What causes "密码不正确" in macrozheng/mall-learning?

Use/reset the correct password (store a BCrypt hash, e.g. new BCryptPasswordEncoder().encode("..."))

macrozheng/mall-learning · error · BadCredentialsException

密码不正确

Error message

密码不正确

What it means

mall-tiny-07's login() throws BadCredentialsException('密码不正确') when the submitted password fails the BCrypt match against the stored hash. This is the expected Spring Security path for wrong passwords in programmatic authentication, and it is caught by the local AuthenticationException handler which logs and returns an empty token.

Solutions

Use/reset the correct password (store a BCrypt hash, e.g. new BCryptPasswordEncoder().encode("..."))
Check the ums_admin.password format matches the configured PasswordEncoder
Align register/login encoder beans
Return a clear error to the API caller instead of only logging

Example fix

// before
catch (AuthenticationException e) {
    log.warn("登录异常:{}", e.getMessage());
}
// after
catch (BadCredentialsException e) {
    log.warn("登录异常:{}", e.getMessage());
    throw new BadCredentialsException("密码不正确");
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (!password) throw new Error('密码不能为空');
// check hash format before matching
boolean bcrypt = userDetails.getPassword() != null && userDetails.getPassword().startsWith("$2");
if (!bcrypt) log.error("Password for {} is not BCrypt-encoded", username);

Try / catch

try {
    String token = adminService.login(username, password);
    if (StrUtil.isBlank(token)) throw new ApiException("登录失败，请检查用户名和密码");
} catch (BadCredentialsException e) {
    throw new ApiException("密码不正确");
}

Prevention

Verify seeded passwords are BCrypt hashes before deploying
Never change PasswordEncoder without migrating existing hashes
Log failed attempts (with rate limiting) for security monitoring
Return explicit errors rather than an empty token string

When it happens

Trigger: Login attempt with valid username, wrong password — passwordEncoder.matches(password, userDetails.getPassword()) returns false.

Common situations: User mistypes password, seed data not BCrypt-encoded, encoder mismatch after config change, manually edited DB passwords, environment where the expected default password differs.

Related errors

AI-assisted analysis of macrozheng/mall-learning@cd02c000e5 (2026-09-07). Data as JSON: /api/errors/bdcf78dd3437e080. Report an issue: GitHub.

Appendix: source

Thrown at mall-tiny-07/src/main/java/com/macro/mall/tiny/service/impl/UmsAdminServiceImpl.java:106

        }
        return null;
    }

    @Override
    public List<UmsResource> getResourceList() {
        return resourceList;
    }

    @Override
    public String login(String username, String password) {
        String token = null;
        try {
            UserDetails userDetails = getAdminByUsername(username);
            if(userDetails==null){
                return token;
            }
            if (!passwordEncoder.matches(password, userDetails.getPassword())) {
                throw new BadCredentialsException("密码不正确");
            }
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
            token = jwtTokenUtil.generateToken(userDetails);
        } catch (AuthenticationException e) {
            log.warn("登录异常:{}", e.getMessage());
        }
        return token;
    }
}

View on GitHub (pinned to cd02c000e5)