登录优化
我们登录成功时会得到一个令牌,而当我们修改密码重新登录后会得到一个新令牌,但是这时旧令牌仍然可以使用,这就有很大的安全隐患。
这时我们想到用redis
来存储令牌,当外界登录时,需要验证令牌是否在redis
中储存,若redis
中没有该令牌,则无法登录。当修改密码时,则会将旧令牌删除,写入新令牌进redis
。
1.先引入redis依赖坐标
<!-- redis坐标-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
2.在application.yml配置redis相关信息
spring:
datasource:
driver-class-name: com.mysql.cj.jdbc.Driver
url: jdbc:mysql://localhost:3306/big_event
username: root
password: 123456
data:
redis:
host: localhost
port: 6379
password: root@123456
3.在测试类中测试redis是否能够正常使用
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.data.redis.core.ValueOperations;
import java.util.concurrent.TimeUnit;
@SpringBootTest//如果在测试类上添加了这个注解,那么将来单元测试方法执行之前,我们会先初始化spring容器
public class RedisTest {
@Autowired
private StringRedisTemplate stringRedisTemplate;
@Test
public void testSet(){
//往redis中存储一个键值对 StringRedisTemplate
ValueOperations<String,String> operations = stringRedisTemplate.opsForValue();
operations.set("username","zhangsan");
operations.set("id","1",15, TimeUnit.SECONDS);
}
@Test
public void testGet(){
//从redis中获取一个键值对
ValueOperations<String,String> operations = stringRedisTemplate.opsForValue();
System.out.println(operations.get("username"));
}
}
4.下载redis,启动redis-server.exe服务(有问题看错误笔记4.),通过redis-cli.exe图形化界面查询,也可以通过java代码测试。
5.正式写redis令牌失效机制,在Controller的登录中加上当登录时,将token令牌写入redis,先自动装配
@Autowired
private UserService userService;
@Autowired
private StringRedisTemplate stringRedisTemplate;//----------
再写流程
@PostMapping("/login")
public Result<String> login(@Pattern(regexp = "^\\S{5,16}$") String username,@Pattern(regexp = "^\\S{5,16}$") String password){
//根据用户名查询用户
User loginUser = userService.findByUserName(username);
//判断用户是否存在
if(loginUser==null){
return Result.error("用户名错误");
}
//判断密码是否正确
if(Md5Util.getMD5String(password).equals(loginUser.getPassword())){
Map<String,Object> claims = new HashMap<>();
claims.put("id",loginUser.getId());
claims.put("username",loginUser.getUsername());
String token = JwtUtil.genToken(claims);
//把token记录在redis中-------------
ValueOperations<String,String> operations = stringRedisTemplate.opsForValue();
operations.set(token,token,1, TimeUnit.HOURS);//------------
return Result.success(token);
}
return Result.error("密码错误");
}
6.在登录拦截器中验证,同样是先自动装配,再写判断
@Component
public class LoginInterceptor implements HandlerInterceptor {
@Autowired
private StringRedisTemplate stringRedisTemplate;//----------
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
//令牌验证
String token = request.getHeader("Authorization");
try {
//从redis中获取相同的token---
ValueOperations<String,String> operations = stringRedisTemplate.opsForValue();
String redisToken = operations.get(token);
if (redisToken==null){
//token已经失效
throw new RuntimeException();
}
//----------------
Map<String,Object> claims = JwtUtil.parseToken(token);
//把业务数据存储到ThreadLocal中
ThreadLocalUtil.set(claims);
//放行
return true;
} catch (Exception e) {
//http响应状态码为401
response.setStatus(401);
//不放行
return false;
}
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
//清空ThreadLocal中的数据
ThreadLocalUtil.remove();
}
}
7.当修改密码时得到新的令牌,并使旧令牌失效
@PatchMapping("/updatePwd")
public Result updatePwd(@RequestBody Map<String,String> params,@RequestHeader("Authorization") String token){
//1.校验参数
String oldPwd = params.get("old_pwd");
String newPwd = params.get("new_pwd");
String rePwd = params.get("re_pwd");
if (!StringUtils.hasLength(oldPwd)||!StringUtils.hasLength(newPwd)||!StringUtils.hasLength(rePwd)){
return Result.error("缺少必要的参数");
}
//原密码是否正确
//调用service拿到原密码
Map<String,Object> map = ThreadLocalUtil.get();
String username = (String) map.get("username");
User loginUser = userService.findByUserName(username);
if (!loginUser.getPassword().equals(Md5Util.getMD5String(oldPwd))){
return Result.error("原密码填写不正确");
}
//new和re是否一样
if (!rePwd.equals(newPwd)){
return Result.error("两次填写的新密码不一致");
}
//2.调用service完成密码更新
userService.updatePwd(newPwd);
//删除原来的token
ValueOperations<String,String> operations = stringRedisTemplate.opsForValue();
operations.getOperations().delete(token);
return Result.success();
}