{"record":{"id":"a04a161f7318b6db","repo":"paascloud/paascloud-master","slug":"error-a04a16","errorCode":null,"errorMessage":"用户名不存在或者密码错误","messagePattern":"用户名不存在或者密码错误","errorType":"http","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/security/UacUserDetailsServiceImpl.java","lineNumber":38,"sourceCode":"@Component\npublic class UacUserDetailsServiceImpl implements UserDetailsService {\n\n\t@Resource\n\tprivate UacUserService uacUserService;\n\n\t/**\n\t * Load user by username user details.\n\t *\n\t * @param username the username\n\t *\n\t * @return the user details\n\t */\n\t@Override\n\tpublic UserDetails loadUserByUsername(String username) {\n\t\tCollection<GrantedAuthority> grantedAuthorities;\n\t\tUacUser user = uacUserService.findByLoginName(username);\n\t\tif (user == null) {\n\t\t\tthrow new BadCredentialsException(\"用户名不存在或者密码错误\");\n\t\t}\n\t\tuser = uacUserService.findUserInfoByUserId(user.getId());\n\t\tgrantedAuthorities = uacUserService.loadUserAuthorities(user.getId());\n\t\treturn new SecurityUser(user.getId(), user.getLoginName(), user.getLoginPwd(),\n\t\t\t\tuser.getUserName(), user.getGroupId(), user.getGroupName(), user.getStatus(), grantedAuthorities);\n\t}\n}\n","sourceCodeStart":20,"sourceCodeEnd":46,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/security/UacUserDetailsServiceImpl.java#L20-L46","documentation":"UacUserDetailsServiceImpl.loadUserByUsername throws BadCredentialsException(\"用户名不存在或者密码错误\") when uacUserService.findByLoginName(username) returns null during Spring Security authentication. Spring Security deliberately reports a generic message so attackers cannot distinguish unknown usernames from wrong passwords.","triggerScenarios":"Authenticating (form login or the /user/login flow) with a loginName that has no matching row in the uac_user table.","commonSituations":"User typed wrong username or an email/phone instead of loginName; user never registered or was soft-deleted; case-sensitivity mismatch in login name; connecting to a DB where the account does not exist.","solutions":["Verify the exact loginName exists: SELECT * FROM uac_user WHERE login_name = ?","Confirm the user is registering/logging in with the loginName field, not email or mobile","Check for leading/trailing spaces or case differences in the submitted username","If the account should exist, re-register or restore the user record"],"exampleFix":"// before\nuacUserService.login(\"john@example.com\", pwd); // email used as loginName\n// after\nUacUser u = uacUserService.findByLoginName(\"john\"); // use the actual login_name column value","handlingStrategy":"try-catch","validationCode":"boolean exists = userService.findByLoginName(username) != null; // or SELECT 1 FROM uac_user WHERE login_name = ?","typeGuard":null,"tryCatchPattern":"try { authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password)); } catch (BadCredentialsException e) { throw new LoginException(\"用户名不存在或者密码错误\"); }","preventionTips":["Always authenticate with the login_name column value, not email or phone","Trim and normalize username input before submitting","Provide clear UI feedback that distinguishes 'check credentials' without leaking which part was wrong","Seed test users in every environment's DB before running integration tests"],"tags":["spring-security","authentication","bad-credentials","user"],"backgroundTag":"user-not-found","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}