flipped-aurora/gin-vue-admin · warning

密码错误

Error message

密码错误

What it means

Login in UserService throws "密码错误" when the user record is found by username but utils.BcryptCheck fails to match the supplied password against the stored bcrypt hash. Authentication is rejected and the caller gets no user object.

Source

Thrown at server/service/system/sys_user.go:62

}

//@author: [piexlmax](https://github.com/piexlmax)
//@author: [SliverHorn](https://github.com/SliverHorn)
//@function: Login
//@description: 用户登录
//@param: u *model.SysUser
//@return: err error, userInter *model.SysUser

func (userService *UserService) Login(ctx context.Context, u *system.SysUser) (userInter *system.SysUser, err error) {
	if nil == global.GVA_DB {
		return nil, fmt.Errorf("db not init")
	}

	var user system.SysUser
	err = global.GVA_DB.WithContext(ctx).Where("username = ?", u.Username).Preload("Authorities").Preload("Authority").Preload("Departments").Preload("Positions").Preload("Dept").First(&user).Error
	if err == nil {
		if ok := utils.BcryptCheck(u.Password, user.Password); !ok {
			return nil, errors.New("密码错误")
		}
		MenuServiceApp.UserAuthorityDefaultRouter(ctx, &user)
	}
	return &user, err
}

//@author: [piexlmax](https://github.com/piexlmax)
//@function: ChangePassword
//@description: 修改用户密码
//@param: u *model.SysUser, newPassword string
//@return: err error

func (userService *UserService) ChangePassword(ctx context.Context, u *system.SysUser, newPassword string) (err error) {
	var user system.SysUser
	err = global.GVA_DB.WithContext(ctx).Select("id, password").Where("id = ?", u.ID).First(&user).Error
	if err != nil {
		return err
	}

View on GitHub (pinned to 3136500ef3)

Solutions

1. Retry with the correct plaintext password (no client-side hashing).
2. Use the password reset / change-password flow to set a new password.
3. As admin, reset the user's password via the user management API.
4. Trim accidental whitespace from the password field before submitting.

Example fix

// before
pwd := utils.BcryptHash(rawPwd) // double hashing breaks bcrypt compare
svc.Login(ctx, system.SysUser{Username: "alice", Password: pwd})

// after
svc.Login(ctx, system.SysUser{Username: "alice", Password: rawPwd})

if strings.TrimSpace(password) == "" || strings.TrimSpace(username) == "" {
    return errors.New("username and password are required")
}

user, err := userService.Login(ctx, system.SysUser{Username: name, Password: pwd})
if err != nil {
    if strings.Contains(err.Error(), "密码错误") {
        http.Error(w, "invalid credentials", http.StatusUnauthorized)
        return
    }
    http.Error(w, err.Error(), http.StatusInternalServerError)
}

When it happens

Trigger: Submitting the login API with a password that doesn't match the stored hash; logging in after a password reset/change elsewhere; a client hashing or encoding the password before sending it while the server expects the plaintext to compare via bcrypt.

Common situations: Caps lock / keyboard layout issues; stale credentials cached in frontend storage; password containing leading/trailing whitespace; accounts created via seeding or import with unknown passwords; password field double-hashed client-side.

Related errors

• 原密码错误
• 当前响应不支持流式输出
• 当前响应不支持流式输出
• 未找到 MCP 独立配置文件，请在当前目录、cmd/mcp 目录或通过 -config / GVA_MCP_CONFIG
• 未能自动识别项目根目录，请在 MCP 配置中设置 autocode.root

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/e12bd9ed90ae7eea. Report an issue: GitHub.