qiurunze123/miaosha · warning · GlobleException

30010

30010

Error message

密码错误!

What it means

Thrown by MiaoShaUserService.login() (miaosha-v1) when the MD5-hashed password submitted by the user does not equal the stored DB password hash. Maps to ResultStatus.PASSWORD_ERROR (code 30010, '密码错误!'). The comparison is calcPass = MD5Utils.formPassToDBPass(password, saltDb) checked against dbPass = user.getPassword(). If they differ, the password is wrong or the salting/hashing pipeline is inconsistent.

Source

Thrown at miaosha-v1/src/main/java/com/geekq/miaosha/service/MiaoShaUserService.java:128

    }

    public boolean login(HttpServletResponse response, LoginVo loginVo) {
        if (loginVo == null) {
            throw new GlobleException(SYSTEM_ERROR);
        }

        String mobile = loginVo.getMobile();
        String password = loginVo.getPassword();
        MiaoshaUser user = getByNickName(mobile);
        if (user == null) {
            throw new GlobleException(MOBILE_NOT_EXIST);
        }

        String dbPass = user.getPassword();
        String saltDb = user.getSalt();
        String calcPass = MD5Utils.formPassToDBPass(password, saltDb);
        if (!calcPass.equals(dbPass)) {
            throw new GlobleException(PASSWORD_ERROR);
        }
        //生成cookie 将session返回游览器 分布式session
        String token = UUIDUtil.uuid();
        addCookie(response, token, user);
        return true;
    }


    public String createToken(HttpServletResponse response, LoginVo loginVo) {
        if (loginVo == null) {
            throw new GlobleException(SYSTEM_ERROR);
        }

        String mobile = loginVo.getMobile();
        String password = loginVo.getPassword();
        MiaoshaUser user = getByNickName(mobile);
        if (user == null) {
            throw new GlobleException(MOBILE_NOT_EXIST);

View on GitHub (pinned to e58017658e)

Solutions

  1. Confirm the front-end performs MD5 on the plaintext password before sending it (the back-end applies a second MD5 with the DB salt).
  2. Verify the salt stored at registration matches the salt used during login by checking the miaosha_user.salt column.
  3. Reset the password via updatePassword() with a known value if the hash pipeline is inconsistent.
  4. Check that MD5Utils.formPassToDBPass uses the same algorithm on both register and login code paths.
Defensive patterns

Strategy: try-catch

Try / catch

try {
    userService.login(response, loginVo);
} catch (GlobleException e) {
    if (e.getStatus() == ResultStatus.PASSWORD_ERROR) {
        model.addAttribute("errmsg", "密码错误");
        return "login";
    }
    throw e;
}

Prevention

When it happens

Trigger: POST /login with a LoginVo whose getPassword() value, after double-MD5 (MD5(MD5(password) + salt)), does not match the password column in miaosha_user. This fires when the user typed the wrong password, or when the front-end did not perform the first MD5 pass that the back-end expects.

Common situations: The front-end skipped the client-side MD5 (formPassToDBPass expects a pre-hashed input); the salt was regenerated after registration but the old password hash remains; passwords were migrated from another system with a different hashing scheme; the user simply mistyped their password.

Related errors

AI-assisted analysis of qiurunze123/miaosha@e58017658e (2026-08-14). Data as JSON: /api/errors/a97f92cab4b485cc. Report an issue: GitHub.