What causes "用户名或密码错误" in macrozheng/mall-learning?

Verify the admin row exists in ums_admin for the given username

macrozheng/mall-learning · error · UsernameNotFoundException

用户名或密码错误

Error message

用户名或密码错误

What it means

In mall-tiny-07 the UserDetailsService bean throws UsernameNotFoundException with message '用户名或密码错误' when getAdminByUsername returns null. This is the standard Spring Security mechanism for signaling an unknown principal during authentication; the generic message intentionally hides whether the user exists.

Solutions

Verify the admin row exists in ums_admin for the given username
Load seed data (mall_tiny.sql) into the database configured in application.yml
Double-check the active Spring profile and datasource URL
Create the user via the register endpoint

Example fix

// before
AdminUserDetails admin = adminService.getAdminByUsername(username);
if (admin != null) { return admin; }
throw new UsernameNotFoundException("用户名或密码错误");
// after
AdminUserDetails admin = adminService.getAdminByUsername(username == null ? "" : username.trim());
if (admin != null) { return admin; }
throw new UsernameNotFoundException("用户名或密码错误");

Defensive patterns

Strategy: try-catch

Validate before calling

const username = (form.username || '').trim();
if (!username) throw new Error('用户名不能为空');

Try / catch

try {
    authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
} catch (BadCredentialsException e) {
    throw new ApiException("用户名或密码错误");
}

Prevention

Run schema+data migrations so admin users always exist
Pin datasource config per environment and smoke-test login after deploy
Register users through the API instead of manual inserts
Never return 'user not found' to clients — keep the generic message

When it happens

Trigger: Any authentication attempt (e.g. POST /admin/login) where the username is not present in the ums_admin table.

Common situations: Database not seeded, app connected to wrong schema, user account removed, typo/case-sensitivity in username, frontend form submitting empty string.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of macrozheng/mall-learning@cd02c000e5 (2026-09-07). Data as JSON: /api/errors/61106fc835cf2b19. Report an issue: GitHub.

Appendix: source

Thrown at mall-tiny-07/src/main/java/com/macro/mall/tiny/config/MallSecurityConfig.java:31

 * @description 自定义配置，用于配置如何获取用户信息
 * @date 2022/5/20
 * @github https://github.com/macrozheng
 */
@Configuration
public class MallSecurityConfig {

    @Autowired
    private UmsAdminService adminService;

    @Bean
    public UserDetailsService userDetailsService() {
        //获取登录用户信息
        return username -> {
            AdminUserDetails admin = adminService.getAdminByUsername(username);
            if (admin != null) {
                return admin;
            }
            throw new UsernameNotFoundException("用户名或密码错误");
        };
    }
}

View on GitHub (pinned to cd02c000e5)