qiurunze123/miaosha · warning · GlobleException

30010

30010

Error message

密码错误!

What it means

Thrown by MiaoShaUserService.login() (miaosha-v2) when the calculated password hash does not equal the stored DB password. Maps to ResultStatus.PASSWORD_ERROR (code 30010, '密码错误!'). The comparison is MD5Utils.formPassToDBPass(password, saltDb) versus user.getPassword(). The hashing expects the client to have already applied one MD5 pass to the plaintext.

Solutions

  1. Confirm the front-end applies MD5 to the password before submitting (formPassToDBPass expects a pre-hashed input).
  2. Verify the salt in miaosha_user.salt matches the salt used during this user's registration.
  3. Reset the password through updatePassword() to restore a known state.
  4. Temporarily log calcPass vs dbPass in a dev environment to diagnose encoding mismatches.
Defensive patterns

Strategy: try-catch

Try / catch

try {
    userService.login(response, loginVo);
} catch (GlobleException e) {
    if (e.getStatus() == ResultStatus.PASSWORD_ERROR) {
        model.addAttribute("errmsg", "密码错误");
        return "login";
    }
    throw e;
}

Prevention

When it happens

Trigger: POST /login with a LoginVo whose getPassword() value, after double-MD5 with the user's salt, does not match the miaosha_user.password column. Fires on wrong password, missing client-side MD5, or salt mismatch.

Common situations: Front-end sends plaintext password instead of the expected MD5-hashed value; the salt changed between registration and login (e.g., password was reset through a different code path); different MD5 encoding (uppercase hex vs lowercase); the user mistyped their password.

Related errors

AI-assisted analysis of qiurunze123/miaosha@e58017658e (2026-08-14). Data as JSON: /api/errors/9086d180e2c2dade. Report an issue: GitHub.

Appendix: source

Thrown at miaosha-v2/miaosha-service/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java:146

    }

    public boolean login(HttpServletResponse response, LoginVo loginVo) {
        if (loginVo == null) {
            throw new GlobleException(SYSTEM_ERROR);
        }

        String mobile = loginVo.getNickname();
        String password = loginVo.getPassword();
        MiaoshaUser user = getByNickName(mobile);
        if (user == null) {
            throw new GlobleException(MOBILE_NOT_EXIST);
        }

        String dbPass = user.getPassword();
        String saltDb = user.getSalt();
        String calcPass = MD5Utils.formPassToDBPass(password, saltDb);
        if (!calcPass.equals(dbPass)) {
            throw new GlobleException(PASSWORD_ERROR);
        }
        //生成cookie 将session返回游览器 分布式session
        String token = UUIDUtil.uuid();
        addCookie(response, token, user);
        return true;
    }


    public String createToken(HttpServletResponse response, LoginVo loginVo) {
        if (loginVo == null) {
            throw new GlobleException(SYSTEM_ERROR);
        }

        String mobile = loginVo.getNickname();
        String password = loginVo.getPassword();
        MiaoshaUser user = getByNickName(mobile);
        if (user == null) {
            throw new GlobleException(MOBILE_NOT_EXIST);

View on GitHub (pinned to e58017658e)