Spring Boot密码修改API：逻辑陷阱与安全实践

// 原始代码片段
if (member.getPassword().equals(checkIfValidOldPassword(member, password.getOldPassword()))){
   // ... 更新密码的逻辑 ...
}

@Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Entity
@Table(name ="member",
        indexes = {
            @Index(columnList = "email_address", name = "email_address_idx", unique = true),
        },
        uniqueConstraints = {
            @UniqueConstraint(columnNames = {"email_address", "phone_number"}, name = "email_address_phone_number_uq")
        }
)
public class Member {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    // ... 其他字段 ...

    @Column(name ="password", nullable = false)
    private String password; // 存储加密后的密码
}

@Data
public class ChangePasswordDto {
    private String oldPassword;
    private String newPassword;
    private String reNewPassword; // 用于确认新密码
}

import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import lombok.extern.slf4j.Slf4j;
import java.util.Optional; // 导入Optional

@Slf4j
@Service
public class ChangePasswordServiceImpl implements ChangePasswordService {

    private final PasswordEncoder passwordEncoder;
    private final PasswordJpaRepository jpaRepository; // 假设这是Member的JPA仓库

    // 构造器注入PasswordEncoder和JpaRepository
    public ChangePasswordServiceImpl(PasswordEncoder passwordEncoder, PasswordJpaRepository jpaRepository) {
        this.passwordEncoder = passwordEncoder;
        this.jpaRepository = jpaRepository;
    }

    @Override
    @Transactional
    public Member changePassword(Long memberId, ChangePasswordDto passwordDto) {
        // 1. 根据ID获取会员信息，并处理会员不存在的情况
        Optional<Member> optionalMember = jpaRepository.findById(memberId);
        if (optionalMember.isEmpty()) {
            log.warn("Member with ID {} not found for password change.", memberId);
            // 可以抛出自定义异常，例如 ResourceNotFoundException
            throw new IllegalArgumentException("Member not found.");
        }
        Member member = optionalMember.get();

        // 2. 验证旧密码是否正确
        // 使用 passwordEncoder.matches() 比较用户输入的旧密码与数据库中存储的哈希密码
        if (!passwordEncoder.matches(passwordDto.getOldPassword(), member.getPassword())) {
            log.warn("Incorrect old password provided for member ID {}.", memberId);
            // 可以抛出自定义异常，例如 InvalidPasswordException
            throw new IllegalArgumentException("Old password is incorrect.");
        }

        // 3. 验证新密码及其确认是否一致
        if (!passwordDto.getNewPassword().equals(passwordDto.getReNewPassword())) {
            log.warn("New passwords do not match for member ID {}.", memberId);
            // 可以抛出自定义异常，例如 PasswordMismatchException
            throw new IllegalArgumentException("New passwords do not match.");
        }

        // 4. 对新密码进行加密
        String encodedNewPassword = passwordEncoder.encode(passwordDto.getNewPassword());

        // 5. 更新会员的密码
        member.setPassword(encodedNewPassword);

        // 6. 保存更新后的会员信息到数据库
        return jpaRepository.save(member);
    }

    // 移除原有的 checkIfValidOldPassword 和 changPassword 方法，
    // 其逻辑已整合到 changePassword 方法中，使代码更简洁、内聚。
}

import org.springframework.http.MediaType;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping(
        value = "password",
        produces = { MediaType.APPLICATION_JSON_VALUE }
)
public class ChangePasswordController {

    private final ChangePasswordService service; // 使用final关键字

    public ChangePasswordController(ChangePasswordService passwordService) {
        this.service = passwordService;
    }

    @PostMapping("/change-password/{id}")
    public Member changePassword(@Validated @RequestBody ChangePasswordDto passwordDto, @PathVariable(name = "id") Long id){
        // 服务层会处理各种验证和异常，控制器只需调用
        return service.changePassword(id, passwordDto);
    }
}