{"record":{"id":"9086d180e2c2dade","repo":"qiurunze123/miaosha","slug":"30010-9086d1","errorCode":"30010","errorMessage":"密码错误!","messagePattern":"密码错误!","errorType":"exception","errorClass":"GlobleException","httpStatus":null,"severity":"warning","filePath":"miaosha-v2/miaosha-service/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java","lineNumber":146,"sourceCode":"    }\n\n    public boolean login(HttpServletResponse response, LoginVo loginVo) {\n        if (loginVo == null) {\n            throw new GlobleException(SYSTEM_ERROR);\n        }\n\n        String mobile = loginVo.getNickname();\n        String password = loginVo.getPassword();\n        MiaoshaUser user = getByNickName(mobile);\n        if (user == null) {\n            throw new GlobleException(MOBILE_NOT_EXIST);\n        }\n\n        String dbPass = user.getPassword();\n        String saltDb = user.getSalt();\n        String calcPass = MD5Utils.formPassToDBPass(password, saltDb);\n        if (!calcPass.equals(dbPass)) {\n            throw new GlobleException(PASSWORD_ERROR);\n        }\n        //生成cookie 将session返回游览器 分布式session\n        String token = UUIDUtil.uuid();\n        addCookie(response, token, user);\n        return true;\n    }\n\n\n    public String createToken(HttpServletResponse response, LoginVo loginVo) {\n        if (loginVo == null) {\n            throw new GlobleException(SYSTEM_ERROR);\n        }\n\n        String mobile = loginVo.getNickname();\n        String password = loginVo.getPassword();\n        MiaoshaUser user = getByNickName(mobile);\n        if (user == null) {\n            throw new GlobleException(MOBILE_NOT_EXIST);","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/qiurunze123/miaosha/blob/e58017658e549b63fc4db2160d2325ccd7f8435b/miaosha-v2/miaosha-service/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java#L128-L164","documentation":"Thrown by MiaoShaUserService.login() (miaosha-v2) when the calculated password hash does not equal the stored DB password. Maps to ResultStatus.PASSWORD_ERROR (code 30010, '密码错误!'). The comparison is MD5Utils.formPassToDBPass(password, saltDb) versus user.getPassword(). The hashing expects the client to have already applied one MD5 pass to the plaintext.","triggerScenarios":"POST /login with a LoginVo whose getPassword() value, after double-MD5 with the user's salt, does not match the miaosha_user.password column. Fires on wrong password, missing client-side MD5, or salt mismatch.","commonSituations":"Front-end sends plaintext password instead of the expected MD5-hashed value; the salt changed between registration and login (e.g., password was reset through a different code path); different MD5 encoding (uppercase hex vs lowercase); the user mistyped their password.","solutions":["Confirm the front-end applies MD5 to the password before submitting (formPassToDBPass expects a pre-hashed input).","Verify the salt in miaosha_user.salt matches the salt used during this user's registration.","Reset the password through updatePassword() to restore a known state.","Temporarily log calcPass vs dbPass in a dev environment to diagnose encoding mismatches."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    userService.login(response, loginVo);\n} catch (GlobleException e) {\n    if (e.getStatus() == ResultStatus.PASSWORD_ERROR) {\n        model.addAttribute(\"errmsg\", \"密码错误\");\n        return \"login\";\n    }\n    throw e;\n}","preventionTips":["Confirm the front-end performs client-side MD5 before submitting.","Verify miaosha_user.salt is consistent with registration.","Provide a password-reset flow for repeated failures.","Ensure MD5Utils.formPassToDBPass hex encoding is consistent."],"tags":["authentication","login","password-mismatch","md5","miaosha-v2"],"backgroundTag":null,"analyzedSha":"e58017658e549b63fc4db2160d2325ccd7f8435b","analyzedAt":"2026-08-14T05:22:03.691Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}