Spring Boot项目Shiro1.7.1版本默认密钥的漏洞

没有什么是不变的

已于 2022-09-21 18:45:23 修改

阅读量3k

点赞数

分类专栏： Java

于 2022-09-06 09:30:18 首次发布

本文链接：https://blog.csdn.net/UD_World/article/details/126718066

版权

Shiro 安全框架密钥管理 AES加密动态密钥

关键词由CSDN通过智能技术生成

Java 专栏收录该内容

7 篇文章 0 订阅

订阅专栏

1.Shiro1.7.1默认密钥


public CookieRememberMeManager rememberMeManager(){
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        cookieRememberMeManager.setCookie(rememberMeCookie());
        cookieRememberMeManager.setCipherKey(Base64.decode("fCq+/xW488hMTCD+cmJ3aQ=="));
        return cookieRememberMeManager;
    }

2.重新生成新的密钥

  
  public static void main(String[] args) throws Exception {
        
        KeyGenerator keygen = KeyGenerator.getInstance("AES");
        SecretKey deskey = keygen.generateKey();
        System.out.println(Base64.encodeToString(deskey.getEncoded()));

    }

用新生成的密钥替换原来的密钥即可。

3.或者直接换成动态密钥


 public CookieRememberMeManager rememberMeManager()
    {
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        cookieRememberMeManager.setCookie(rememberMeCookie());
        cookieRememberMeManager.setCipherKey(Base64.decode(generateNewKey()));
        return cookieRememberMeManager;
    }

    public static String generateNewKey() {
        try {
            KeyGenerator keygen = KeyGenerator.getInstance("AES");
            SecretKey deskey = keygen.generateKey();
            return Base64.encodeToString(deskey.getEncoded());
        }catch (Exception e){
            e.printStackTrace();
            return "7Iqlf6Ql/A4h7Umjw+254w==";
        }
    }