Spring security change password,then logout,but fail when relogin with new password -
i'm dying,i'm dying! use spring 4.1.5.release spring-security 4.0.0.rc2 spring-data-jpa 1.8.0.rc1
in usercontroller.changepwd() method below:
user currentuser = this.securityutil.getcurrentuser(); currentuser.setpassword(passwordencoder.encodepassword(newpwd, null)); this.userservice.save(currentuser); request.getsession() .removeattribute(constants.session_current_user_key); after change password,the request redirected /logout
then checked database,the password has been changed new password.
then relogin new password,i bad credentials exception
so debuged,i found in org.springframework.security.core.userdetails.jdbc.jdbcdaoimpl.loadusersbyusername(string username) method user old password
only when restart server,the new password useful.
please me , thank lot
are using caching in userdetailsservice? in case need explicitly reset cache entry user after changed password:
@autowired private usercache usercache; public void resetpassword() { // change password in db // now: explicitly expire user user cache usercache.removeuserfromcache(username) }
Comments
Post a Comment