如何让Thymeleaf在Spring Boot中填充密码字段？

问题说明 #

在Spring Boot+Thymeleaf的注册表单中，当registrationDto未通过服务器端验证、页面重新渲染时，文本输入框能自动填充之前的输入值，但type="password"的字段始终为空——尽管password属性已经正确传递到模板（可通过th:text="*{password}"正常输出值）。

表单核心代码：

<form id="registration-form" method="post" th:object="${registrationDto}" th:action="@{/registration}">
    <input id="name" type="text" name="name" th:field="*{name}"/>
    <input id="password" type="password" name="password" th:field="*{password}"/>
</form>

渲染后密码字段的HTML：

<input id="password" type="password" name="password" value=""/>

可行解决方案 #

方法1：手动指定th:value #

Thymeleaf出于安全默认不给密码框自动填充value，可以直接手动绑定值：

<input id="password" type="password" name="password" th:field="*{password}" th:value="*{password}"/>

如果上述方式不生效，改用th:attr强制设置属性：

<input id="password" type="password" name="password" th:field="*{password}" th:attr="value=*{password}"/>

方法2：前端JS动态填充 #

通过Thymeleaf内联JS获取密码值，页面加载时填充到输入框：

<script th:inline="javascript">
    window.addEventListener('load', () => {
        const pwd = /*[[*{password}]]*/ '';
        if (pwd) {
            document.getElementById('password').value = pwd;
        }
    });
</script>

方法3：全局修改Thymeleaf处理器（进阶） #

若需要全局统一处理所有密码框的填充逻辑，可自定义Thymeleaf处理器：

1. 编写自定义密码输入处理器：

import org.thymeleaf.context.ITemplateContext;
import org.thymeleaf.engine.AttributeName;
import org.thymeleaf.model.IProcessableElementTag;
import org.thymeleaf.processor.element.AbstractAttributeTagProcessor;
import org.thymeleaf.processor.element.IElementTagStructureHandler;
import org.thymeleaf.templatemode.TemplateMode;

public class CustomPasswordInputProcessor extends AbstractAttributeTagProcessor {

    private static final String ATTR_NAME = "field";
    private static final int PRECEDENCE = 1000;

    public CustomPasswordInputProcessor(String dialectPrefix) {
        super(TemplateMode.HTML, dialectPrefix, "input", false, ATTR_NAME, true, PRECEDENCE, true);
    }

    @Override
    protected void doProcess(ITemplateContext context, IProcessableElementTag tag, AttributeName attributeName, String attributeValue, IElementTagStructureHandler structureHandler) {
        super.doProcess(context, tag, attributeName, attributeValue, structureHandler);
        // 获取绑定的密码值并设置到value属性
        Object pwdValue = context.getExpressionEngine().executeExpression(context, attributeValue);
        if (pwdValue != null) {
            structureHandler.setAttribute("value", pwdValue.toString());
        }
    }
}

2. 注册自定义方言：

import org.thymeleaf.dialect.AbstractProcessorDialect;
import org.thymeleaf.processor.IProcessor;
import java.util.HashSet;
import java.util.Set;

public class CustomThymeleafDialect extends AbstractProcessorDialect {
    public static final String DIALECT_NAME = "Custom Thymeleaf Dialect";
    public static final String DIALECT_PREFIX = "custom";

    public CustomThymeleafDialect() {
        super(DIALECT_NAME, DIALECT_PREFIX, 1000);
    }

    @Override
    public Set<IProcessor> getProcessors(String dialectPrefix) {
        Set<IProcessor> processors = new HashSet<>();
        processors.add(new CustomPasswordInputProcessor(dialectPrefix));
        return processors;
    }
}

3. 在Spring配置中注册方言：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ThymeleafConfig {
    @Bean
    public CustomThymeleafDialect customThymeleafDialect() {
        return new CustomThymeleafDialect();
    }
}

内容的提问来源于stack exchange，提问作者Slevin