MySQL 提供密码过期功能，使数据库管理员可以要求用户重置密码。密码可以手动过期，也可以基于自动过期策略（参见 第 8.2.15 节，“密码管理”）。MySQL provides password-expiration capability, which enables database administrators to require that users reset their password. Passwords can be expired manually, and on the basis of a policy for automatic expiration (see Section 8.2.15, “Password Management”).

ALTER USER 语句可以启用账户密码过期。例如：The ALTER USER statement enables account password expiration. For example:

ALTER USER 'myuser'@'localhost' PASSWORD EXPIRE;

对于每个使用已过期密码账户的连接，服务器要么断开客户端，要么将客户端限制在“沙箱模式，” 在这种模式下，服务器只允许客户端执行重置过期密码所需的操作。服务器采取的具体操作取决于客户端和服务器的设置，如后文所述。For each connection that uses an account with an expired password, the server either disconnects the client or restricts the client to “sandbox mode,” in which the server permits the client to perform only those operations necessary to reset the expired password. Which action is taken by the server depends on both client and server settings, as discussed later.

如果服务器断开客户端连接，它将返回一个 ER_MUST_CHANGE_PASSWORD_LOGIN 错误：If the server disconnects the client, it returns an ER_MUST_CHANGE_PASSWORD_LOGIN error:

$> mysql -u myuser -p
Password: ******
ERROR 1862 (HY000): Your password has expired. To log in you must
change it using a client that supports expired passwords.

如果服务器将客户端限制为沙盒模式，则在客户端会话中允许以下操作：If the server restricts the client to sandbox mode, these operations are permitted within the client session:

对于会话中不允许的任何操作，服务器会返回 ER_MUST_CHANGE_PASSWORD 错误：For any operation not permitted within the session, the server returns an ER_MUST_CHANGE_PASSWORD error:

mysql> USE performance_schema;
ERROR 1820 (HY000): You must reset your password using ALTER USER
statement before executing this statement.

mysql> SELECT 1;
ERROR 1820 (HY000): You must reset your password using ALTER USER
statement before executing this statement.

这通常是 mysql 客户端进行交互式调用时发生的情况，因为默认情况下，此类调用会被置于沙箱模式。要恢复正常功能，请选择一个新密码。That is what normally happens for interactive invocations of the mysql client because by default such invocations are put in sandbox mode. To resume normal functioning, select a new password.

对于非交互式调用 mysql 客户端（例如，在批处理模式下），如果密码已过期，服务器通常会断开客户端连接。为了允许非交互式 mysql 调用保持连接，以便可以更改密码（使用沙箱模式下允许的语句），请在 mysql 命令中添加 --connect-expired-password 选项。For noninteractive invocations of the mysql client (for example, in batch mode), the server normally disconnects the client if the password is expired. To permit noninteractive mysql invocations to stay connected so that the password can be changed (using the statements permitted in sandbox mode), add the --connect-expired-password option to the mysql command.

如前所述，服务器是断开使用过期密码的客户端连接，还是将其限制在沙盒模式，取决于客户端和服务器设置的组合。以下讨论描述了相关设置及其如何交互。As mentioned previously, whether the server disconnects an expired-password client or restricts it to sandbox mode depends on a combination of client and server settings. The following discussion describes the relevant settings and how they interact.

在客户端方面，特定客户端会指示它是否可以处理过期密码的沙盒模式。对于使用 C 客户端库的客户端，有两种方法可以实现这一点：On the client side, a given client indicates whether it can handle sandbox mode for expired passwords. For clients that use the C client library, there are two ways to do this:

其他 MySQL 连接器有自己指示准备处理沙盒模式的约定。请参阅您感兴趣的连接器的文档。Other MySQL Connectors have their own conventions for indicating readiness to handle sandbox mode. See the documentation for the Connector in which you are interested.

在服务器端，如果客户端表示它可以处理过期密码，服务器会将其置于沙盒模式。On the server side, if a client indicates that it can handle expired passwords, the server puts it in sandbox mode.

如果客户端没有表明它可以处理过期密码（或者使用的客户端库较老，无法表明此功能），服务器的操作取决于 disconnect_on_expired_password 系统变量的值：If a client does not indicate that it can handle expired passwords (or uses an older version of the client library that cannot so indicate), the server action depends on the value of the disconnect_on_expired_password system variable: