{"record":{"id":"275dde57e9ea85c5","repo":"shuzheng/zheng","slug":"incorrectcredentialsexception","errorCode":null,"errorMessage":"IncorrectCredentialsException","messagePattern":"IncorrectCredentialsException","errorType":"exception","errorClass":"IncorrectCredentialsException","httpStatus":null,"severity":"warning","filePath":"zheng-upms/zheng-upms-client/src/main/java/com/zheng/upms/client/shiro/realm/UpmsRealm.java","lineNumber":91,"sourceCode":"     */\n    @Override\n    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {\n        String username = (String) authenticationToken.getPrincipal();\n        String password = new String((char[]) authenticationToken.getCredentials());\n        // client无密认证\n        String upmsType = PropertiesFileUtil.getInstance(\"zheng-upms-client\").get(\"zheng.upms.type\");\n        if (\"client\".equals(upmsType)) {\n            return new SimpleAuthenticationInfo(username, password, getName());\n        }\n\n        // 查询用户信息\n        UpmsUser upmsUser = upmsApiService.selectUpmsUserByUsername(username);\n\n        if (null == upmsUser) {\n            throw new UnknownAccountException();\n        }\n        if (!upmsUser.getPassword().equals(MD5Util.md5(password + upmsUser.getSalt()))) {\n            throw new IncorrectCredentialsException();\n        }\n        if (upmsUser.getLocked() == 1) {\n            throw new LockedAccountException();\n        }\n\n        return new SimpleAuthenticationInfo(username, password, getName());\n    }\n\n}\n","sourceCodeStart":73,"sourceCodeEnd":101,"githubUrl":"https://github.com/shuzheng/zheng/blob/7005c0a775e6d014d1dc8a8a809f7b1c13bf785a/zheng-upms/zheng-upms-client/src/main/java/com/zheng/upms/client/shiro/realm/UpmsRealm.java#L73-L101","documentation":"UpmsRealm throws Shiro's IncorrectCredentialsException when the stored MD5 hash (MD5(password + salt)) does not match the submitted password's computed hash. The account exists but the password is wrong.","triggerScenarios":"Subject.login with a password whose MD5(password + user.salt) differs from upmsUser.getPassword(); happens on wrong password, or when the salt/hash was changed or migrated inconsistently.","commonSituations":"User mistypes password; password stored with a different hashing scheme (plain MD5, different salt placement) than the realm expects; user record imported from another system without re-hashing; caps-lock/encoding issues.","solutions":["Retry with the correct password and provide a reset-password flow for forgotten ones.","Verify stored password equals MD5Util.md5(password + salt) for the row; re-hash if data was migrated with a different algorithm.","Ensure the same MD5Util/salt concatenation order is used everywhere (registration/update vs. verification).","Catch IncorrectCredentialsException in the login controller and return a user-friendly error."],"exampleFix":"// before\nboolean ok = upmsUser.getPassword().equals(MD5Util.md5(password + upmsUser.getSalt())); // throws upstream on mismatch\n// after\ntry {\n    currentUser.login(token);\n} catch (IncorrectCredentialsException ice) {\n    model.addAttribute(\"error\", \"密码错误\");\n    return \"login\";\n}","handlingStrategy":"try-catch","validationCode":"UpmsUser u = upmsApiService.selectUpmsUserByUsername(username);\nboolean passwordOk = u != null && u.getPassword().equals(MD5Util.md5(password + u.getSalt()));","typeGuard":null,"tryCatchPattern":"try {\n    currentUser.login(token);\n} catch (IncorrectCredentialsException e) {\n    model.addAttribute(\"error\", \"账号或密码错误\");\n    return \"login\";\n}","preventionTips":["Always hash with the same scheme (MD5(password + salt)) on create/update as on verify.","Provide a self-service password reset flow.","Catch IncorrectCredentialsException and lock out after repeated failures with rate limiting.","When migrating users from other systems, re-hash passwords consistently.","Catch all of Unknown/Incorrect/Locked together via Shiro's AuthenticationException base where appropriate."],"tags":["authentication","shiro","password","md5"],"backgroundTag":"incorrect-credentials-exception","analyzedSha":"7005c0a775e6d014d1dc8a8a809f7b1c13bf785a","analyzedAt":"2026-09-04T16:58:32.852Z","contentChangedAt":"2026-09-04T16:58:32.852Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}