Spring Boot安全密码修改指南：实现与常见陷阱规避

if (member.getPassword().equals(checkIfValidOldPassword(member, password.getOldPassword()))){
   // ...
}

import lombok.Data;

@Data
public class ChangePasswordDto {
    private String oldPassword;
    private String newPassword;
    private String reNewPassword; // 用于确认新密码
}

import lombok.Getter;
import lombok.Setter;
import lombok.AllArgsConstructor;
import lombok.NoArgsConstructor;
import javax.persistence.*;
import java.util.Date;

@Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Entity
@Table(name ="member",
        indexes = {
            @Index(
                    columnList = "email_address",
                    name = "email_address_idx",
                    unique = true
            ),
        },
        uniqueConstraints = {
            @UniqueConstraint(
                    columnNames = {"email_address", "phone_number"},
                    name = "email_address_phone_number_uq"
            )
        }
)
public class Member {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(name = "first_name", nullable = false)
    private String firstName;

    @Column(name = "last_name", nullable = false)
    private String lastName;

    // ... 其他字段 ...

    @Column(name ="password", nullable = false)
    private String password; // 存储加密后的密码
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

// 假设存在一个 MemberJpaRepository 用于 Member 实体
interface MemberJpaRepository extends JpaRepository<Member, Long> {
    // ...
}

@Slf4j
@Service
public class ChangePasswordServiceImpl implements ChangePasswordService {

    private final MemberJpaRepository jpaRepository; // 修正为 MemberJpaRepository
    private final PasswordEncoder passwordEncoder; // 注入 PasswordEncoder

    @Autowired
    public ChangePasswordServiceImpl(MemberJpaRepository jpaRepository, PasswordEncoder passwordEncoder) {
        this.jpaRepository = jpaRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    @Transactional
    public Member changePassword(Long id, ChangePasswordDto passwordDto) {
        // 1. 根据ID获取会员信息，如果不存在则抛出异常
        Member member = jpaRepository.findById(id)
                .orElseThrow(() -> new ResourceNotFoundException("Member not found with id: " + id)); // 假设有一个 ResourceNotFoundException

        // 2. 验证旧密码
        // 使用 passwordEncoder.matches() 比较用户输入的明文旧密码与数据库中存储的加密旧密码
        if (!passwordEncoder.matches(passwordDto.getOldPassword(), member.getPassword())) {
            log.warn("Password change failed for member ID {}: Invalid old password.", id);
            throw new InvalidPasswordException("Invalid old password."); // 假设有一个 InvalidPasswordException
        }

        // 3. 验证新密码与确认新密码是否一致
        if (!passwordDto.getNewPassword().equals(passwordDto.getReNewPassword())) {
            log.warn("Password change failed for member ID {}: New passwords do not match.", id);
            throw new NewPasswordMismatchException("New password and re-entered new password do not match."); // 假设有一个 NewPasswordMismatchException
        }

        // 4. (可选) 验证新密码是否与旧密码相同
        if (passwordEncoder.matches(passwordDto.getNewPassword(), member.getPassword())) {
            log.warn("Password change failed for member ID {}: New password cannot be the same as old password.", id);
            throw new SameNewOldPasswordException("New password cannot be the same as the old password."); // 假设有一个 SameNewOldPasswordException
        }

        // 5. 编码新密码并更新到会员对象
        member.setPassword(passwordEncoder.encode(passwordDto.getNewPassword()));

        // 6. 保存更新后的会员信息到数据库
        return jpaRepository.save(member);
    }

    // 原有的 checkIfValidOldPassword 和 changPassword 方法在此处不再需要作为独立的公共方法，
    // 其逻辑已整合并优化到 changePassword 方法中。
    // 如果需要，可以作为私有辅助方法。
}

import org.springframework.http.MediaType;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping(
        value = "password",
        produces = { MediaType.APPLICATION_JSON_VALUE }
)
public class ChangePasswordController {

    private final ChangePasswordService service; // 使用 final 保证不可变性

    public ChangePasswordController(ChangePasswordService passwordService) {
        this.service = passwordService;
    }

    @PostMapping("/change-password/{id}")
    public Member changePassword(@Validated @RequestBody ChangePasswordDto passwordDto, @PathVariable(name = "id") Long id){
        // 服务层抛出的异常应由全局异常处理器（@ControllerAdvice）进行统一处理，
        // 从而返回合适的HTTP状态码和错误信息。
        return service.changePassword(id, passwordDto);
    }
}