Spring Boot密码修改API的正确实现与安全实践

if (member.getPassword().equals(checkIfValidOldPassword(member, password.getOldPassword()))){
   // ...
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

import org.springframework.security.crypto.password.PasswordEncoder;
// ...

@Service
public class ChangePasswordServiceImpl implements ChangePasswordService {

    private final PasswordJpaRepository jpaRepository;
    private final PasswordEncoder passwordEncoder; // 注入 PasswordEncoder

    public ChangePasswordServiceImpl(PasswordJpaRepository jpaRepository, PasswordEncoder passwordEncoder) {
        this.jpaRepository = jpaRepository;
        this.passwordEncoder = passwordEncoder;
    }

    // ...
}

import lombok.Data;

@Data
public class ChangePasswordDto {
    private String oldPassword;
    private String newPassword;
    private String reNewPassword; // 确认新密码
}

import lombok.Getter;
import lombok.Setter;
import lombok.AllArgsConstructor;
import lombok.NoArgsConstructor;
import javax.persistence.*;
import java.util.Date;

@Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Entity
@Table(name ="member",
        indexes = {
            @Index(columnList = "email_address", name = "email_address_idx", unique = true),
        },
        uniqueConstraints = {
            @UniqueConstraint(columnNames = {"email_address", "phone_number"}, name = "email_address_phone_number_uq")
        }
)
public class Member {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    // ... 其他字段

    @Column(name ="password", nullable = false)
    private String password; // 存储哈希后的密码
}

import lombok.extern.slf4j.Slf4j;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.util.Optional;

@Slf4j
@Service
public class ChangePasswordServiceImpl implements ChangePasswordService {

    private final PasswordJpaRepository jpaRepository;
    private final PasswordEncoder passwordEncoder; // 注入 PasswordEncoder

    public ChangePasswordServiceImpl(PasswordJpaRepository jpaRepository, PasswordEncoder passwordEncoder) {
        this.jpaRepository = jpaRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    @Transactional
    public Member changePassword(Long id, ChangePasswordDto passwordDto) {
        // 1. 根据ID查找用户
        Optional<Member> optionalMember = jpaRepository.findById(id);
        if (optionalMember.isEmpty()) {
            log.warn("Member with ID {} not found.", id);
            // 抛出自定义异常或返回null，此处简化处理
            throw new IllegalArgumentException("User not found.");
        }
        Member member = optionalMember.get();

        // 2. 验证旧密码
        // 使用 passwordEncoder.matches() 比较明文旧密码和数据库中存储的哈希密码
        if (!passwordEncoder.matches(passwordDto.getOldPassword(), member.getPassword())) {
            log.warn("Invalid old password for member ID {}.", id);
            throw new IllegalArgumentException("Invalid old password.");
        }

        // 3. 验证新密码是否匹配
        if (!passwordDto.getNewPassword().equals(passwordDto.getReNewPassword())) {
            log.warn("New passwords do not match for member ID {}.", id);
            throw new IllegalArgumentException("New passwords do not match.");
        }

        // 4. 检查新密码是否与旧密码相同（可选，但推荐）
        if (passwordEncoder.matches(passwordDto.getNewPassword(), member.getPassword())) {
            log.warn("New password is the same as the old password for member ID {}.", id);
            throw new IllegalArgumentException("New password cannot be the same as the old password.");
        }

        // 5. 对新密码进行哈希处理并更新
        String hashedNewPassword = passwordEncoder.encode(passwordDto.getNewPassword());
        member.setPassword(hashedNewPassword);

        // 6. 保存更新后的用户对象
        return jpaRepository.save(member);
    }

    // checkIfValidOldPassword 和 changPassword 方法不再需要，其逻辑已整合到 changePassword 中
    // 如果需要，可以将密码哈希操作封装为私有方法
    private String hashPassword(String rawPassword) {
        return passwordEncoder.encode(rawPassword);
    }
}

import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping(
        value = "password",
        produces = { MediaType.APPLICATION_JSON_VALUE }
)
public class ChangePasswordController {

    private final ChangePasswordService service;

    public ChangePasswordController(ChangePasswordService passwordService) {
        this.service = passwordService;
    }

    @PostMapping("/change-password/{id}")
    public ResponseEntity<?> changePassword(@Validated @RequestBody ChangePasswordDto passwordDto, @PathVariable(name = "id") Long id){
        try {
            Member updatedMember = service.changePassword(id, passwordDto);
            // 注意：不应将完整的Member对象（包含哈希密码）直接返回给客户端。
            // 应该返回一个状态消息或只包含非敏感信息的DTO。
            return ResponseEntity.ok("Password changed successfully for member ID: " + updatedMember.getId());
        } catch (IllegalArgumentException e) {
            return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(e.getMessage());
        } catch (Exception e) {
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("An unexpected error occurred: " + e.getMessage());
        }
    }
}