二次认证，本来的需求是完成一个二次认证，对于登录到制定系统的中的用户进行二次验证，本来是只有某一个功能要用的，也是按照某一个功能设计的接口情况，但是在这个接口上线之前要求改成通用性的。
首先是简单的处理，只有某一个功能用的话就涉及三个接口，第一个接口去感知这个用户是否二次认证过，第二个接口是用来发送验证码，第三个接口是将获得验证码输入进行匹配。我是这么想的也是这么实现的。
@Override
public Map SendVerificationCodeRetCode(Map<String, Object> params) {
Map<String, Object> ret = new HashMap<>();
String usernumber = String.valueOf(params.get("usernumber"));
if(StringUtils.isBlank(usernumber)){
ret.put("status","1");
ret.put("msg","参数不全");
return ret;
}
boolean existslogin = redisUtils.exists(getForbiddenToLoginKey(usernumber));
if(existslogin){
ret.put("status","2");
ret.put("msg","验证码输入错误次数超过5次，请两小时后重试。");
return ret;
}
boolean exists = redisUtils.exists(getSendTimeKey(usernumber));
if(exists){
ret.put("status","3");
ret.put("msg","发送过验证码，请稍后再试");
return ret;
}else {
String generate = generate();
redisUtils.set(getSendTimeKey(usernumber),generate,SendVerificationCodeTimeEffective);
LocalDateTime now = LocalDateTime.now();
DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
String formattedDateTime = now.format(formatter);
String text = "由XXX发送，验证码："+generate+"，验证码有效期1分钟，切勿将验证码泄露于他人。发送时间："+formattedDateTime;
params.put("msgcontent",text);
params.put("domainOrPayload",2);
secondaryValidation(params);
ret.put("status","4");
ret.put("data",generate);
ret.put("msg","验证码发送成功");
ret.put("text",text);
return ret;
}
}
@Override
public Map VerifyVerificationCode(Map<String, Object> params, HttpServletResponse res) {
Map<String, Object> ret = new HashMap<>();
String usernumber = String.valueOf(params.get("usernumber"));
String code = String.valueOf(params.get("code"));
if(StringUtils.isBlank(usernumber) || StringUtils.isBlank(code)){
ret.put("status","1");
ret.put("msg","参数不全");
return ret;
}
boolean existslogin = redisUtils.exists(getForbiddenToLoginKey(usernumber));
if(existslogin){
ret.put("status","2");
ret.put("msg","验证码输入错误次数超过5次，请两小时后重试");
return ret;
}
boolean exists = redisUtils.exists(getSendTimeKey(usernumber));
if(exists){
String usernumberCode = String.valueOf(redisUtils.get(getSendTimeKey(usernumber)));
if(usernumberCode.equals(code)){
redisUtils.set(getVerificationCodeKey(usernumber),"1",loginTime);
boolean existsFalseTime = redisUtils.exists(getFalseTimeKey(usernumber));
if(existsFalseTime){
redisUtils.remove(getFalseTimeKey(usernumber));
}
ret.put("status","3");
ret.put("msg","验证通过");
String secondary_validation = UUID.randomUUID().toString();
Cookie cookie = new Cookie("secondary_validation", secondary_validation);
cookie.setPath("/");
cookie.setDomain("");
cookie.setHttpOnly(Boolean.TRUE);
res.addCookie(cookie);
redisUtils.set(getVerificationCodeKeyCookie(unifastContext.getUser().getStaffId()),secondary_validation,loginTime);
return ret;
}else{
boolean existsFalseTime = redisUtils.exists(getFalseTimeKey(usernumber));
if(existsFalseTime){
int falseTime = (int) redisUtils.get(getFalseTimeKey(usernumber));
falseTime = falseTime + 1;
if(falseTime > 5){
redisUtils.remove(getFalseTimeKey(usernumber));
redisUtils.set(getForbiddenToLoginKey(usernumber),"1",ForbiddenToLoginTime);
ret.put("status","4");
ret.put("msg","验证码输入不正确，请重新输入。");
return ret;
}else {
redisUtils.set(getFalseTimeKey(usernumber),falseTime);
ret.put("status","5");
ret.put("msg","验证码输入不正确，请重新输入。");
return ret;
}
}else{
redisUtils.set(getFalseTimeKey(usernumber),1,falseTimeTime);
ret.put("status","6");
ret.put("msg","验证码输入不正确，请重新输入。");
return ret;
}
}
}else{
ret.put("status","7");
ret.put("msg","验证码已失效，请重新发送。");
return ret;
}
}
@Override
public Map WhetherToValidate(Map<String, Object> params) {
Map<String, Object> ret = new HashMap<>();
String usernumber = String.valueOf(params.get("usernumber"));
if(StringUtils.isBlank(usernumber)){
ret.put("status","1");
ret.put("msg","参数不全");
return ret;
}
if(redisUtils.exists(getVerificationCodeKey(usernumber))){
ret.put("status","2");
ret.put("msg","已验证");
return ret;
}else{
ret.put("status","3");
ret.put("msg","未验证");
return ret;
}
}
三个接口写完了，感觉是完事了，但是存在一个问题，如果被人直接访问了呢，直接选择跳过前台的二次验证判断接口，于是就想写一个拦截器，直接在每一个请求之前进行判断，思路的话就是在的登录之后，在token中存一个cookie中存一个key用于表示
import cn.chinaunicom.sdsi.cloud.auth.MallUser;
import cn.chinaunicom.sdsi.cloud.system.permission.entity.SysPermissionPO;
import cn.chinaunicom.sdsi.framework.utils.RedisUtils;
import cn.chinaunicom.sdsi.framework.utils.UnifastContext;
import cn.chinaunicom.sdsi.system.service.SecondaryValidationMenuService;
import cn.chinaunicom.sdsi.talent.secondaryValidation.service.SecondaryValidationService;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import lombok.Getter;
import lombok.Setter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.util.AntPathMatcher;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import javax.annotation.Resource;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.List;
@Primary
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@ConfigurationProperties(prefix = "unifast.cloud.resource")
public class SecondaryValidationFilter implements HandlerInterceptor {
@Autowired
private SecondaryValidationMenuService secondaryValidationService;
@Autowired
private UnifastContext unifastContext;
@Resource
private RedisUtils redisUtils;
public static final String SECONDARY_VALIDATION = "secondary_validation";
@Getter
@Setter
private List<String> whiteList;
/**
* 在请求处理之前调用-Controller方法调用之前调用
*
* @param request
* @param response
* @param handler
* @return
* @throws Exception
*/
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
AntPathMatcher pathMatcher = new AntPathMatcher();
for (String s : whiteList) {
if (pathMatcher.match(s, request.getRequestURI())) {
return true;
}
}
MallUser user = unifastContext.getUser();
//获取需要验证的接口
List<SysPermissionPO> permissionList = secondaryValidationService.getMoreVerify();
for (SysPermissionPO permission : permissionList) {
if(permission.getCheckCode().contains(request.getRequestURI())){
String cellphone = user.getCellphone();
Boolean isCode = redisUtils.exists("verification_code:" + cellphone);
if(isCode){
return true;
}else{
final Cookie[] cookies = request.getCookies();
if (cookies != null && cookies.length > 0) {
for (Cookie cookie : cookies) {
if ((SECONDARY_VALIDATION+":"+user.getStaffId()).equals(cookie.getName())) {
//获取redis中的token并判断正确性
String secondaryCalidationCode = (String) redisUtils.get(SECONDARY_VALIDATION + ":" + user.getStaffId());
if(secondaryCalidationCode.equals(cookie.getValue())){
return true;
}else{
response.setCharacterEncoding("utf-8");
response.setHeader("Content-Type","application/json;charset=utf-8");
String json = "{\"message\": \"需要二次认证\",\"code\": \"0\",\"data\": \"null\",\"success\": false}";
try {
response.getWriter().write(json);
} catch (IOException e) {
throw new RuntimeException(e);
}
return false;
}
}
}
}
response.setCharacterEncoding("utf-8");
response.setHeader("Content-Type","application/json;charset=utf-8");
String json = "{\"message\": \"需要二次认证\",\"code\": \"0\",\"data\": \"null\",\"success\": false}";
try {
response.getWriter().write(json);
} catch (IOException e) {
throw new RuntimeException(e);
}
return false;
}
}
}
return true;
}
/**
* 请求处理之后调用，但是在视图被渲染之前-Controller方法调用之后
*
* @param request
* @param response
* @param handler
* @param modelAndView
* @throws Exception
*/
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
}
/**
* 在整个请求调用之后被调用，也就是在DispatcherServlet渲染了对应的视图之后执行 主要是用于进行资源清理工作
*
* @param request
* @param response
* @param handler
* @param ex
* @throws Exception
*/
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
throws Exception {
}
}
import cn.chinaunicom.sdsi.filter.SecondaryValidationFilter;
import com.google.common.collect.Lists;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
import javax.annotation.Resource;
import java.util.List;
@Order(100)
@Configuration
/**
* 二次验证拦截器
*/
public class SecondaryValidation extends WebMvcConfigurerAdapter {
@Resource
private SecondaryValidationFilter loginLoginInterceptor;
@Override
public void addInterceptors(InterceptorRegistry registry) {
List<String> excludePathList = Lists.newArrayList();
registry.addInterceptor(loginLoginInterceptor).addPathPatterns("/*/**").excludePathPatterns(excludePathList.toArray(new String[0]))
.excludePathPatterns("/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**");
super.addInterceptors(registry);
}
}
实话说这块不是我写的，但是我大概能够看的懂，但是我自己写可能还是有差距，持续学习吧