title: What should I verify when change current user's password?
body: <p>I'm working on a spring-mvc project which using spring-security to authenticate. I'm also using encrypt to encode password and store in database.</p>
  
  <p>And now I'm trying with change password function. Usually we have <code>old password</code> and <code>new password</code>.</p>
  
  <p>So I have some question.</p>
  
  <ol>
  <li><p>User only can change their password after logged in. So is it necessary to verify <code>old password</code> again?</p></li>
  <li><p>If we have to verify how can we do it in spring with an <code>old password</code> had been encode?</p></li>
  </ol>
  
  <p>I'm using <code>BCryptPasswordEncoder</code> to encode password.</p>