java session 伪造_Java Session验证码案例代码实例解析

案例

用户输入用户名，密码以及验证码。

如果用户名和密码输入有误，跳转登录页面，提示:用户名或密码错误

如果验证码输入有误，跳转登录页面，提示：验证码错误

如果全部输入正确，则跳转到主页success.jsp，显示：用户名,欢迎您思路

在生成验证码的时候将它的值存入到session中，在比对的时候再取出来进行对比

代码index.jsp

Created by IntelliJ IDEA.

User: tanglei

Date: 2020/6/26

Time: 下午12:48

To change this template use File | Settings | File Templates.

--%>

login

window.onload = function(){

document.getElementById("img").onclick = function(){

this.src="/login_time_war_exploded/checkCode?time="+new Date().getTime();

}

}

div{

color: red;

}

用户名
密码
验证码

success.jsp

Created by IntelliJ IDEA.

User: tanglei

Date: 2020/6/26

Time: 下午6:27

To change this template use File | Settings | File Templates.

--%>

Title

,欢迎您

验证码checkCode.java

package cn.guizimo.servlet;

import javax.imageio.ImageIO;

import javax.servlet.ServletException;

import javax.servlet.annotation.WebServlet;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.awt.*;

import java.awt.image.BufferedImage;

import java.io.IOException;

import java.util.Random;

@WebServlet("/checkCode")

public class CheckCode extends HttpServlet {

@Override

protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

int width = 100;

int height = 50;

//创建图片对象

BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR);

//美化

Graphics g = image.getGraphics();

//背景

g.setColor(Color.PINK);

g.fillRect(0, 0, width, height);

//边框

g.setColor(Color.BLUE);

g.drawRect(0, 0, width - 1, height - 1);

String str = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

Random ran = new Random();

StringBuilder sb = new StringBuilder();

for (int i = 1; i <= 4; i++) {

int index = ran.nextInt(str.length());

char ch = str.charAt(index);

sb.append(ch);

g.drawString(ch+"",width/5*i,height/2);

}

String checkCode_session = sb.toString();

//将验证码存入session

req.getSession().setAttribute("checkCode_session",checkCode_session);

//干扰线

g.setColor(Color.GREEN);

for (int i = 0; i < 10; i++) {

int x1 = ran.nextInt(width);

int x2= ran.nextInt(width);

int y1 = ran.nextInt(height);

int y2 = ran.nextInt(height);

g.drawLine(x1,y1,x2,y2);

}

//输出图片到浏览器

ImageIO.write(image, "jpg", resp.getOutputStream());

}

@Override

protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

this.doPost(req, resp);

}

}

login.java

package cn.guizimo.servlet;

import javax.servlet.ServletException;

import javax.servlet.annotation.WebServlet;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

import java.io.IOException;

@WebServlet("/login")

public class Login extends HttpServlet {

@Override

protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

//1.设置request编码

req.setCharacterEncoding("utf-8");

//2.获取参数

String username = req.getParameter("username");

String password = req.getParameter("password");

String checkCode = req.getParameter("checkCode");

//3.先获取生成的验证码

HttpSession session = req.getSession();

String checkCode_session = (String) session.getAttribute("checkCode_session");

//删除session中存储的验证码

//session.removeAttribute("checkCode_session");

//3.先判断验证码是否正确

if(checkCode_session!= null && checkCode_session.equalsIgnoreCase(checkCode)){

//忽略大小写比较

//验证码正确

//判断用户名和密码是否一致

if("zhangsan".equals(username) && "123".equals(password)){//需要调用UserDao查询数据库

//登录成功

//存储信息，用户信息

session.setAttribute("user",username);

//重定向到success.jsp

resp.sendRedirect(req.getContextPath()+"/success.jsp");

}else{

//登录失败

//存储提示信息到request

req.setAttribute("login_error","用户名或密码错误");

//转发到登录页面

req.getRequestDispatcher("/login.jsp").forward(req,resp);

}

}else{

//验证码不一致

//存储提示信息到request

req.setAttribute("cc_error","验证码错误");

//转发到登录页面

req.getRequestDispatcher("/login.jsp").forward(req,resp);

}

}

@Override

protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

this.doPost(req, resp);

}

}

测试登录界面

验证码错误

用户名密码错误

登录成功

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持脚本之家。