我在java中使用带有安全性的spring boot。我有一个覆盖此方法UserDetails lodUserByUsername(String email)
。
我希望当用户输入错误的电子邮件和密码时提供响应“无效的用户名和密码”
如果他们的电子邮件存在并且他们将输入错误的密码,则该尝试的特定用户将增加 1 并存储到列尝试的数据库表中。
如果该用户的超出限制超过 3 个,超出我想要的响应“您的用户名已被阻止”
如果该用户前两次或一次尝试输入错误的密码,则唯一的尝试次数会增加并显示响应“您的尝试是”+MIN_ATTEMPTS。
如果用户输入了前两次或一次尝试输入错误的密码,那么在他们可以输入正确的用户名和密码后,该特定用户的尝试次数将设置为 0。
private static final int MAX_ATTEMPTS = 3;
int MIN_ATTEMPTS = 0;
@SneakyThrows
@Override
public UserDetails loadUserByUsername(String email) {
Members members = membersDao.findByEmail(email);
Set<GrantedAuthority> authorities = new HashSet<>();
if (members == null) {
throw new Exception("Invalid username and password");
} else {
MIN_ATTEMPTS = members.getAttempts();
MIN_ATTEMPTS++;
members.setAttempts(MIN_ATTEMPTS);
membersDao.save(members);
}
if (members.getAttempts() <= MAX_ATTEMPTS) {
APIResponseBuilder.build(true , commonMessages.loginSuccess);
return new User(members.getEmail(), members.getPassword(), authorities);
} else {
throw new Exception("You have exceed max +" + MAX_ATTEMPTS + "+limit of login");
}
}
最佳答案
我已将上述代码添加到我的身份验证 Controller 中,问题已解决
1. Controller
private static final int MAX_ATTEMPTS = 3;
@PostMapping("/login")
public ResponseEntity<?> login(@RequestBody LoginMembers loginMembers) throws AuthenticationException, IOException, ServletException {
Members members = membersDao.findByEmail(loginMembers.getEmail());
PasswordEncoder passencoder = new BCryptPasswordEncoder();
if (members == null) {
//Create Error Message for User
throw new RuntimeException("Invalid Username and Password");
}
if (members.getAttempts() >= MAX_ATTEMPTS) {
//Create Error Message for User
throw new RuntimeException("Login Attempt exceeds "+MAX_ATTEMPTS);
}
if (passencoder.matches(loginMembers.getPassword(), members.getPassword())) {
final Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
loginMembers.getEmail(),
loginMembers.getPassword()
)
);
SecurityContextHolder.getContext().setAuthentication(authentication);
final String token = jwtTokenUtil.generateToken(authentication);
logger.info("You are log in successfully with token");
return ResponseEntity.ok(new AuthTokenRequest(token));
} else {
int attempts = members.getAttempts();
members.setAttempts(++attempts);
membersDao.save(members);
//Create Error Message for User
throw new RuntimeException("Login attempts "+attempts);
}
}
- 方法
@Override
public UserDetails loadUserByUsername(String email) {
Members members = membersDao.findByEmail(email);
Set<GrantedAuthority> authorities = new HashSet<>();
try {
Role role = members.getRoles();
authorities.add(new SimpleGrantedAuthority(role.getRole()));
} catch (Exception e) {
APIResponseBuilder.build(false, e.getMessage(), commonMessages.exception);
}
return new User(members.getEmail(), members.getPassword(), authorities);
}
关于java - 当登录尝试超过 3 次时,用户无法使用 Spring Security Rest API 登录?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/60652851/