Spring Boot密码修改API的实现与安全实践

if (member.getPassword().equals(checkIfValidOldPassword(member, password.getOldPassword()))){
    // ...
}

// 例如，在您的Spring Boot主应用类或配置类中
@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(); // 推荐使用BCryptPasswordEncoder
    }
}

import lombok.Data;
import javax.validation.constraints.NotBlank;
import javax.validation.constraints.Size;

@Data
public class ChangePasswordDto {

    @NotBlank(message = "旧密码不能为空")
    private String oldPassword;

    @NotBlank(message = "新密码不能为空")
    @Size(min = 8, message = "新密码长度至少为8位")
    private String newPassword;

    @NotBlank(message = "确认新密码不能为空")
    private String reNewPassword;
}

import lombok.Getter;
import lombok.Setter;
import lombok.AllArgsConstructor;
import lombok.NoArgsConstructor;
import javax.persistence.*;
import java.util.Date;

@Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Entity
@Table(name ="member",
        indexes = {
            @Index(
                    columnList = "email_address",
                    name = "email_address_idx",
                    unique = true
            ),
        },
        uniqueConstraints = {
            @UniqueConstraint(
                    columnNames = {"email_address", "phone_number"},
                    name = "email_address_phone_number_uq"
            )
        }
)
public class Member {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    // ... 其他字段 ...

    @Column(name ="password", nullable = false)
    private String password; // 存储哈希后的密码
}

import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.util.Optional;

@Slf4j
@Service
public class ChangePasswordServiceImpl implements ChangePasswordService {

    private final MemberJpaRepository jpaRepository; // 假设您有一个MemberJpaRepository
    private final PasswordEncoder passwordEncoder;

    @Autowired
    public ChangePasswordServiceImpl(MemberJpaRepository jpaRepository, PasswordEncoder passwordEncoder) {
        this.jpaRepository = jpaRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    @Transactional
    public Member changePassword(Long id, ChangePasswordDto passwordDto) {
        // 1. 根据ID查找会员
        Optional<Member> memberOptional = jpaRepository.findById(id);
        if (memberOptional.isEmpty()) {
            log.warn("Member with ID {} not found.", id);
            // 更好的做法是抛出自定义异常，例如 ResourceNotFoundException
            throw new IllegalArgumentException("Member not found.");
        }
        Member member = memberOptional.get();

        // 2. 验证旧密码
        // 使用 passwordEncoder.matches() 比较用户输入的旧密码与数据库中存储的哈希密码
        if (!passwordEncoder.matches(passwordDto.getOldPassword(), member.getPassword())) {
            log.warn("Invalid old password for member ID {}.", id);
            // 抛出自定义异常，例如 InvalidOldPasswordException
            throw new IllegalArgumentException("Invalid old password.");
        }

        // 3. 验证新密码及其确认密码是否一致
        if (!passwordDto.getNewPassword().equals(passwordDto.getReNewPassword())) {
            log.warn("New password and re-entered new password do not match for member ID {}.", id);
            // 抛出自定义异常，例如 NewPasswordMismatchException
            throw new IllegalArgumentException("New password and re-entered new password do not match.");
        }

        // 4. 对新密码进行哈希处理并更新
        String encodedNewPassword = passwordEncoder.encode(passwordDto.getNewPassword());
        member.setPassword(encodedNewPassword);

        // 5. 保存更新后的会员信息
        return jpaRepository.save(member);
    }

    // 原有的 checkIfValidOldPassword 和 changPassword 方法现在已集成到 changePassword 中，
    // 无需作为公共方法单独存在，以提高封装性和安全性。
}

import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping(
        value = "password",
        produces = { MediaType.APPLICATION_JSON_VALUE }
)
public class ChangePasswordController {

    private final ChangePasswordService service;

    public ChangePasswordController(ChangePasswordService passwordService) {
        this.service = passwordService;
    }

    @PostMapping("/change-password/{id}")
    public ResponseEntity<Member> changePassword(@Validated @RequestBody ChangePasswordDto passwordDto, @PathVariable(name = "id") Long id){
        try {
            Member updatedMember = service.changePassword(id, passwordDto);
            return ResponseEntity.ok(updatedMember);
        } catch (IllegalArgumentException e) {
            // 根据实际情况返回不同的HTTP状态码和错误信息
            return ResponseEntity.badRequest().body(null); // 示例：返回400 Bad Request
        }
    }
}