1.短信登录
1.1基于Session实现登录
流程分析
1.1.1发送短信验证码
public Result sendCode(String phone, HttpSession session) {
//1.效验手机号
if(RegexUtils.isPhoneInvalid(phone)){
//2.不符合,返回错误信息
return Result.fail("手机号格式错误");
}
//3.符合,生成验证码
String code = RandomUtil.randomNumbers(6);
//4.保存验证码到session
session.setAttribute("code",code);
//5.发送验证码
log.debug("发送短信验证码成功:验证码:{}",code);
return Result.ok();
}
1.1.2短信验证码登录
流程分析
public Result login(LoginFormDTO loginForm, HttpSession session) {
//1.校验手机号
String phone = loginForm.getPhone();
if(RegexUtils.isPhoneInvalid(phone)){
//2.不符合,返回错误信息
return Result.fail("手机号格式错误");
}
//2.校验验证码
Object cachCode = session.getAttribute("code");
String code = loginForm.getCode();
if(cachCode == null || !cachCode.toString().equals(code)){
//3.不一致,报错
return Result.fail("验证码错误");
}
//4.一致,根据手机号查询用户
User user = query().eq("phone", phone).one();
//5.判断用户是否存在
if (user == null){
//6不存在
createUserWithPhone(phone);
}
//7.保存用户信息到session中
session.setAttribute("user",user);
return Result.ok();
}
private User createUserWithPhone(String phone) {
User user = new User();
user.setNickName(USER_NICK_NAME_PREFIX + RandomUtil.randomString(10));
user.setPhone(phone);
save(user);
return user;
}
1.2登录验证功能
设置拦截器
public class LoginInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response,Object handler) throws Exception{
//1.获取session
HttpSession session = request.getSession();
//2.获取session用户
Object user = session.getAttribute("user");
//3.判断用户是否存在
if(user == null){
//4不存在,拦截
response.setStatus(401);
return false;
}
//5.存在,保存用户信息到ThreadLocal
UserHolder.saveUser((UserDTO) user);
//6.放行
return true;
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Exception ex) throws Exception {
//移除用户
UserHolder.removeUser();
}
}
添加拦截器
@Configuration
public class MvcConfig implements WebMvcConfigurer {
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new LoginInterceptor())
.excludePathPatterns(
"/shop/**",
"/voucher/**",
"/shop-type/**",
"/upload/**",
"/blog/hot",
"/user/code",
"/user/login"
);
}
}
1.3集群的Session共享问题
多台Tomcat并不共享session存储空间,当请求切换到不同tomcat服务时导致数据丢失的问题。
session的替代方案应该满足:
- 数据共享
- 内存存储
- key、value结构
1.4基于Redis实现共享session登录
基于redis的短信发送、验证码验证登录、注册流程
修改发送短信代码-将验证码保存到redis
stringRedisTemplate.opsForValue().set(LOGIN_CODE_KEY +phone, code, LOGIN_CODE_TTL, TimeUnit.MINUTES);
修改登录代码
public Result login(LoginFormDTO loginForm, HttpSession session) {
//1.效验手机号
String phone = loginForm.getPhone();
if (RegexUtils.isPhoneInvalid(phone)){
//2.如果不符合,返回错误信息
return Result.fail("手机号格式错误");
}
//3.效验验证码
String cacheCode = stringRedisTemplate.opsForValue().get(LOGIN_CODE_KEY+phone);
String code = loginForm.getCode();
if(cacheCode == null || !cacheCode.equals(code)){
//3.不一致,报错
return Result.fail("验证码错误");
}
//4.一致,根据手机号查询用户
User user = query().eq("phone", phone).one();
//5.判断用户是否存在
if(user == null){
//6.不存在,创建用户并保存
user = createUserWithPhone(phone);
}
//7.保存用户到redis中
//7.1随机生成token,作为登录令牌
String token = UUID.randomUUID().toString(true);
//7.2将User对象转为Hash存储
UserDTO userDTO = BeanUtil.copyProperties(user, UserDTO.class);
Map<String, Object> userMap = BeanUtil.beanToMap(userDTO, new HashMap<>(),
CopyOptions.create()
.setIgnoreNullValue(true)
.setFieldValueEditor((fieldName, fieldValue) -> fieldValue.toString()));
//7.3存储
String tokenKey = LOGIN_USER_KEY + token;
stringRedisTemplate.opsForHash().putAll(tokenKey,userMap);
//7.4设置token有效期
stringRedisTemplate.expire(tokenKey, LOGIN_USER_TTL, TimeUnit.MINUTES);
//8.返回token
return Result.ok(token);
}
修改登录拦截器-并且给用户的key设置刷新,一旦访问了到拦截器,就刷新时间
以下有一个细节点:StringRestTemplate并不归sping管,拦截器无法直接注入
方法给构造器传入StringRestTemplate,在添加拦截器的MvcConfig(归spring管)注入StringRedisTemplate,然后用拦截器的相应共构造器,这样就在拦截器中注入了stringredistemplate了
@Resource
private StringRedisTemplate stringRedisTemplate;
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new LoginInterceptor(stringRedisTemplate))
.excludePathPatterns(
"/shop/**",
"/voucher/**",
"/shop-type/**",
"/upload/**",
"/blog/hot",
"/user/code",
"/user/login"
);
}
private StringRedisTemplate stringRedisTemplate;
public LoginInterceptor(StringRedisTemplate stringRedisTemplate) {
this.stringRedisTemplate = stringRedisTemplate;
}
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response,Object handler) throws Exception{
//1.获取请求头中的token
String token = request.getHeader("authorization");
if(StrUtil.isBlank(token)){
//不存在,拦截
response.setStatus(401);
return false;
}
//2.基于TOKEN获取redis中的用户
Map<Object, Object> userMap = stringRedisTemplate.opsForHash()
.entries(LOGIN_USER_KEY + token);
//3.判断用户是否存在
if(userMap.isEmpty()){
//4不存在,拦截
response.setStatus(401);
return false;
}
//5.将查询到的Has数据转为UserDTO对象
UserDTO userDTO = BeanUtil.fillBeanWithMap(userMap, new UserDTO(), false);
//6.存在,保存用户信息到ThreadLocal
UserHolder.saveUser(userDTO);
//7.刷新token有效期
stringRedisTemplate.expire(LOGIN_USER_KEY + token, LOGIN_USER_TTL, TimeUnit.MINUTES);
//放行
return true;
}
1.5解决登录状态刷新问题
上面的刷新token有效期只对需要做登录效验的页面刷新,而用户的首页等不需要效验的就不会刷新
添加一个拦截器,拦截一切路径,用于刷新token有效期,查询redis用户,有则保存到threadlocal
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response,Object handler) throws Exception{
//1.获取请求头中的token
String token = request.getHeader("authorization");
if(StrUtil.isBlank(token)){
return true;
}
//2.基于TOKEN获取redis中的用户
Map<Object, Object> userMap = stringRedisTemplate.opsForHash()
.entries(LOGIN_USER_KEY + token);
//3.判断用户是否存在
if(userMap.isEmpty()){
return true;
}
//5.将查询到的Has数据转为UserDTO对象
UserDTO userDTO = BeanUtil.fillBeanWithMap(userMap, new UserDTO(), false);
//6.存在,保存用户信息到ThreadLocal
UserHolder.saveUser(userDTO);
//7.刷新token有效期
stringRedisTemplate.expire(LOGIN_USER_KEY + token, LOGIN_USER_TTL, TimeUnit.MINUTES);
//放行
return true;
}
第二个拦截器
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response,Object handler) throws Exception{
//1.判断是否需要拦截
if(UserHolder.getUser() == null){
//没有,拦截
return false;
}
//有,放行
return true;
}
添加拦截器
@Configuration
public class MvcConfig implements WebMvcConfigurer {
@Resource
private StringRedisTemplate stringRedisTemplate;
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new LoginInterceptor())
.excludePathPatterns(
"/shop/**",
"/voucher/**",
"/shop-type/**",
"/upload/**",
"/blog/hot",
"/user/code",
"/user/login"
).order(1);
//token刷新的拦截器
registry.addInterceptor(new RefreshTokenInterceptor(stringRedisTemplate))
.excludePathPatterns(
"/**"
//order越大,优先级越低
).order(0);
}
}