What is the method signature for hashing password?
-
String hashPassword(String password)
-
String hashPassword(String password, String accountName)
-
String hashpassword(String password)
-
None of the above
The hashPassword method requiring both password and accountName parameters allows for account-specific salting, which improves security by preventing the same password from hashing identically across different accounts. The single-parameter versions would be less secure. Option C is incorrect due to incorrect method naming convention (lowercase 'p').
In ESAPI's Authenticator interface, password hashing is defined as String hashPassword(String password, String accountName) — the account name is mixed in (acting like a per-user salt) so that two users with the same password don't produce the same hash. A signature without the account name parameter wouldn't provide that per-user uniqueness, which is why the two-argument form is the actual API contract.