spring security 修改密码

在Spring Security中，修改密码通常涉及以下几个步骤：

1. **创建修改密码的表单**：首先，需要创建一个前端表单，用户可以在其中输入旧密码和新密码。

2. **编写控制器**：接下来，编写一个控制器来处理表单提交。控制器将验证旧密码是否正确，并将新密码更新到数据库中。

3. **配置Spring Security**：确保Spring Security配置允许用户修改密码。通常，这涉及到配置一个自定义的UserDetailsService和PasswordEncoder。

以下是一个简单的示例，展示了如何在Spring Security中实现密码修改功能。

### 1. 创建修改密码的表单

<form th:action="@{/changePassword}" method="post">
    <input type="password" name="oldPassword" placeholder="Old Password" required />
    <input type="password" name="newPassword" placeholder="New Password" required />
    <button type="submit">Change Password</button>
</form>

### 2. 编写控制器

@Controller
public class PasswordController {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @PostMapping("/changePassword")
    public String changePassword(@RequestParam String oldPassword, @RequestParam String newPassword, Principal principal, Model model) {
        UserDetails userDetails = userDetailsService.loadUserByUsername(principal.getName());
        if (passwordEncoder.matches(oldPassword, userDetails.getPassword())) {
            // 更新密码
            userDetailsService.updatePassword(userDetails.getUsername(), passwordEncoder.encode(newPassword));
            model.addAttribute("message", "Password changed successfully");
        } else {
            model.addAttribute("message", "Old password is incorrect");
        }
        return "changePassword";
    }
}

### 3. 配置Spring Security

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/changePassword").authenticated()
                .anyRequest().permitAll()
                .and()
            .formLogin()
                .permitAll()
                .and()
            .logout()
                .permitAll();
    }
}

### 4. 更新用户密码

在UserDetailsService的实现类中，添加一个方法来更新用户密码。

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("User not found");
        }
        return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), new ArrayList<>());
    }

    public void updatePassword(String username, String newPassword) {
        User user = userRepository.findByUsername(username);
        user.setPassword(newPassword);
        userRepository.save(user);
    }
}

通过以上步骤，你就可以在Spring Security中实现密码修改功能了。