{"record":{"id":"bdcf78dd3437e080","repo":"macrozheng/mall-learning","slug":"error-bdcf78","errorCode":null,"errorMessage":"密码不正确","messagePattern":"密码不正确","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":null,"severity":"error","filePath":"mall-tiny-07/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java","lineNumber":106,"sourceCode":"        }\n        return null;\n    }\n\n    @Override\n    public List<UmsResource> getResourceList() {\n        return resourceList;\n    }\n\n    @Override\n    public String login(String username, String password) {\n        String token = null;\n        try {\n            UserDetails userDetails = getAdminByUsername(username);\n            if(userDetails==null){\n                return token;\n            }\n            if (!passwordEncoder.matches(password, userDetails.getPassword())) {\n                throw new BadCredentialsException(\"密码不正确\");\n            }\n            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());\n            SecurityContextHolder.getContext().setAuthentication(authentication);\n            token = jwtTokenUtil.generateToken(userDetails);\n        } catch (AuthenticationException e) {\n            log.warn(\"登录异常:{}\", e.getMessage());\n        }\n        return token;\n    }\n}\n","sourceCodeStart":88,"sourceCodeEnd":117,"githubUrl":"https://github.com/macrozheng/mall-learning/blob/cd02c000e57c693e49f1f72986dbfa6e4c952e09/mall-tiny-07/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java#L88-L117","documentation":"mall-tiny-07's login() throws BadCredentialsException('密码不正确') when the submitted password fails the BCrypt match against the stored hash. This is the expected Spring Security path for wrong passwords in programmatic authentication, and it is caught by the local AuthenticationException handler which logs and returns an empty token.","triggerScenarios":"Login attempt with valid username, wrong password — passwordEncoder.matches(password, userDetails.getPassword()) returns false.","commonSituations":"User mistypes password, seed data not BCrypt-encoded, encoder mismatch after config change, manually edited DB passwords, environment where the expected default password differs.","solutions":["Use/reset the correct password (store a BCrypt hash, e.g. new BCryptPasswordEncoder().encode(\"...\"))","Check the ums_admin.password format matches the configured PasswordEncoder","Align register/login encoder beans","Return a clear error to the API caller instead of only logging"],"exampleFix":"// before\ncatch (AuthenticationException e) {\n    log.warn(\"登录异常:{}\", e.getMessage());\n}\n// after\ncatch (BadCredentialsException e) {\n    log.warn(\"登录异常:{}\", e.getMessage());\n    throw new BadCredentialsException(\"密码不正确\");\n}","handlingStrategy":"try-catch","validationCode":"if (!password) throw new Error('密码不能为空');\n// check hash format before matching\nboolean bcrypt = userDetails.getPassword() != null && userDetails.getPassword().startsWith(\"$2\");\nif (!bcrypt) log.error(\"Password for {} is not BCrypt-encoded\", username);","typeGuard":null,"tryCatchPattern":"try {\n    String token = adminService.login(username, password);\n    if (StrUtil.isBlank(token)) throw new ApiException(\"登录失败，请检查用户名和密码\");\n} catch (BadCredentialsException e) {\n    throw new ApiException(\"密码不正确\");\n}","preventionTips":["Verify seeded passwords are BCrypt hashes before deploying","Never change PasswordEncoder without migrating existing hashes","Log failed attempts (with rate limiting) for security monitoring","Return explicit errors rather than an empty token string"],"tags":["spring-security","bcrypt","authentication","login"],"backgroundTag":"invalid-credentials","analyzedSha":"cd02c000e57c693e49f1f72986dbfa6e4c952e09","analyzedAt":"2026-09-07T23:16:08.059Z","contentChangedAt":"2026-09-07T23:16:08.059Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}