Redis实战篇–短信登录
短信登录
基于session实现登录
主要流程
验证登录功能
session共享问题: 多台Tomcat并不共享session存储空间,当请求切换到不同tomcat服务时导致数据丢失的问题session的替代方案应该满足:
- 数据共享
- 内存存储
- key、value结构
基于Redis实现共享session登录
主要流程
发送短信验证码
public Result sendCodeByPhone(String phone, HttpSession session) {
//1.校验手机号
if (!RegexUtils.isPhoneInvalid(phone)) {
return Result.fail("手机格式错误");
}
//2.生成验证码
String code = RandomUtil.randomNumbers(6);
//3.保存验证码到redis
//session.setAttribute("code", code);
stringRedisTemplate.opsForValue().set(LOGIN_CODE_KEY+phone,code,LOGIN_CODE_TTL, TimeUnit.MINUTES);
//4.发送验证码
log.debug("发送短信成功,验证码 :{}" ,code);
return Result.ok();
}
短信验证码登录、注册
public Result login(LoginFormDTO loginForm, HttpSession session) {
//1.校验手机号
String phone = loginForm.getPhone();
if (!RegexUtils.isPhoneInvalid(phone)) {
return Result.fail("手机格式错误");
}
//2.校验验证码
String code = loginForm.getCode();
//从redis中获取验证码
String cacheCode = stringRedisTemplate.opsForValue().get(LOGIN_CODE_KEY + phone);
//3.验证码不一致
if (cacheCode == null || !cacheCode.equals(code)) {
return Result.fail("验证码错误");
}
//4.验证码一致
//5.查询用户是否存在
User user = query().eq("phone", phone).one();
//6.不存在 创建新用户
if (user == null) {
user = userService.createUser(phone);
}
//7.将用户信息保存至redis
//7.1 随机生成token 作为主键
String token = UUID.randomUUID().toString(true);
//7.2 将User对象转为Hash存储
//将user转为UserDTO是为了保护数据
UserDTO userDTO = new UserDTO();
BeanUtils.copyProperties(user,userDTO);
Map<String, Object> userMap = BeanUtil.beanToMap(userDTO,new HashMap<>(),
CopyOptions.create().setIgnoreNullValue(true)
.setFieldValueEditor((fieldName, fileldValue) -> fileldValue.toString()));
//7.3存储
//将UserDTO转为Map
String tokenKey = LOGIN_USER_KEY + token;
stringRedisTemplate.opsForHash().putAll(tokenKey,userMap);
//7.4设置 token 有效期
stringRedisTemplate.expire(tokenKey,LOGIN_USER_TTL,TimeUnit.SECONDS);
//8.返回token
return Result.ok(token);
}
@Override
public User createUser(String phone) {
User user = new User();
user.setPhone(phone);
user.setNickName(USER_NICK_NAME_PREFIX + RandomUtil.randomString(10));
save(user);
return user;
}
保存数据至Redis数据结构的选择
登录拦截器的优化
在原本的有选着性的拦截器前再加上一个拦截任何请求的拦截器,将获取和刷新token的操作移至前一个拦截器中。
/**
第一个拦截器
*/
public class RefeshTokenTimeInterceptor implements HandlerInterceptor {
//注入stringRedisTemplate
private StringRedisTemplate stringRedisTemplate;
public RefeshTokenTimeInterceptor(StringRedisTemplate stringRedisTemplate) {
this.stringRedisTemplate = stringRedisTemplate;
}
//controller之前
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
//1.获取请求头中的token
String token = request.getHeader("authorization");
if(StringUtil.isNullOrEmpty(token)){
return true;
}
//2.基于token获取redis中的用户
String key = RedisConstants.LOGIN_USER_KEY + token;
Map<Object, Object> userMap = stringRedisTemplate.opsForHash().entries(key);
//3.判断用户是否存在
if(userMap.isEmpty()){
return true;
}
//将查询到的数据转为UserDTO
UserDTO userDTO = BeanUtil.fillBeanWithMap(userMap, new UserDTO(), false);
//6.存在保存用户信息至ThreadLocal
UserHolder.saveUser(userDTO);
// 刷新token有效期
stringRedisTemplate.expire(key,RedisConstants.LOGIN_USER_TTL, TimeUnit.SECONDS);
//8.放行
return HandlerInterceptor.super.preHandle(request, response, handler);
}
//controller之后
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
HandlerInterceptor.super.postHandle(request, response, handler, modelAndView);
}
//视图渲染之后返回用户之前 销毁对应用户信息 避免内存泄露
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
UserHolder.removeUser();
HandlerInterceptor.super.afterCompletion(request, response, handler, ex);
}
}
/**
第二个拦截器
*/
public class LoginInterceptor implements HandlerInterceptor {
//controller之前
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
UserDTO user = UserHolder.getUser();
//判断是否需要拦截 即ThreadLocal中是否有用户
if (user == null) {
//没有 需要拦截
response.setStatus(401);
//拦截
return false;
}
//8.放行
return HandlerInterceptor.super.preHandle(request, response, handler);
}
//controller之后
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
HandlerInterceptor.super.postHandle(request, response, handler, modelAndView);
}
//视图渲染之后返回用户之前 销毁对应用户信息 避免内存泄露
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
UserHolder.removeUser();
HandlerInterceptor.super.afterCompletion(request, response, handler, ex);
}
}
对拦截器进行配置
@Configuration
public class MvcConfig implements WebMvcConfigurer {
@Resource
StringRedisTemplate stringRedisTemplate;
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new LoginInterceptor())
.excludePathPatterns(
"/shop/**",
"/voucher/**",
"/shop-type/**",
"/upload/**",
"/blog/hot",
"/user/code",
"/user/login"
).order(1);
registry.addInterceptor(new RefeshTokenTimeInterceptor(stringRedisTemplate)).addPathPatterns("/**").order(0);
}
}
总结
Redis代替session需要考虑的问题
- 选择合适的数据结构
- 选择合适的key
- 选择合适的存储粒度