更改密码 - Spring Security

Question

我有一个 Spring MVC 3.0 应用程序，并实现了 Spring Security。我正在创建一个小弹出窗口来更改当前登录用户的密码。一切都很好，直到我将表格发布到以下操作。

\n\n

@RequestMapping(value = "principalchangepassword" , method = RequestMethod.POST)\npublic @ResponseBody String principalchangepassword(Model uiModel, HttpServletRequest httpServletRequest){\n    Principal principal = (Principal) SecurityContextHolder.getContext().getAuthentication().getPrincipal();\n    StandardStringDigester digester = new StandardStringDigester();\n    digester.setAlgorithm("SHA-256");   // optionally set the algorithm\n    digester.setStringOutputType("hexadecimal");\n    digester.setSaltSizeBytes(0);\n    digester.setIterations(1);\n    String digest = digester.digest(httpServletRequest.getParameter("password1")); \n    principal.setPassword(digest.toLowerCase());\n    principal.merge();\n    return "Password Updated successfully";\n}\n

\n\n

当我执行 ajax 调用来更新当前主体的密码时，我收到以下异常消息。

\n\n

org.hibernate.TransientObjectException: object references an unsaved transient instance \xe2\x80\x93 save the transient instance before flushing\n

\n\n

我究竟做错了什么 ？

\n

Answer 1

我正在使用 Spring Security 使用 BCryptPasswordEncoder。现在，要更改密码，我要做的是将用户提供的现有密码与数据库值进行比较。

BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String existingPassword = ... // Password entered by user
String dbPassword       = ... // Load hashed DB password

if (passwordEncoder.matches(existingPassword, dbPassword)) {
    // Encode new password and store it
} else {
    // Report error 
}