What causes "密码不正确" in macrozheng/mall-learning?

Reset the password with a BCrypt-encoded hash matching the configured encoder

macrozheng/mall-learning · error · BadCredentialsException

密码不正确

Error message

密码不正确

What it means

mall-tiny-08's login() throws BadCredentialsException('密码不正确') when passwordEncoder.matches fails — the provided password does not correspond to the stored BCrypt hash for that admin. The surrounding catch(AuthenticationException) logs '登录异常' and returns the empty token, hiding the failure from the caller.

Solutions

Reset the password with a BCrypt-encoded hash matching the configured encoder
Verify stored hashes are BCrypt format ($2a$/$2b$...)
Ensure the same PasswordEncoder is used for register and login
Improve error surfacing: propagate BadCredentialsException as a proper API error

Example fix

// before
if (!passwordEncoder.matches(password, userDetails.getPassword())) {
    throw new BadCredentialsException("密码不正确");
}
// after
if (!passwordEncoder.matches(password, userDetails.getPassword())) {
    log.warn("Invalid password for user: {}", username);
    throw new BadCredentialsException("密码不正确");
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (password == null || password.isEmpty()) return CommonResult.validateFailed("密码不能为空");
String stored = userDetails != null ? userDetails.getPassword() : null;
if (stored != null && !stored.startsWith("$2")) log.error("Stored password not BCrypt: {}", username);

Try / catch

try {
    String token = adminService.login(username, password);
} catch (BadCredentialsException e) {
    log.warn("登录异常:{}", e.getMessage());
    return CommonResult.failed("用户名或密码错误");
}

Prevention

Encode every password with passwordEncoder.encode() at creation
Match the encoder between register and login paths
Avoid manual DB password updates without re-encoding
Distinguish empty-token (unknown user) vs wrong-password cases in logs

When it happens

Trigger: POST /admin/login (or login() call) with correct username and wrong password; matches() returns false and the exception is thrown.

Common situations: Password typo, seed users with plaintext or MD5 passwords instead of BCrypt, PasswordEncoder bean changed after user creation, direct DB password edits, copied user rows across environments with different passwords.

Related errors

AI-assisted analysis of macrozheng/mall-learning@cd02c000e5 (2026-09-07). Data as JSON: /api/errors/463b316b72874972. Report an issue: GitHub.

Appendix: source

Thrown at mall-tiny-08/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java:106

        }
        return null;
    }

    @Override
    public List<UmsResource> getResourceList() {
        return resourceList;
    }

    @Override
    public String login(String username, String password) {
        String token = null;
        try {
            UserDetails userDetails = getAdminByUsername(username);
            if(userDetails==null){
                return token;
            }
            if (!passwordEncoder.matches(password, userDetails.getPassword())) {
                throw new BadCredentialsException("密码不正确");
            }
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            token = jwtTokenUtil.generateToken(userDetails);
        } catch (AuthenticationException e) {
            log.warn("登录异常:{}", e.getMessage());
        }
        return token;
    }
}

View on GitHub (pinned to cd02c000e5)