qiurunze123/miaosha · warning · GlobleException

30010

30010

Error message

密码错误!

What it means

Thrown by MiaoShaUserService.login() (miaosha-v2) when the calculated password hash does not equal the stored DB password. Maps to ResultStatus.PASSWORD_ERROR (code 30010, '密码错误!'). The comparison is MD5Utils.formPassToDBPass(password, saltDb) versus user.getPassword(). The hashing expects the client to have already applied one MD5 pass to the plaintext.

Source

Thrown at miaosha-v2/miaosha-service/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java:146

    }

    public boolean login(HttpServletResponse response, LoginVo loginVo) {
        if (loginVo == null) {
            throw new GlobleException(SYSTEM_ERROR);
        }

        String mobile = loginVo.getNickname();
        String password = loginVo.getPassword();
        MiaoshaUser user = getByNickName(mobile);
        if (user == null) {
            throw new GlobleException(MOBILE_NOT_EXIST);
        }

        String dbPass = user.getPassword();
        String saltDb = user.getSalt();
        String calcPass = MD5Utils.formPassToDBPass(password, saltDb);
        if (!calcPass.equals(dbPass)) {
            throw new GlobleException(PASSWORD_ERROR);
        }
        //生成cookie 将session返回游览器 分布式session
        String token = UUIDUtil.uuid();
        addCookie(response, token, user);
        return true;
    }


    public String createToken(HttpServletResponse response, LoginVo loginVo) {
        if (loginVo == null) {
            throw new GlobleException(SYSTEM_ERROR);
        }

        String mobile = loginVo.getNickname();
        String password = loginVo.getPassword();
        MiaoshaUser user = getByNickName(mobile);
        if (user == null) {
            throw new GlobleException(MOBILE_NOT_EXIST);

View on GitHub (pinned to e58017658e)

Solutions

  1. Confirm the front-end applies MD5 to the password before submitting (formPassToDBPass expects a pre-hashed input).
  2. Verify the salt in miaosha_user.salt matches the salt used during this user's registration.
  3. Reset the password through updatePassword() to restore a known state.
  4. Temporarily log calcPass vs dbPass in a dev environment to diagnose encoding mismatches.
Defensive patterns

Strategy: try-catch

Try / catch

try {
    userService.login(response, loginVo);
} catch (GlobleException e) {
    if (e.getStatus() == ResultStatus.PASSWORD_ERROR) {
        model.addAttribute("errmsg", "密码错误");
        return "login";
    }
    throw e;
}

Prevention

When it happens

Trigger: POST /login with a LoginVo whose getPassword() value, after double-MD5 with the user's salt, does not match the miaosha_user.password column. Fires on wrong password, missing client-side MD5, or salt mismatch.

Common situations: Front-end sends plaintext password instead of the expected MD5-hashed value; the salt changed between registration and login (e.g., password was reset through a different code path); different MD5 encoding (uppercase hex vs lowercase); the user mistyped their password.

Related errors

AI-assisted analysis of qiurunze123/miaosha@e58017658e (2026-08-14). Data as JSON: /api/errors/9086d180e2c2dade. Report an issue: GitHub.