登录功能:md5加密与分布式Session

迷南。 2022-05-20 03:48 153阅读 0赞

强烈推荐一个大神的人工智能的教程：[http://www.captainbed.net/zhanghan][http_www.captainbed.net_zhanghan]

## 1. 背景 ##

网站上用户登录时用户密码明文传输是比较危险的,因此引入md5密码加密,在数据库中存放的也是加密后的,用户登录是否成功时比较两次加密后和数据库中存放的用户密码是否相同做出判断。

## ２. 依赖jar包 ##

<dependency>
          <groupId>commons-codec</groupId>
          <artifactId>commons-codec</artifactId>
          <version>1.11</version>
        </dependency>
        <dependency>
          <groupId>org.apache.commons</groupId>
          <artifactId>commons-lang3</artifactId>
          <version>3.7</version>
        </dependency>

\#\#3. 写一个2次加密的工具类

public class MD5Util {
        public static String md5(String src){
            return DigestUtils.md5Hex(src);
        }
        
        private static final String salt = "1a2b3c4d";
        //用户输入信息加密传递到后台
        public static String inputPassToFormPass(String inputPass){
            String str =""+ salt.charAt(0) + salt.charAt(2) + inputPass + salt.charAt(5) + salt.charAt(4);
    
            return md5(str);
        }
        //传递到后台的加密信息二次加密存到数据库
        public static String formPassToDBPass(String formPass,String salt){
            String str = ""+salt.charAt(0) + salt.charAt(2) + formPass + salt.charAt(5) + salt.charAt(4);
            return md5(str);
        }
    
        public static String inputPassToDbPass(String input,String saltDB){
            String formPass = inputPassToFormPass(input);
            String dbPass = formPassToDBPass(formPass,saltDB);
            return dbPass;
        }
    }

\#\#4. 前端传递到后端为加密的密码  
根据相同的规则加密(盐值相同,加密表达式规则相同)

var inputPass = $("#password").val();
    	var salt = g_passsword_salt;
    	var str = ""+salt.charAt(0)+salt.charAt(2) + inputPass +salt.charAt(5) + salt.charAt(4);
    	var password = md5(str);

## 5. 后端验证 ##

a.判断用户名是否存在,若存在取回用户信息

//判断手机号是否存在
    MiaoshaUser user = getById(Long.parseLong(mobile));
      if (user == null) {
       throw new GlobalException(CodeMsg.MOBILE_NOT_EXIST);
      }

b.验证前端传递的密码再加密一次后和数据库中存放的密码是否相同,若相同则证明登录成功

//验证密码
     String password1 = user.getPassword();
     String salt = user.getSalt();
     String calPass = MD5Util.formPassToDBPass(password, salt);
     if (!calPass.equals(password1)) {
        throw new GlobalException(CodeMsg.PASSWORD_ERROR);
     }

c.生成token,将token存放到redis中,将token放到cookie中,返回给前端,之后的请求都会带上这个token,之后的操作去比较request中的cookies是否有这个token,用来判断是否已经登录

//生成cookie
    String token = UUIDUtil.uuid();
    
    addCookie(response,token, user);

private void addCookie(HttpServletResponse response,String token, MiaoshaUser user) {
            //将用户信息放入redis中
            redisService.set(MiaoshaUserKey.token, token, user);
            //将生成的token放入到response中返回给前台
            Cookie cookie = new Cookie(COOKI_NAME_TOKEN, token);
            cookie.setMaxAge(MiaoshaUserKey.token.expireSeconds());
            cookie.setPath("/");
            response.addCookie(cookie);
        }

验证是否已经登录:

@Service
    public class UserArgumentResolver implements HandlerMethodArgumentResolver {
    
    	@Autowired
    	MiaoshaUserService userService;
    
    	/**
    	 *
    	 * @param parameter 获取参数
    	 * @return 只要参数类型是MiaoshaUser.class,则执行resolveArgument,从而
    	 * 判断用户是否已经登录
    	 */
    	public boolean supportsParameter(MethodParameter parameter) {
    		Class<?> clazz = parameter.getParameterType();
    		return clazz==MiaoshaUser.class;
    	}
    
    	public Object resolveArgument(MethodParameter parameter, ModelAndViewContainer mavContainer,
    			NativeWebRequest webRequest, WebDataBinderFactory binderFactory) throws Exception {
    		HttpServletRequest request = webRequest.getNativeRequest(HttpServletRequest.class);
    		HttpServletResponse response = webRequest.getNativeResponse(HttpServletResponse.class);
    		
    		String paramToken = request.getParameter(MiaoshaUserService.COOKI_NAME_TOKEN);
    		String cookieToken = getCookieValue(request, MiaoshaUserService.COOKI_NAME_TOKEN);
    		if(StringUtils.isEmpty(cookieToken) && StringUtils.isEmpty(paramToken)) {
    			return null;
    		}
    		String token = StringUtils.isEmpty(paramToken)?cookieToken:paramToken;
    		return userService.getByToken(response, token);
    	}
    
    	private String getCookieValue(HttpServletRequest request, String cookiName) {
    		Cookie[]  cookies = request.getCookies();
    		if(cookies == null || cookies.length <=0){
    			return null;
    		}
    		for(Cookie cookie : cookies) {
    			if(cookie.getName().equals(cookiName)) {
    				return cookie.getValue();
    			}
    		}
    		return null;
    	}
    
    }

[http_www.captainbed.net_zhanghan]: http://www.captainbed.net/zhanghan