|
@@ -20,17 +20,14 @@ import static org.springframework.web.context.request.RequestAttributes.SCOPE_SE
|
|
public class SecurityService {
|
|
public class SecurityService {
|
|
|
|
|
|
|
|
|
|
|
|
+ private static final SecureRandom RANDOM = new SecureRandom();
|
|
@Value("${app.token-effective:604800}")
|
|
@Value("${app.token-effective:604800}")
|
|
private long defaultAppTokenEffective;
|
|
private long defaultAppTokenEffective;
|
|
@Value("${app.code-effective:600}")
|
|
@Value("${app.code-effective:600}")
|
|
private long defaultSecurityCodeEffective;
|
|
private long defaultSecurityCodeEffective;
|
|
-
|
|
|
|
@Value("${app.debug:false}")
|
|
@Value("${app.debug:false}")
|
|
private boolean debug;
|
|
private boolean debug;
|
|
|
|
|
|
-
|
|
|
|
- private static final SecureRandom RANDOM = new SecureRandom();
|
|
|
|
-
|
|
|
|
private static String createCode(int size, String source) {
|
|
private static String createCode(int size, String source) {
|
|
StringBuilder verifyCode = new StringBuilder(size);
|
|
StringBuilder verifyCode = new StringBuilder(size);
|
|
int codesLen = source.length();
|
|
int codesLen = source.length();
|
|
@@ -55,7 +52,7 @@ public class SecurityService {
|
|
List<Map<String, Object>> applicationList = DataBase.query(Config.getSecurityConnectionStr(), query, appid.get(), appSecret.get());
|
|
List<Map<String, Object>> applicationList = DataBase.query(Config.getSecurityConnectionStr(), query, appid.get(), appSecret.get());
|
|
|
|
|
|
if (applicationList.isEmpty()) {
|
|
if (applicationList.isEmpty()) {
|
|
- return UniReturnUtil.fail("appid 或 appsecret 错误");
|
|
|
|
|
|
+ throw new RuntimeException("appid 或 appsecret 错误");
|
|
}
|
|
}
|
|
Map<String, Object> application = applicationList.get(0);
|
|
Map<String, Object> application = applicationList.get(0);
|
|
|
|
|
|
@@ -66,64 +63,35 @@ public class SecurityService {
|
|
apptokeneffective = Long.parseLong(apptokeneffectiveObj.toString());
|
|
apptokeneffective = Long.parseLong(apptokeneffectiveObj.toString());
|
|
}
|
|
}
|
|
LocalDateTime expiresTime = LocalDateTime.now().plusSeconds(apptokeneffective);
|
|
LocalDateTime expiresTime = LocalDateTime.now().plusSeconds(apptokeneffective);
|
|
- Map<String, Object> data = new HashMap<>();
|
|
|
|
String ip = RequestUtil.getIpAddr();
|
|
String ip = RequestUtil.getIpAddr();
|
|
- List<Map<String, Object>> logs = DataBase.query(Config.getSecurityConnectionStr(), "select * from appconnectlog where requestip=? and appid = ?", ip, appid.get());
|
|
|
|
|
|
+ List<Map<String, Object>> logs = DataBase.query(Config.getSecurityConnectionStr(), "select connid, apptoken, expiretime, lasttime from appconnectlog where requestip=? and appid = ?", ip, appid.get());
|
|
String appToken;
|
|
String appToken;
|
|
if (!logs.isEmpty()) {
|
|
if (!logs.isEmpty()) {
|
|
|
|
+ Map<String, Object> applicationlog = logs.get(0);
|
|
DataBase.update(Config.getSecurityConnectionStr(), """
|
|
DataBase.update(Config.getSecurityConnectionStr(), """
|
|
update appconnectlog
|
|
update appconnectlog
|
|
set expiretime = ?,lasttime=?
|
|
set expiretime = ?,lasttime=?
|
|
- where connid=?""", expiresTime, LocalDateTime.now(), logs.get(0).get("connid"));
|
|
|
|
- Map<String, Object> map = logs.get(0);
|
|
|
|
- RequestContextHolder.currentRequestAttributes().setAttribute("application", application, SCOPE_SESSION);
|
|
|
|
- appToken = map.get("apptoken").toString();
|
|
|
|
|
|
+ where connid=?""", expiresTime, LocalDateTime.now(), applicationlog.get("connid"));
|
|
|
|
+ appToken = applicationlog.get("apptoken").toString();
|
|
} else {
|
|
} else {
|
|
String sessionId = RequestUtil.getSessionId();
|
|
String sessionId = RequestUtil.getSessionId();
|
|
appToken = DataEncryptionUtil.signatureMD5("%s:%s".formatted(LocalDateTime.now(), sessionId));
|
|
appToken = DataEncryptionUtil.signatureMD5("%s:%s".formatted(LocalDateTime.now(), sessionId));
|
|
- RequestContextHolder.currentRequestAttributes().setAttribute("appid", appid, SCOPE_SESSION);
|
|
|
|
|
|
|
|
DataBase.update(Config.getSecurityConnectionStr(), """
|
|
DataBase.update(Config.getSecurityConnectionStr(), """
|
|
insert into appconnectlog (appid, requesttime, requestip, apptoken, expiretime, lasttime)
|
|
insert into appconnectlog (appid, requesttime, requestip, apptoken, expiretime, lasttime)
|
|
values (?,?,?,?,?,?)""", appid.get(), LocalDateTime.now(), ip, appToken, expiresTime, LocalDateTime.now());
|
|
values (?,?,?,?,?,?)""", appid.get(), LocalDateTime.now(), ip, appToken, expiresTime, LocalDateTime.now());
|
|
-
|
|
|
|
}
|
|
}
|
|
- data.put("token", appToken);
|
|
|
|
- data.put("expirestime", DataFormatUtil.toString(expiresTime));
|
|
|
|
- data.put("appname", application.get("appname"));
|
|
|
|
- data.put("appenname", application.get("appengname"));
|
|
|
|
- data.put("logo", application.get("applog"));
|
|
|
|
- data.put("smalllogo", application.get("smalllogo"));
|
|
|
|
- data.put("background", application.get("backgroundimage"));
|
|
|
|
- data.put("securitycoderule", application.get("securitycoderule"));
|
|
|
|
|
|
+// 添加token和过期时间
|
|
|
|
+ application.put("token", appToken);
|
|
|
|
+ application.put("expirestime", DataFormatUtil.toString(expiresTime));
|
|
RequestContextHolder.currentRequestAttributes().setAttribute("application", application, SCOPE_SESSION);
|
|
RequestContextHolder.currentRequestAttributes().setAttribute("application", application, SCOPE_SESSION);
|
|
- return UniReturnUtil.success(data);
|
|
|
|
|
|
+// 清理敏感信息 appsecret
|
|
|
|
+ application.put("appsecret", null);
|
|
|
|
+ return UniReturnUtil.success(application);
|
|
}
|
|
}
|
|
return UniReturnUtil.fail("appid 或 appsecret 不能为空");
|
|
return UniReturnUtil.fail("appid 或 appsecret 不能为空");
|
|
}
|
|
}
|
|
|
|
|
|
- //校验连接令牌
|
|
|
|
-
|
|
|
|
- public Map<String, Object> verifyToken(String appToken) throws Exception {
|
|
|
|
- String clean = "delete from appconnectlog where expiretime < ?";
|
|
|
|
-
|
|
|
|
- DataBase.update(Config.getSecurityConnectionStr(), clean, LocalDateTime.now());
|
|
|
|
-
|
|
|
|
-
|
|
|
|
- String requestIp = RequestUtil.getIpAddr();
|
|
|
|
- String query = "select * from appconnectlog where apptoken=? and requestip =?";
|
|
|
|
- List<Map<String, Object>> appConnectLogList = DataBase.query(Config.getSecurityConnectionStr(), query,
|
|
|
|
- appToken, requestIp);
|
|
|
|
- Map<String, Object> data = new HashMap<>();
|
|
|
|
- if (!appConnectLogList.isEmpty()) {
|
|
|
|
- Map<String, Object> appConnectLog = appConnectLogList.get(0);
|
|
|
|
- data.put("validstatus", true);
|
|
|
|
- data.put("appid", appConnectLog.get("appid"));
|
|
|
|
- return UniReturnUtil.success(data);
|
|
|
|
- }
|
|
|
|
- data.put("validstatus", false);
|
|
|
|
- return UniReturnUtil.success(data);
|
|
|
|
- }
|
|
|
|
|
|
|
|
//刷新连接令牌
|
|
//刷新连接令牌
|
|
|
|
|
|
@@ -145,10 +113,15 @@ public class SecurityService {
|
|
Map<String, Object> data = new HashMap<>();
|
|
Map<String, Object> data = new HashMap<>();
|
|
try {
|
|
try {
|
|
String update = "update appconnectlog set expiretime=? where apptoken =? and requestip =? and appid=?";
|
|
String update = "update appconnectlog set expiretime=? where apptoken =? and requestip =? and appid=?";
|
|
- DataBase.update(Config.getSecurityConnectionStr(), update, expiresTime, appToken, RequestUtil.getIpAddr(), appid);
|
|
|
|
- data.put("expirestime", DataFormatUtil.toString(expiresTime));
|
|
|
|
- data.put("token", appToken);
|
|
|
|
- return UniReturnUtil.success(data);
|
|
|
|
|
|
+ boolean updateRow = DataBase.update(Config.getSecurityConnectionStr(), update, expiresTime, appToken, RequestUtil.getIpAddr(), appid);
|
|
|
|
+
|
|
|
|
+ if (updateRow) {
|
|
|
|
+ data.put("expirestime", DataFormatUtil.toString(expiresTime));
|
|
|
|
+ data.put("token", appToken);
|
|
|
|
+ return UniReturnUtil.success(data);
|
|
|
|
+ } else {
|
|
|
|
+ return UniReturnUtil.fail("刷新令牌失败");
|
|
|
|
+ }
|
|
} catch (Exception exception) {
|
|
} catch (Exception exception) {
|
|
return UniReturnUtil.fail("刷新令牌失败:%s".formatted(exception.getMessage()));
|
|
return UniReturnUtil.fail("刷新令牌失败:%s".formatted(exception.getMessage()));
|
|
}
|
|
}
|
|
@@ -156,7 +129,7 @@ public class SecurityService {
|
|
|
|
|
|
//获取登录验证码
|
|
//获取登录验证码
|
|
|
|
|
|
- public Map<String, Object> verifyCode() throws Exception {
|
|
|
|
|
|
+ public Map<String, Object> getSecurityCode() throws Exception {
|
|
|
|
|
|
String appId = RequestUtil.getAppId();
|
|
String appId = RequestUtil.getAppId();
|
|
Map<String, Object> application = RequestUtil.getApplication();
|
|
Map<String, Object> application = RequestUtil.getApplication();
|
|
@@ -235,7 +208,7 @@ public class SecurityService {
|
|
|
|
|
|
if (Objects.nonNull(securityCodeRule) && !debug) {
|
|
if (Objects.nonNull(securityCodeRule) && !debug) {
|
|
code = DataEncryptionUtil.decryptRSAByPrivateKey(verifycode.get());
|
|
code = DataEncryptionUtil.decryptRSAByPrivateKey(verifycode.get());
|
|
- if (Objects.nonNull(securityCodeRule) && !check(code, sessionId, appId, ip)) {
|
|
|
|
|
|
+ if (!check(code, sessionId, appId, ip)) {
|
|
return UniReturnUtil.fail("验证码错误");
|
|
return UniReturnUtil.fail("验证码错误");
|
|
}
|
|
}
|
|
}
|
|
}
|
|
@@ -264,12 +237,12 @@ public class SecurityService {
|
|
Optional<Map<String, Object>> log = userLoginLogList.stream().filter(it -> it.get("sessionid").equals(sessionId)).findAny();
|
|
Optional<Map<String, Object>> log = userLoginLogList.stream().filter(it -> it.get("sessionid").equals(sessionId)).findAny();
|
|
if (log.isEmpty()) {
|
|
if (log.isEmpty()) {
|
|
DataBase.update(Config.getSecurityConnectionStr(), insert, userId, ip, sessionId, LocalDateTime.now(), null, LocalDateTime.now(), LocalDateTime.now(), appToken, appId);
|
|
DataBase.update(Config.getSecurityConnectionStr(), insert, userId, ip, sessionId, LocalDateTime.now(), null, LocalDateTime.now(), LocalDateTime.now(), appToken, appId);
|
|
- } else {
|
|
|
|
- Map<String, Object> map = log.get();
|
|
|
|
- if (Objects.isNull(map.get("apptoken"))) {
|
|
|
|
-
|
|
|
|
- DataBase.update(Config.getSecurityConnectionStr(), "update userloginlog set apptoken = ? where loginid = ?", appToken, map.get("loginid"));
|
|
|
|
- }
|
|
|
|
|
|
+// } else {
|
|
|
|
+// Map<String, Object> map = log.get();
|
|
|
|
+// if (Objects.isNull(map.get("apptoken"))) {
|
|
|
|
+//
|
|
|
|
+// DataBase.update(Config.getSecurityConnectionStr(), "update userloginlog set apptoken = ? where loginid = ?", appToken, map.get("loginid"));
|
|
|
|
+// }
|
|
}
|
|
}
|
|
data.put("userstatus", "0");
|
|
data.put("userstatus", "0");
|
|
|
|
|
|
@@ -283,9 +256,7 @@ public class SecurityService {
|
|
}
|
|
}
|
|
}
|
|
}
|
|
data.put("userid", userId);
|
|
data.put("userid", userId);
|
|
- if (Objects.nonNull(securityCodeRule)) {
|
|
|
|
- remove(code, sessionId, appId, ip);
|
|
|
|
- }
|
|
|
|
|
|
+
|
|
return UniReturnUtil.success(data);
|
|
return UniReturnUtil.success(data);
|
|
}
|
|
}
|
|
|
|
|
|
@@ -451,24 +422,34 @@ public class SecurityService {
|
|
|
|
|
|
public void addCode(String code, String sessionId, String appid, Long securitycodeeffective, String requestIp) throws Exception {
|
|
public void addCode(String code, String sessionId, String appid, Long securitycodeeffective, String requestIp) throws Exception {
|
|
// 使用数据库
|
|
// 使用数据库
|
|
|
|
+// 先清理数据库中的重复请求 和过期数据
|
|
|
|
+ String deleteSql = "delete from tempsecuritycode where expiretime < ? or appid = ? and requestip = ? and sessionid =? ";
|
|
|
|
+ DataBase.update(Config.getSecurityConnectionStr(), deleteSql,
|
|
|
|
+ LocalDateTime.now(), appid, requestIp, sessionId
|
|
|
|
+ );
|
|
|
|
+// 新增数据
|
|
LocalDateTime localDateTime = LocalDateTime.now().plusSeconds(securitycodeeffective);
|
|
LocalDateTime localDateTime = LocalDateTime.now().plusSeconds(securitycodeeffective);
|
|
String insertSql = "insert into tempsecuritycode(appid,requestip,sessionid,securitycode,expiretime) values (?,?,?,?,?)";
|
|
String insertSql = "insert into tempsecuritycode(appid,requestip,sessionid,securitycode,expiretime) values (?,?,?,?,?)";
|
|
DataBase.update(Config.getSecurityConnectionStr(), insertSql,
|
|
DataBase.update(Config.getSecurityConnectionStr(), insertSql,
|
|
appid, requestIp, sessionId, code, localDateTime
|
|
appid, requestIp, sessionId, code, localDateTime
|
|
);
|
|
);
|
|
- String deleteSql = "delete from tempsecuritycode where expiretime < ?";
|
|
|
|
- DataBase.update(Config.getSecurityConnectionStr(), deleteSql,
|
|
|
|
- LocalDateTime.now()
|
|
|
|
- );
|
|
|
|
|
|
+
|
|
}
|
|
}
|
|
|
|
|
|
public boolean check(String code, String sessionId, String appid, String requestIp) throws Exception {
|
|
public boolean check(String code, String sessionId, String appid, String requestIp) throws Exception {
|
|
|
|
|
|
- String selectSql = "select * from tempsecuritycode where securitycode=? and sessionid=? and appid=? and requestip=?";
|
|
|
|
- List<Map<String, Object>> map = DataBase.query(Config.getSecurityConnectionStr(), selectSql,
|
|
|
|
|
|
+
|
|
|
|
+// String selectSql = "select count(1) as result from tempsecuritycode where securitycode=? and sessionid=? and appid=? and requestip=?";
|
|
|
|
+ String deleteSql = """
|
|
|
|
+ delete
|
|
|
|
+ from tempsecuritycode
|
|
|
|
+ where securitycode = ?
|
|
|
|
+ and sessionid = ?
|
|
|
|
+ and appid = ?
|
|
|
|
+ and requestip = ?""";
|
|
|
|
+ return DataBase.update(Config.getSecurityConnectionStr(), deleteSql,
|
|
code, sessionId, appid, requestIp
|
|
code, sessionId, appid, requestIp
|
|
);
|
|
);
|
|
- return !map.isEmpty();
|
|
|
|
|
|
|
|
}
|
|
}
|
|
|
|
|