{"record":{"id":"721f63a0bff4c8a7","repo":"MyCATApache/Mycat-Server","slug":"user-user-passwrod-need-to-decrype-but-decrype","errorCode":null,"errorMessage":"user {user} passwrod need to decrype ,but decrype password is wrong !","messagePattern":"user (.+?) passwrod need to decrype ,but decrype password is wrong !","errorType":"exception","errorClass":"ConfigException","httpStatus":null,"severity":"error","filePath":"src/main/java/io/mycat/util/DecryptUtil.java","lineNumber":89,"sourceCode":"        + \"\\t\\t<property name=\\\"schemas\\\">TESTDB</property>\");\n\t\tString password = args[0];\n\t\tSystem.out.println(encrypt(password));\n\t}\n\t\n\tpublic static String mycatDecrypt(String usingDecrypt,String user ,String passwrod){\n\t\tif(\"1\".equals(usingDecrypt)||\"true\".equalsIgnoreCase(usingDecrypt)){\n        \t//type:user:password\n        \t//0:test:test\n        \tboolean flag = false;\n        \ttry {\n        \t\tString passwrods[] = DecryptUtil.decrypt(passwrod).split(\":\");\n            \tif(\"0\".equals(passwrods[0])\n\t\t\t\t\t\t&& user.equals(passwrods[1])){\n                        flag = true;\n            \t\t\treturn passwrods[2];\n            \t}\n            \tif(flag==false){\n            \t\t throw new ConfigException(\"user \" + user + \" passwrod need to decrype ,but decrype password is wrong !\");\n            \t}\n        \t} catch (Exception e2) {\n       \t\t    throw new ConfigException(\"user \" + user + \" passwrod need to decrype ,but decrype password is wrong !\",e2);\n\t\t\t}\n\t\t}\n\t\treturn passwrod;\n\t}\n\tpublic static String DBHostDecrypt(String usingDecrypt,String host,String user ,String passwrod){\n\t\tif(\"1\".equals(usingDecrypt)||\"true\".equalsIgnoreCase(usingDecrypt)){\n\t\t\t//type:host:user:password\n        \t//1:myhost1:test:test\n        \tboolean flag = false;\n        \ttry {\n        \t\tString passwrods[] = DecryptUtil.decrypt(passwrod).split(\":\");\n            \tif(\"1\".equals(passwrods[0]) && host.equals(passwrods[1]) && user.equals(passwrods[2])){\n            \t\treturn passwrods[3];\n            \t}\n            \tif(flag==false){","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/MyCATApache/Mycat-Server/blob/65f8d8beb752f935752f2a0eec0ab017facab9ef/src/main/java/io/mycat/util/DecryptUtil.java#L71-L107","documentation":"DecryptUtil.mycatDecrypt decrypts an encrypted Mycat user credential of the form 'encrypted:user:password'. After decryption it verifies the version flag ('0') and that the decrypted user matches the expected user; if verification fails or decryption throws, it wraps the problem in a ConfigException saying the encrypted password is wrong.","triggerScenarios":"server.xml/user config with usingDecrypt enabled and a password that does not decrypt to '0:<user>:<password>' matching the configured user name; corrupt or wrongly generated encrypted string; user renamed without re-encrypting.","commonSituations":"Regenerating passwords with a different Mycat encode tool version; copying an encrypted password between users; typos in the encrypted string; enabling usingDecrypt but leaving plaintext passwords.","solutions":["Re-encrypt the credential with the correct tool (Mycat encode for version 0) and update server.xml.","Ensure the encrypted payload's embedded username matches the configured user exactly.","Verify the format: decrypt(password) must yield '0:user:password'.","Set usingDecrypt to false/remove it if you intend to use plaintext passwords."],"exampleFix":"// before\n<user name=\"app\" usingDecrypt=\"1\" password=\"WRONGENCRYPTED\"/>\n// after\n<user name=\"app\" usingDecrypt=\"1\" password=\"<correctly encoded 0:app:secret>\"/>","handlingStrategy":"validation","validationCode":"// verify encrypted credential before applying config\nString decoded = new String(java.util.Base64.getDecoder().decode(encPassword));\nString[] parts = decoded.split(\":\");\nif (!(\"0\".equals(parts[0]) && user.equals(parts[1]) && parts.length == 3))\n    throw new IllegalStateException(\"encrypted password does not match user \" + user);","typeGuard":null,"tryCatchPattern":"try { loadMycatConfig(); } catch (ConfigException e) { if (e.getMessage().contains(\"decrype\")) { reencryptCredentials(cfg); loadMycatConfig(); } else throw e; }","preventionTips":["Generate encrypted passwords only with the matching Mycat version's tool.","Re-encrypt whenever a user name changes.","Keep usingDecrypt flag in sync with whether passwords are actually encrypted."],"tags":["config","password","decryption"],"backgroundTag":"invalid-config-value","analyzedSha":"65f8d8beb752f935752f2a0eec0ab017facab9ef","analyzedAt":"2026-09-11T00:12:21.696Z","contentChangedAt":"2026-09-11T00:12:21.696Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}