一、说明
在实际开发中,为了保护用户信息的安全,都会在网站登录界面上添加一次性验证码,从而限制人们使用软件来暴力猜测密码。在实现用户登录案例中,增加一次性验证码功能。
验证码是4个随机字符,以图片的形式展示给用户。
二、实现步骤
1.修改登录页面login.html
增加验证码输入框和验证码图片
<form name="reg" action="/chapter05/LoginServlet" method="post">
用户名: <input name="username" type="text" /><br />
密 码:<input name="password" type="password" /><br />
验证码:<input type="text" name="check_code">
<img src="/chapter05/CheckServlet"><br>
<input type="submit" value="提交" id="bt" />
</form>
2.创建CheckServlet类
用于产生验证码图片
public class CheckServlet extends HttpServlet
{
private static int WIDTH = 60; //验证码图片宽度
private static int HEIGHT = 20; //验证码图片高度
public void doGet(HttpServletRequest request,HttpServletResponse response)
throws ServletException,IOException{
HttpSession session = request.getSession();
response.setContentType("image/jpeg");
ServletOutputStream sos = response.getOutputStream();
//设置浏览器不要缓存此图片
response.setHeader("Pragma","No-cache");
response.setHeader("Cache-Control","no-cache");
response.setDateHeader("Expires", 0);
//创建内存图象并获得其图形上下文
BufferedImage image =
new BufferedImage(WIDTH, HEIGHT, BufferedImage.TYPE_INT_RGB);
Graphics g = image.getGraphics();
//产生随机的认证码
char [] rands = generateCheckCode();
//产生图像
drawBackground(g);
drawRands(g,rands);
//结束图像的绘制过程,完成图像
g.dispose();
//将图像输出到客户端
ByteArrayOutputStream bos = new ByteArrayOutputStream();
ImageIO.write(image, "JPEG", bos);
byte [] buf = bos.toByteArray();
response.setContentLength(buf.length);
//下面的语句也可写成:bos.writeTo(sos);
sos.write(buf);
bos.close();
sos.close();
//将当前验证码存入到Session中
session.setAttribute("check_code",new String(rands));
//直接使用下面的代码将有问题,Session对象必须在提交响应前获得
//request.getSession().setAttribute("check_code",new String(rands));
}
//生成一个4字符的验证码
private char [] generateCheckCode()
{
//定义验证码的字符表
String chars = "0123456789abcdefghijklmnopqrstuvwxyz";
char [] rands = new char[4];
for(int i=0; i<4; i++)
{
int rand = (int)(Math.random() * 36);
rands[i] = chars.charAt(rand);
}
return rands;
}
private void drawRands(Graphics g , char [] rands)
{
g.setColor(Color.BLACK);
g.setFont(new Font(null,Font.ITALIC|Font.BOLD,18));
//在不同的高度上输出验证码的每个字符
g.drawString("" + rands[0],1,17);
g.drawString("" + rands[1],16,15);
g.drawString("" + rands[2],31,18);
g.drawString("" + rands[3],46,16);
System.out.println(rands);
}
private void drawBackground(Graphics g)
{
//画背景
g.setColor(new Color(0xDCDCDC));
g.fillRect(0, 0, WIDTH, HEIGHT);
//随机产生120个干扰点
for(int i=0; i<120; i++)
{
int x = (int)(Math.random() * WIDTH);
int y = (int)(Math.random() * HEIGHT);
int red = (int)(Math.random() * 255);
int green = (int)(Math.random() * 255);
int blue = (int)(Math.random() * 255);
g.setColor(new Color(red,green,blue));
g.drawOval(x,y,1,0);
}
}
}
3.修改LoginServlet
增加对验证码的判断
/**
* 添加了验证码
*/
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=utf-8");
String username = request.getParameter("username");
String password = request.getParameter("password");
String checkCode = request.getParameter("check_code");
String savedCode = (String) request.getSession().getAttribute("check_code");
PrintWriter pw = response.getWriter();
if (("itcast").equals(username) && ("123").equals(password) && checkCode.equals(savedCode)) {
User user = new User();
user.setUsername(username);
user.setPassword(password);
request.getSession().setAttribute("user", user);
response.sendRedirect("/chapter05/IndexServlet");
} else if (checkCode.equals(savedCode)) {
pw.write("用户名或密码错误,登录失败");
} else {
pw.write("验证码错误");
}
}
三、启动Tomcat,测试验证码
http://localhost:8080/chapter05/login.html
如果用户名和密码正确,但不填验证码: