What causes "密码不正确" in macrozheng/mall-learning?

Reset the password with a properly BCrypt-encoded hash

macrozheng/mall-learning · error · BadCredentialsException

密码不正确

Error message

密码不正确

What it means

In mall-tiny-06, login() throws BadCredentialsException('密码不正确') when passwordEncoder.matches fails, meaning the supplied password does not hash to the stored BCrypt value. Spring Security treats this as an authentication failure; the method's catch block logs it and returns an empty token string.

Solutions

Reset the password with a properly BCrypt-encoded hash
Verify the stored hash format ($2a$...) matches the configured encoder
Keep register and login using the same PasswordEncoder
Fix the swallow-catch so the caller gets a meaningful login-failure response

Example fix

// before
if (!passwordEncoder.matches(password, userDetails.getPassword())) {
    throw new BadCredentialsException("密码不正确");
}
// after
if (!passwordEncoder.matches(password, userDetails.getPassword())) {
    log.warn("Wrong password attempt for: {}", username);
    throw new BadCredentialsException("密码不正确");
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (password == null || password.isEmpty()) throw new IllegalArgumentException("密码不能为空");
String stored = userDetails.getPassword();
if (stored == null || !stored.matches("^\\$2[aby]\\$.*")) log.warn("Stored password not BCrypt for {}", username);

Try / catch

try {
    String token = adminService.login(username, password);
} catch (BadCredentialsException e) {
    log.warn("Wrong password for {}", username);
    throw new ApiException("密码不正确");
}

Prevention

Use one PasswordEncoder instance everywhere (define a single @Bean)
Hash passwords at registration with passwordEncoder.encode()
Re-encode seed data if the encoder version/ID changes
Surface login failures as API errors instead of returning null token

When it happens

Trigger: Authenticate with a known username and a wrong password; the matches() check fails and the exception is thrown.

Common situations: Typos, plaintext passwords in seeded DB rows, changed or mismatched PasswordEncoder bean, passwords updated directly in the database without re-encoding, multiple environments with different user passwords.

Related errors

AI-assisted analysis of macrozheng/mall-learning@cd02c000e5 (2026-09-07). Data as JSON: /api/errors/02dc8871c6e5203f. Report an issue: GitHub.

Appendix: source

Thrown at mall-tiny-06/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java:106

        }
        return null;
    }

    @Override
    public List<UmsResource> getResourceList() {
        return resourceList;
    }

    @Override
    public String login(String username, String password) {
        String token = null;
        try {
            UserDetails userDetails = getAdminByUsername(username);
            if(userDetails==null){
                return token;
            }
            if (!passwordEncoder.matches(password, userDetails.getPassword())) {
                throw new BadCredentialsException("密码不正确");
            }
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            token = jwtTokenUtil.generateToken(userDetails);
        } catch (AuthenticationException e) {
            log.warn("登录异常:{}", e.getMessage());
        }
        return token;
    }
}

View on GitHub (pinned to cd02c000e5)