{"record":{"id":"a97f92cab4b485cc","repo":"qiurunze123/miaosha","slug":"30010","errorCode":"30010","errorMessage":"密码错误!","messagePattern":"密码错误!","errorType":"exception","errorClass":"GlobleException","httpStatus":null,"severity":"warning","filePath":"miaosha-v1/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java","lineNumber":128,"sourceCode":"    }\n\n    public boolean login(HttpServletResponse response, LoginVo loginVo) {\n        if (loginVo == null) {\n            throw new GlobleException(SYSTEM_ERROR);\n        }\n\n        String mobile = loginVo.getMobile();\n        String password = loginVo.getPassword();\n        MiaoshaUser user = getByNickName(mobile);\n        if (user == null) {\n            throw new GlobleException(MOBILE_NOT_EXIST);\n        }\n\n        String dbPass = user.getPassword();\n        String saltDb = user.getSalt();\n        String calcPass = MD5Utils.formPassToDBPass(password, saltDb);\n        if (!calcPass.equals(dbPass)) {\n            throw new GlobleException(PASSWORD_ERROR);\n        }\n        //生成cookie 将session返回游览器 分布式session\n        String token = UUIDUtil.uuid();\n        addCookie(response, token, user);\n        return true;\n    }\n\n\n    public String createToken(HttpServletResponse response, LoginVo loginVo) {\n        if (loginVo == null) {\n            throw new GlobleException(SYSTEM_ERROR);\n        }\n\n        String mobile = loginVo.getMobile();\n        String password = loginVo.getPassword();\n        MiaoshaUser user = getByNickName(mobile);\n        if (user == null) {\n            throw new GlobleException(MOBILE_NOT_EXIST);","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/qiurunze123/miaosha/blob/e58017658e549b63fc4db2160d2325ccd7f8435b/miaosha-v1/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java#L110-L146","documentation":"Thrown by MiaoShaUserService.login() (miaosha-v1) when the MD5-hashed password submitted by the user does not equal the stored DB password hash. Maps to ResultStatus.PASSWORD_ERROR (code 30010, '密码错误!'). The comparison is calcPass = MD5Utils.formPassToDBPass(password, saltDb) checked against dbPass = user.getPassword(). If they differ, the password is wrong or the salting/hashing pipeline is inconsistent.","triggerScenarios":"POST /login with a LoginVo whose getPassword() value, after double-MD5 (MD5(MD5(password) + salt)), does not match the password column in miaosha_user. This fires when the user typed the wrong password, or when the front-end did not perform the first MD5 pass that the back-end expects.","commonSituations":"The front-end skipped the client-side MD5 (formPassToDBPass expects a pre-hashed input); the salt was regenerated after registration but the old password hash remains; passwords were migrated from another system with a different hashing scheme; the user simply mistyped their password.","solutions":["Confirm the front-end performs MD5 on the plaintext password before sending it (the back-end applies a second MD5 with the DB salt).","Verify the salt stored at registration matches the salt used during login by checking the miaosha_user.salt column.","Reset the password via updatePassword() with a known value if the hash pipeline is inconsistent.","Check that MD5Utils.formPassToDBPass uses the same algorithm on both register and login code paths."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    userService.login(response, loginVo);\n} catch (GlobleException e) {\n    if (e.getStatus() == ResultStatus.PASSWORD_ERROR) {\n        model.addAttribute(\"errmsg\", \"密码错误\");\n        return \"login\";\n    }\n    throw e;\n}","preventionTips":["Confirm the front-end performs the client-side MD5 pass before submitting the password.","Verify the salt in miaosha_user matches the registration-time salt.","Provide a password-reset flow for users who repeatedly hit this error.","Ensure MD5Utils.formPassToDBPass uses consistent hex encoding across paths."],"tags":["authentication","login","password-mismatch","md5","miaosha-v1"],"backgroundTag":null,"analyzedSha":"e58017658e549b63fc4db2160d2325ccd7f8435b","analyzedAt":"2026-08-14T05:22:03.691Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}