Spring Boot密码修改接口开发指南：常见陷阱与安全实践

if (member.getPassword().equals(checkIfValidOldPassword(member, password.getOldPassword()))){
   // ... 更新密码逻辑
}

@Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Entity
@Table(name ="member",
        indexes = {
            @Index(columnList = "email_address", name = "email_address_idx", unique = true),
        },
        uniqueConstraints = {
            @UniqueConstraint(columnNames = {"email_address", "phone_number"}, name = "email_address_phone_number_uq")
        }
)
public class Member {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    // ... 其他字段

    @Column(name ="password", nullable = false)
    private String password; // 存储加密后的密码
}

@Data
public class ChangePasswordDto {
    private String oldPassword;
    private String newPassword;
    private String reNewPassword; // 用于确认新密码
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import com.yourpackage.repository.PasswordJpaRepository; // 假设你的JPA仓库

@Slf4j
@Service
public class ChangePasswordServiceImpl implements ChangePasswordService {

    private final PasswordJpaRepository jpaRepository;
    private final PasswordEncoder passwordEncoder; // 注入PasswordEncoder

    @Autowired
    public ChangePasswordServiceImpl(PasswordJpaRepository jpaRepository, PasswordEncoder passwordEncoder) {
        this.jpaRepository = jpaRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    @Transactional
    public Member changePassword(Long id, ChangePasswordDto passwordDto) {
        // 1. 根据ID查找用户
        final Member member = jpaRepository.findById(id)
                                          .orElseThrow(() -> new RuntimeException("Member not found with id: " + id));

        // 2. 验证旧密码
        // 使用 passwordEncoder.matches() 比较用户输入的明文旧密码和数据库中加密的旧密码
        if (!passwordEncoder.matches(passwordDto.getOldPassword(), member.getPassword())) {
            log.warn("Attempt to change password for member {} with invalid old password.", id);
            // 可以抛出自定义异常，例如 InvalidOldPasswordException
            return null; // 或者抛出异常，让Controller层处理
        }

        // 3. 验证新密码与确认密码是否一致
        if (!passwordDto.getNewPassword().equals(passwordDto.getReNewPassword())) {
            log.warn("New password and re-enter new password do not match for member {}.", id);
            // 抛出自定义异常，例如 NewPasswordsMismatchException
            return null; // 或者抛出异常
        }

        // 4. 对新密码进行加密
        String encodedNewPassword = passwordEncoder.encode(passwordDto.getNewPassword());

        // 5. 更新密码并保存
        member.setPassword(encodedNewPassword);
        return jpaRepository.save(member); // save方法会更新已存在的实体
    }

    // 原始代码中的 checkIfValidOldPassword 和 changPassword 方法可以被上述逻辑整合或简化
    // 例如，checkIfValidOldPassword 的逻辑已整合到 changePassword 方法中
    // changPassword 方法也已整合，直接在 member 对象上设置新密码并保存
}

import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;
import com.yourpackage.dto.ChangePasswordDto;
import com.yourpackage.model.Member;
import com.yourpackage.service.ChangePasswordService;

@RestController
@RequestMapping(
        value = "password",
        produces = { MediaType.APPLICATION_JSON_VALUE }
)
public class ChangePasswordController {

    private final ChangePasswordService service;

    public ChangePasswordController(ChangePasswordService passwordService) {
        this.service = passwordService;
    }

    @PostMapping("/change-password/{id}")
    public ResponseEntity<Member> changePassword(@Validated @RequestBody ChangePasswordDto passwordDto, @PathVariable(name = "id") Long id) {
        Member updatedMember = service.changePassword(id, passwordDto);
        if (updatedMember == null) {
            // 根据服务层返回null的原因，返回不同的HTTP状态码或错误信息
            // 例如，如果旧密码不正确，可以返回 401 Unauthorized 或 400 Bad Request
            return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
        }
        return new ResponseEntity<>(updatedMember, HttpStatus.OK);
    }
}