public class RegisterCommand {
    // omit getter and setter

    @Size(min=5, max=20)
    @Pattern(regexp="^[a-zA-Z0-9]+$", message="Username must be alphanumeric with no spaces")
    private String username;

    private String fullname;

    @Size(min=6, max=20)
    private String password;

    @Size(min=6, max=20)
    private String confirmation;

    @Email
    private String email;
}

public class RegistrationValidator implements Validator{
    @Override
    public boolean supports(Class<?> aClass) {
        return RegistrationValidator.class.isAssignableFrom(aClass);
    }

    @Override
    public void validate(Object o, Errors errors) {
        RegisterCommand registerCommand = (RegisterCommand) o;
        if (!registerCommand.getConfirmation().equals(registerCommand.getPassword()))
            errors.rejectValue("confirmation", "password.confirmation.error");

    }
}

@Controller
public class HomeController {
    private static String salt = "SECRET";
    //private static final int DEFAULT_SPITTERS_PER_PAGE = 25;

    @Autowired
    private UserService userService;

    @Autowired
    private RegistrationValidator registrationValidator;

    @RequestMapping(value="/", method = RequestMethod.GET)
    public String loginCommand(Model model){
        model.addAttribute("loginCommand", new LoginCommand());
        return "home";
    }

    @RequestMapping(value="/", method = RequestMethod.POST)
    public ModelAndView loginCheck(@ModelAttribute("loginCommand") @Valid LoginCommand loginCommand,
                                   BindingResult result,
                                   HttpServletRequest request, Model model) {
        String name = loginCommand.getUsername();
        String pass = loginCommand.getPassword();

        if (result.hasErrors()) {
            return new ModelAndView("home");
        }

        String secretPass = DigestUtils.md5Hex(salt + pass);
        boolean valid = userService.hasMatchUser(name, secretPass);
        if (!valid) {
            return new ModelAndView("redirect:/", "fatal", "Username or password error!");
        } else {
            User user = userService.findUserByName(name);
            user.setLastIp(request.getRemoteAddr());
            user.setLastVisit(new Date());
            userService.loginSuccess(user);
            request.getSession().setAttribute("user", user);
            String userPage = "redirect:user/" + name;
            return new ModelAndView(userPage);
        }

    }

    @RequestMapping(value="/user/{name}")
    public ModelAndView userPage(@PathVariable String name, HttpServletRequest request, Model model) {
        model.addAttribute("name", name);
        return new ModelAndView("sucess");
    }

    @RequestMapping(value="register.html", method=RequestMethod.GET)
    public String register(Model model) {
        model.addAttribute("registerCommand", new RegisterCommand());
        return "register";
    }

    @RequestMapping(value="register.do", method=RequestMethod.POST)
    public String register(@ModelAttribute("registerCommand") @Valid RegisterCommand registerCommand,
                           BindingResult result,
                           HttpServletRequest request, Model model) {
        registrationValidator.validate(registerCommand, result);

        if (result.hasErrors()) {
            return "register";
        }

        User user = new User();
        user.setUserName(registerCommand.getUsername());
        user.setPassword(DigestUtils.md5Hex(salt + registerCommand.getPassword()));
        user.setLastIp(request.getRemoteAddr());
        user.setLastVisit(new Date());
        userService.insertUser(user);

        model.addAttribute("loginCommand", new LoginCommand());
        return "home";
    }
}

@Target({ TYPE, ANNOTATION_TYPE})
@Retention(RUNTIME)
@Constraint(validatedBy = CheckPasswordValidator.class)
@Documented
public @interface CheckPassword {

    //默认错误消息
    String message() default "";

    //分组
    Class<?>[] groups() default { };

    //负载
    Class<? extends Payload>[] payload() default { };

    //指定多个时使用
    @Target({ FIELD, METHOD, PARAMETER, ANNOTATION_TYPE })
    @Retention(RUNTIME)
    @Documented
    @interface List {
        CheckPassword[] value();
    }
}

public class CheckPasswordValidator implements ConstraintValidator<CheckPassword, RegisterCommand> {

    @Override
    public void initialize(CheckPassword constraintAnnotation) {
    }

    @Override
    public boolean isValid(RegisterCommand user, ConstraintValidatorContext context) {
        if(user == null) {
            return true;
        }

        //两次密码不一样
        if (!user.getPassword().trim().equals(user.getConfirmation().trim())) {
            context.disableDefaultConstraintViolation();
            context.buildConstraintViolationWithTemplate("{password.confirmation.error}")
                    .addPropertyNode("confirmation")
                    .addConstraintViolation();
            return false;
        }
        return true;
    }
}

@SpELAssert(value = "password.equals(passwordVerify)",
            applyIf = "password || passwordVerify",
            message = "{validator.passwords_not_same}")
public class User {

    private String password;
    private String passwordVerify;
}

@ScriptAssert(script = "_this.confirmation==_this.password", lang = "javascript", alias = "_this",
message="Password don't confirm")