Shiro异常java.lang.IllegalArgumentException: Odd number of characters的解决方案

最近在做前后端分离，登录认证部分用到了Shiro，配置MD5加盐加密后，在登录的时候抛出的以下异常：

java.lang.IllegalArgumentException: Odd number of characters.
at org.apache.shiro.codec.Hex.decode(Hex.java:128) ~[shiro-core-1.3.2.jar:1.3.2]
at org.apache.shiro.codec.Hex.decode(Hex.java:107) ~[shiro-core-1.3.2.jar:1.3.2]
at org.apache.shiro.codec.Hex.decode(Hex.java:95) ~[shiro-core-1.3.2.jar:1.3.2]
at org.apache.shiro.authc.credential.HashedCredentialsMatcher.getCredentials(HashedCredentialsMatcher.java:353) ~[shiro-core-1.3.2.jar:1.3.2]
at org.apache.shiro.authc.credential.HashedCredentialsMatcher.doCredentialsMatch(HashedCredentialsMatcher.java:380) ~[shiro-core-1.3.2.jar:1.3.2]
at org.apache.shiro.realm.AuthenticatingRealm.assertCredentialsMatch(AuthenticatingRealm.java:597) ~[shiro-core-1.3.2.jar:1.3.2]
…

对应Realm的代码：

public class CustomRealm extends AuthorizingRealm {
    @Autowired
    UserMapper usermapper;

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
            throws AuthenticationException {

        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        String username = String.valueOf(token.getUsername());
        String password = String.valueOf(token.getPassword());
        // 从数据库获取对应用户名的用户
        User user = usermapper.findByUsername(username);
        if (user == null) {
            throw new AccountException("不存在此用户");
        }
        // 获取盐值，即用户名
        ByteSource salt = ByteSource.Util.bytes(username);
        return new SimpleAuthenticationInfo(token.getPrincipal(), password, salt, getName());
    }
}

错误就在最后一句代码:

return new SimpleAuthenticationInfo(token.getPrincipal(), password, salt, getName());

在这里直接把明文密码当成参数传入了构造器

解决方案：将MD5加密后的密码传入构造器

修改后代码：

public class CustomRealm extends AuthorizingRealm {
    @Autowired
    UserMapper usermapper;

    /**
     * 获取身份验证信息 Shiro中，最终是通过 Realm 来获取应用程序中的用户、角色及权限信息的。
     *
     * @param authenticationToken
     *            用户身份信息 token
     * @return 返回封装了用户信息的 AuthenticationInfo 实例
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
            throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        String username = String.valueOf(token.getUsername());
        // 从数据库获取对应用户名的用户
        User user = usermapper.findByUsername(username);
        if (user == null) {
            throw new AccountException("不存在此用户");
        }
        // 获取盐值，即用户名
        ByteSource salt = ByteSource.Util.bytes(username);
        //注意，数据库中的user的密码必须是要经过md5加密，不然还是会抛出异常！！！！！
        return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), salt, getName());
    }
}

作者：食鱼酱
来源：CSDN
原文：https://blog.csdn.net/weixin_38278878/article/details/81054672
版权声明：本文为博主原创文章，转载请附上博文链接！