java - 使用 loadUserByUsername 时出现 NullPointerException

Question

这是来自 here 的 Spring Security 登录示例。我将注释配置更改为 XML，并对它应该指向的 url 进行了一些更改。我能够使用数据库中的凭据成功登录。如果我输入错误的密码，我会收到无效的消息。但是，如果我输入不在数据库中的用户名或只是在没有值的情况下提交，我会得到 nullpointerException。

java.lang.NullPointerException
    com.xxxx.service.CustomUserDetailsService.loadUserByUsername(CustomUserDetailsService.java:37)
    sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    java.lang.reflect.Method.invoke(Method.java:606)

CustomUserDetailsS​​ervice.java

@Service
@Transactional(readOnly=true)
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private LoginDAO loginDAO;

    public UserDetails loadUserByUsername(String userName)
            throws UsernameNotFoundException {

        com.xxxx.model.Login domainUser = loginDAO.getUser(userName);

        boolean enabled = true;
        boolean accountNonExpired = true;
        boolean credentialsNonExpired = true;
        boolean accountNonLocked = true;

        return new User(
                domainUser.getUserName(), // line 37
                domainUser.getPassword(),
                enabled,
                accountNonExpired,
                credentialsNonExpired,
                accountNonLocked,
                getAuthorities(domainUser.getRole().getId())
                ); 

            }

            public Collection<? extends GrantedAuthority> getAuthorities(Integer role) {
            List<GrantedAuthority> authList = getGrantedAuthorities(getRoles(role));
            return authList;
            }

            public List<String> getRoles(Integer role) {

                List<String> roles = new ArrayList<String>();

                if (role.intValue() == 1) {
                roles.add("ROLE_MODERATOR");
                roles.add("ROLE_ADMIN");
                } else if (role.intValue() == 2) {
                roles.add("ROLE_MODERATOR");
                }
                return roles;
                }
            public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
                List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

                for (String role : roles) {
                authorities.add(new GrantedAuthorityImpl (role));
                }
                return authorities;
                }
}

spring-security.xml

<http auto-config="true">

<intercept-url pattern="/success" access="ROLE_MODERATOR" />
<intercept-url pattern="/success" access="ROLE_ADMIN" />

<form-login login-page="/login.html"
default-target-url="/success.html"
authentication-failure-url="/error.html" />
<logout logout-success-url="/login.html" />

</http>

<authentication-manager>
<authentication-provider user-service-ref="customUserDetailsService">
<password-encoder hash="plaintext" />
</authentication-provider>
</authentication-manager>

</beans:beans> 

请有人指出我哪里做错了。

编辑:LoginDAOImpl.java

@Repository
public class LoginDAOImpl implements LoginDAO {

    @Autowired
    private SessionFactory sessionFactory;

    private Session openSession() {
        return sessionFactory.getCurrentSession();
    }

    public Login getUser(String userName) {
        List<Login> loginList = new ArrayList<Login>();
        Query query = openSession().createQuery(
                "from Login l where l.userName = :userName");
        query.setParameter("userName", userName);
        loginList = query.list();
        if (loginList.size() > 0)
            return loginList.get(0);
        else
            return null;    
    }
}

Answer 1

问题是您正在尝试访问 null Login 对象的 userName 字段。

正如我所见，如果用户名不在数据库中，您将从 DAO 返回 null，但您不会检查服务中的返回值。

因此，在创建新的 User 实例之前，请检查返回的 Login 是否不为 null。如果它是 null，您应该抛出 UsernameNotFoundException。