{"record":{"id":"02dc8871c6e5203f","repo":"macrozheng/mall-learning","slug":"error-02dc88","errorCode":null,"errorMessage":"密码不正确","messagePattern":"密码不正确","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":null,"severity":"error","filePath":"mall-tiny-06/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java","lineNumber":106,"sourceCode":"        }\n        return null;\n    }\n\n    @Override\n    public List<UmsResource> getResourceList() {\n        return resourceList;\n    }\n\n    @Override\n    public String login(String username, String password) {\n        String token = null;\n        try {\n            UserDetails userDetails = getAdminByUsername(username);\n            if(userDetails==null){\n                return token;\n            }\n            if (!passwordEncoder.matches(password, userDetails.getPassword())) {\n                throw new BadCredentialsException(\"密码不正确\");\n            }\n            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());\n            SecurityContextHolder.getContext().setAuthentication(authentication);\n            token = jwtTokenUtil.generateToken(userDetails);\n        } catch (AuthenticationException e) {\n            log.warn(\"登录异常:{}\", e.getMessage());\n        }\n        return token;\n    }\n}\n","sourceCodeStart":88,"sourceCodeEnd":117,"githubUrl":"https://github.com/macrozheng/mall-learning/blob/cd02c000e57c693e49f1f72986dbfa6e4c952e09/mall-tiny-06/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java#L88-L117","documentation":"In mall-tiny-06, login() throws BadCredentialsException('密码不正确') when passwordEncoder.matches fails, meaning the supplied password does not hash to the stored BCrypt value. Spring Security treats this as an authentication failure; the method's catch block logs it and returns an empty token string.","triggerScenarios":"Authenticate with a known username and a wrong password; the matches() check fails and the exception is thrown.","commonSituations":"Typos, plaintext passwords in seeded DB rows, changed or mismatched PasswordEncoder bean, passwords updated directly in the database without re-encoding, multiple environments with different user passwords.","solutions":["Reset the password with a properly BCrypt-encoded hash","Verify the stored hash format ($2a$...) matches the configured encoder","Keep register and login using the same PasswordEncoder","Fix the swallow-catch so the caller gets a meaningful login-failure response"],"exampleFix":"// before\nif (!passwordEncoder.matches(password, userDetails.getPassword())) {\n    throw new BadCredentialsException(\"密码不正确\");\n}\n// after\nif (!passwordEncoder.matches(password, userDetails.getPassword())) {\n    log.warn(\"Wrong password attempt for: {}\", username);\n    throw new BadCredentialsException(\"密码不正确\");\n}","handlingStrategy":"try-catch","validationCode":"if (password == null || password.isEmpty()) throw new IllegalArgumentException(\"密码不能为空\");\nString stored = userDetails.getPassword();\nif (stored == null || !stored.matches(\"^\\\\$2[aby]\\\\$.*\")) log.warn(\"Stored password not BCrypt for {}\", username);","typeGuard":null,"tryCatchPattern":"try {\n    String token = adminService.login(username, password);\n} catch (BadCredentialsException e) {\n    log.warn(\"Wrong password for {}\", username);\n    throw new ApiException(\"密码不正确\");\n}","preventionTips":["Use one PasswordEncoder instance everywhere (define a single @Bean)","Hash passwords at registration with passwordEncoder.encode()","Re-encode seed data if the encoder version/ID changes","Surface login failures as API errors instead of returning null token"],"tags":["spring-security","bcrypt","authentication","login"],"backgroundTag":"invalid-credentials","analyzedSha":"cd02c000e57c693e49f1f72986dbfa6e4c952e09","analyzedAt":"2026-09-07T23:16:08.059Z","contentChangedAt":"2026-09-07T23:16:08.059Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}