使用Spring Security实现登录功能时遇空指针及登录失败问题求助

核心原因 #

CustomAccountDetailsService中的accountRepository未被Spring容器正确注入，导致调用findByUsername方法时抛出NullPointerException，Spring Security捕获异常后统一返回「Invalid Username or Password」错误。

修复步骤 #

1. 确保CustomAccountDetailsService被Spring管理 #

检查类上是否添加@Service或@Component注解，让Spring扫描并创建实例：

import org.springframework.stereotype.Service;

@Service
public class CustomAccountDetailsService implements UserDetailsService {
    // ... 业务代码
}

2. 正确注入AccountRepository #

优先使用构造函数注入（Spring官方推荐，避免依赖注入时机问题）：

private final AccountRepository accountRepository;

public CustomAccountDetailsService(AccountRepository accountRepository) {
    this.accountRepository = accountRepository;
}

若使用字段注入，需添加@Autowired注解（不推荐）：

@Autowired
private AccountRepository accountRepository;

3. 确认AccountRepository被Spring识别 #

检查接口上是否添加@Repository注解，且所在包被Spring组件扫描覆盖：

import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.stereotype.Repository;

@Repository
public interface AccountRepository extends JpaRepository<Account, Long> {
    Account findByUsername(String username);
}

同时确认主启动类的@SpringBootApplication扫描范围覆盖repository和service所在包：

@SpringBootApplication(scanBasePackages = {"com.thang"})
public class YourApplication {
    public static void main(String[] args) {
        SpringApplication.run(YourApplication.class, args);
    }
}

4. 检查SecurityConfig的配置逻辑 #

禁止手动new CustomAccountDetailsService()，必须通过Spring注入实例并配置给认证管理器：

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final CustomAccountDetailsService accountDetailsService;

    public SecurityConfig(CustomAccountDetailsService accountDetailsService) {
        this.accountDetailsService = accountDetailsService;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(accountDetailsService)
            .passwordEncoder(passwordEncoder());
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

5. 验证密码编码一致性 #

若NPE修复后仍报错，需确认用户注册时密码是通过passwordEncoder().encode(rawPassword)加密后存入数据库的，确保和Security配置中的密码编码器一致。

内容的提问来源于stack exchange，提问作者Thang Đai