macrozheng/mall-learning · error · BadCredentialsException

密码不正确

Error message

密码不正确

What it means

Same as error 5, in mall-tiny-05: login() compares the raw password against the stored BCrypt hash with passwordEncoder.matches and throws BadCredentialsException('密码不正确') on mismatch. The enclosing try/catch (AuthenticationException) logs '登录异常' and returns the still-null token, so the visible symptom is usually an empty token in the response.

Solutions

1. Retry with the correct password or reset it using a BCrypt-encoded value
2. Ensure seed SQL stores BCrypt hashes ($2a$...), not plaintext or MD5
3. Use the same PasswordEncoder for register and login paths
4. Surface the BadCredentialsException to the API response instead of swallowing it

Example fix

// before
} catch (AuthenticationException e) {
    log.warn("登录异常:{}", e.getMessage());
}
return token;
// after
} catch (BadCredentialsException e) {
    log.warn("登录异常:{}", e.getMessage());
    throw new ApiException("密码不正确");
}
return token;

if (!password) throw new Error('密码不能为空');
// verify stored format before match
if (userDetails.getPassword() != null && !userDetails.getPassword().startsWith("$2")) {
    log.error("Non-BCrypt hash stored for user {}", username);
}

try {
    String token = adminService.login(username, password);
    if (StrUtil.isEmpty(token)) return CommonResult.validateFailed("用户名或密码错误");
} catch (BadCredentialsException e) {
    return CommonResult.validateFailed("密码不正确");
}

When it happens

Trigger: Login call with correct username but incorrect password; BCrypt match against the stored hash fails.

Common situations: Password typo, seed users inserted with non-BCrypt hashed or plaintext passwords, mismatched PasswordEncoder configuration between registration and login, DB password manually overwritten.

Related errors

• 密码不正确
• 密码不正确
• 密码不正确
• 密码不正确
• 用户名或密码错误

AI-assisted analysis of macrozheng/mall-learning@cd02c000e5 (2026-09-07). Data as JSON: /api/errors/67d749f9afee2247. Report an issue: GitHub.

Appendix: source

Thrown at mall-tiny-05/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java:106

        }
        return null;
    }

    @Override
    public List<UmsResource> getResourceList() {
        return resourceList;
    }

    @Override
    public String login(String username, String password) {
        String token = null;
        try {
            UserDetails userDetails = getAdminByUsername(username);
            if(userDetails==null){
                return token;
            }
            if (!passwordEncoder.matches(password, userDetails.getPassword())) {
                throw new BadCredentialsException("密码不正确");
            }
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            token = jwtTokenUtil.generateToken(userDetails);
        } catch (AuthenticationException e) {
            log.warn("登录异常:{}", e.getMessage());
        }
        return token;
    }
}

View on GitHub (pinned to cd02c000e5)