SpringSecurity根據(jù)自定義異常返回登錄錯誤提示信息(賬戶鎖定)

更新時(shí)間：2025年01月20日 09:48:23 作者：夢里花落知多少

本文介紹了在SpringSecurity中根據(jù)自定義異常返回登錄錯誤提示信息的方法,特別是在賬戶鎖定時(shí),通過記錄輸錯次數(shù)、重寫校驗(yàn)方法并拋出自定義異常,感興趣的可以了解一下

一、背景

當(dāng)前場景：用戶在登錄失敗需要根據(jù)不同的場景返回不同的提示信息，例如賬號不存在或密碼輸錯提示 “用戶名或密碼錯誤”，賬號禁用是提示 "賬戶被鎖定"等，默認(rèn)輸錯5次密碼后賬戶會被鎖定。

需求：當(dāng)最后一次輸錯密碼時(shí)需要給用戶提示出 “xxx賬戶將被鎖定” 的提示，而不是提示 “用戶名或密碼錯誤”

分析：前四次輸錯提示 “用戶名或密碼錯誤”，第5次輸錯提示 “xxx賬戶將被鎖定”，那么需要在密碼校驗(yàn)失敗時(shí)，獲取到這是第幾次輸錯

二、實(shí)現(xiàn)方案

2.1 登錄失敗記錄輸錯次數(shù)

@Component
public class LoginFailedListener implements ApplicationListener<AbstractAuthenticationFailureEvent> {

    @Autowired
    private CustomProperties customProperties ;

    @Autowired
    private UserDao userDao;

    @Override
    public void onApplicationEvent(AbstractAuthenticationFailureEvent abstractAuthenticationFailureEvent) {
        String loginName = abstractAuthenticationFailureEvent.getAuthentication()
            .getName();
        if (log.isInfoEnabled()) {
            log.info("登錄失敗 loginName=[{}]", loginName);
        }
        if (StringUtils.isBlank(loginName)) {
            return;
        }
        //查詢登錄賬號是否存在
        UserDo condition = new UserDo();
        condition.setLoginName(loginName);
        List<UserDo> userDos = userDao.selectByRecord(condition);
        if (CollectionUtils.isEmpty(userDos)) {
            return;
        }
        UserDo userDo = userDos.get(0);
        UserDo updateDo = new UserDo();
        updateDo.setUserId(userDo.getUserId());
        Integer loginFailMaxCount = customroperties.getLoginFailMaxCount();
        if (loginFailMaxCount <= userDo.getTryTime() + 1) {
            //更新用戶狀態(tài)為凍結(jié)
            updateDo.setStatus(EnumUserStatus.FORBIDDEN.getCode());
            updateDo.setTryTime(loginFailMaxCount);
            if (log.isInfoEnabled()) {
                log.info("登錄次數(shù)已達(dá)最大次數(shù):{} 凍結(jié)賬戶 loginName=[{}]", loginFailMaxCount, loginName);
            }
        } else {
            //更新嘗試次數(shù)
            updateDo.setTryTime(userDo.getTryTime() + 1);
            if (log.isInfoEnabled()) {
                log.info("嘗試次數(shù)+1 loginName=[{}], tryTime=[{}]", loginName, updateDo.getTryTime());
            }
        }
        updateDo.setUpdateTime(new Date());
        userDao.updateBySelective(updateDo);
    }
}

2.2 重寫校驗(yàn)方法，滿足條件時(shí)拋出自定義異常

校驗(yàn)拋出的異常一定要是AuthenticationException及其子類
因?yàn)閯?chuàng)建了監(jiān)聽器ApplicationListener的實(shí)現(xiàn)，源碼中回調(diào)是有條件的，所以最后最好是原樣拋出 BadCredentialsException ，否則ApplicationListener將不會被觸發(fā)

@Slf4j
public class CustomDaoAuthenticationProvider extends DaoAuthenticationProvider {

    @Autowired
    private CustomProperties customProperties ;

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        try {
            super.additionalAuthenticationChecks(userDetails, authentication);
        } catch (AuthenticationException e) {
            if(e instanceof BadCredentialsException && userDetails instanceof UserDto){
                UserDto userDto = (UserDto) userDetails;
                //先到這里，然后去觸發(fā)LoginFailedListener,達(dá)到賬戶被鎖定這里需要+1
                //已經(jīng)被凍結(jié)的不處理，只處理正常用戶，并且是達(dá)到最大失敗次數(shù)的那一次
                if(EnumUserStatus.NORMAL.getCode().equals(userDto.getStatus()) && Objects.equals(userDto.getTryTime() + 1, customProperties .getLoginFailMaxCount())){
                    if(log.isErrorEnabled()){
                        log.error("用戶:{} 登錄失敗次數(shù)已達(dá)最大,賬戶將被鎖定", userDto.getLoginName());
                    }
                    throw new BadCredentialsException(e.getMessage(), new LoginFailCountOutException("登錄失敗次數(shù)已達(dá)最大"));
                }else {
                    throw e;
                }

            }else {
                throw e;
            }

        }
    }


}

public class LoginFailCountOutException extends AuthenticationException {
    private static final long serialVersionUID = -8546980609242201580L;

    /**
     * Constructs an {@code AuthenticationException} with the specified message and no
     * root cause.
     *
     * @param msg the detail message
     */
    public LoginFailCountOutException(String msg) {
        super(msg);
    }

    public LoginFailCountOutException(String msg, Throwable ex) {
        super(msg, ex);
    }
}

2.3 裝配自定義的AuthenticationProvider

@Bean
    public AuthenticationProvider authenticationProvider(UserDetailsService userDetailsService, PasswordEncoder passwordEncoder, UserAuthoritiesMapper userAuthoritiesMapper) {
        DaoAuthenticationProvider authenticationProvider = new CustomDaoAuthenticationProvider();
        // 對默認(rèn)的UserDetailsService進(jìn)行覆蓋
        authenticationProvider.setUserDetailsService(userDetailsService);
        authenticationProvider.setPasswordEncoder(passwordEncoder);
        authenticationProvider.setAuthoritiesMapper(userAuthoritiesMapper);
        return authenticationProvider;
    }

WebSecurityConfigurerAdapter 的配置類中注入

@Autowired
    private AuthenticationProvider authenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider);
    }

2.4 AuthenticationFailureHandler 根據(jù)異常返回提示

failureHandler((request, response, ex) -> {
                response.setContentType("application/json;charset=utf-8");
                PrintWriter out = response.getWriter();
                String errorMessage = this.loginFailureErrorMessage(ex);
                out.write(JSON.toJSONString(Response.<Void>builder().isSuccess(false)
                    .errorMessage(errorMessage)
                    .build()));
                out.flush();
                out.close();
            })

private String loginFailureErrorMessage(AuthenticationException ex) {
        if (ex instanceof UsernameNotFoundException || ex instanceof BadCredentialsException) {
            if(ex.getCause() != null && ex.getCause() instanceof LoginFailCountOutException){
                return "登錄失敗次數(shù)已達(dá)最大限制, 賬戶凍結(jié)";
            }
            return "用戶名或密碼錯誤";
        }
        if (ex instanceof DisabledException) {
            return "賬戶被禁用";
        }
        if (ex instanceof LockedException) {
            return "賬戶被鎖定";
        }
        if (ex instanceof AccountExpiredException) {
            return "賬戶已過期";
        }
        if (ex instanceof CredentialsExpiredException) {
            return "密碼已過期";
        }
        log.warn("不明原因登錄失敗", ex);
        return "登錄失敗";
    }

到此這篇關(guān)于SpringSecurity根據(jù)自定義異常返回登錄錯誤提示信息(賬戶鎖定)的文章就介紹到這了,更多相關(guān)SpringSecurity自定義異常返回登錄錯誤提示內(nèi)容請搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家！

您可能感興趣的文章: