redis 實(shí)現(xiàn)登陸次數(shù)限制

loonggg 發(fā)布于2019-08-19 10:21 / 2844人閱讀

摘要：利用實(shí)現(xiàn)登陸次數(shù)限制注解核心代碼很簡(jiǎn)單基本思路比如希望達(dá)到的要求是這樣在內(nèi)登陸異常次數(shù)達(dá)到次鎖定該用戶(hù)那么登陸請(qǐng)求的參數(shù)中會(huì)有一個(gè)參數(shù)唯一標(biāo)識(shí)一個(gè)比如郵箱手機(jī)號(hào)用這個(gè)參數(shù)作為存入對(duì)應(yīng)的為登陸錯(cuò)誤的次數(shù)類(lèi)型并設(shè)置過(guò)期時(shí)間為當(dāng)獲取到

title: redis-login-limitation

利用 redis 實(shí)現(xiàn)登陸次數(shù)限制, 注解 + aop, 核心代碼很簡(jiǎn)單.

基本思路

比如希望達(dá)到的要求是這樣: 在 1min 內(nèi)登陸異常次數(shù)達(dá)到5次, 鎖定該用戶(hù) 1h

那么登陸請(qǐng)求的參數(shù)中, 會(huì)有一個(gè)參數(shù)唯一標(biāo)識(shí)一個(gè) user, 比如郵箱/手機(jī)號(hào)/userName

用這個(gè)參數(shù)作為key存入redis, 對(duì)應(yīng)的value為登陸錯(cuò)誤的次數(shù), string 類(lèi)型, 并設(shè)置過(guò)期時(shí)間為 1min. 當(dāng)獲取到的 value == "4" , 說(shuō)明當(dāng)前請(qǐng)求為第 5 次登陸異常, 鎖定.

所謂的鎖定, 就是將對(duì)應(yīng)的value設(shè)置為某個(gè)標(biāo)識(shí)符, 比如"lock", 并設(shè)置過(guò)期時(shí)間為 1h

核心代碼

定義一個(gè)注解, 用來(lái)標(biāo)識(shí)需要登陸次數(shù)校驗(yàn)的方法

package io.github.xiaoyureed.redispractice.anno;

import java.lang.annotation.*;

@Documented
@Target({ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface RedisLimit {
    /**
     * 標(biāo)識(shí)參數(shù)名, 必須是請(qǐng)求參數(shù)中的一個(gè)
     */
    String identifier();

    /**
     * 在多長(zhǎng)時(shí)間內(nèi)監(jiān)控, 如希望在 60s 內(nèi)嘗試
     * 次數(shù)限制為5次, 那么 watch=60; unit: s
     */
    long watch();

    /**
     * 鎖定時(shí)長(zhǎng), unit: s
     */
    long lock();

    /**
     * 錯(cuò)誤的嘗試次數(shù)
     */
    int times();
}

編寫(xiě)切面, 在目標(biāo)方法前后進(jìn)行校驗(yàn), 處理...

package io.github.xiaoyureed.redispractice.aop;

@Component
@Aspect
// Ensure that current advice is outer compared with ControllerAOP
// so we can handling login limitation Exception in this aop advice.
//@Order(9)
@Slf4j
public class RedisLimitAOP {

    @Autowired
    private StringRedisTemplate stringRedisTemplate;

    @Around("@annotation(io.github.xiaoyureed.redispractice.anno.RedisLimit)")
    public Object handleLimit(ProceedingJoinPoint joinPoint) {
        MethodSignature  methodSignature = (MethodSignature) joinPoint.getSignature();
        final Method     method          = methodSignature.getMethod();
        final RedisLimit redisLimitAnno  = method.getAnnotation(RedisLimit.class);// 貌似可以直接在方法參數(shù)中注入 todo

        final String identifier = redisLimitAnno.identifier();
        final long   watch      = redisLimitAnno.watch();
        final int    times      = redisLimitAnno.times();
        final long   lock       = redisLimitAnno.lock();
        // final ServletRequestAttributes att             = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();
        // final HttpServletRequest       request         = att.getRequest();
        // final String                   identifierValue = request.getParameter(identifier);

        String identifierValue = null;
        try {
            final Object arg           = joinPoint.getArgs()[0];
            final Field  declaredField = arg.getClass().getDeclaredField(identifier);
            declaredField.setAccessible(true);
            identifierValue = (String) declaredField.get(arg);
        } catch (NoSuchFieldException e) {
            log.error(">>> invalid identifier [{}], cannot find this field in request params", identifier);
        } catch (IllegalAccessException e) {
            e.printStackTrace();
        }
        if (StringUtils.isBlank(identifierValue)) {
            log.error(">>> the value of RedisLimit.identifier cannot be blank, invalid identifier: {}", identifier);
        }

        // check User locked
        final ValueOperations ssOps = stringRedisTemplate.opsForValue();
        final String                          flag  = ssOps.get(identifierValue);
        if (flag != null && "lock".contentEquals(flag)) {
            final BaseResp result = new BaseResp();
            result.setErrMsg("user locked");
            result.setCode("1");
            return new ResponseEntity<>(result, HttpStatus.OK);
        }

        ResponseEntity result;
        try {
            result = (ResponseEntity) joinPoint.proceed();
        } catch (Throwable e) {
            result = handleLoginException(e, identifierValue, watch, times, lock);
        }
        return result;
    }

    private ResponseEntity handleLoginException(Throwable e, String identifierValue, long watch, int times, long lock) {
        final BaseResp result = new BaseResp();
        result.setCode("1");
        if (e instanceof LoginException) {
            log.info(">>> handle login exception...");
            final ValueOperations ssOps = stringRedisTemplate.opsForValue();
            Boolean                               exist = stringRedisTemplate.hasKey(identifierValue);
            // key doesn"t exist, so it is the first login failure
            if (exist == null || !exist) {
                ssOps.set(identifierValue, "1", watch, TimeUnit.SECONDS);
                result.setErrMsg(e.getMessage());
                return new ResponseEntity<>(result, HttpStatus.OK);
            }

            String count = ssOps.get(identifierValue);
            // has been reached the limitation
            if (Integer.parseInt(count) + 1 == times) {
                log.info(">>> [{}] has been reached the limitation and will be locked for {}s", identifierValue, lock);
                ssOps.set(identifierValue, "lock", lock, TimeUnit.SECONDS);
                result.setErrMsg("user locked");
                return new ResponseEntity<>(result, HttpStatus.OK);
            }
            ssOps.increment(identifierValue);
            result.setErrMsg(e.getMessage() + "; you have try " + ssOps.get(identifierValue) + "times.");
        }
        log.error(">>> RedisLimitAOP cannot handle {}", e.getClass().getName());
        return new ResponseEntity<>(result, HttpStatus.OK);
    }
}

這樣使用:

package io.github.xiaoyureed.redispractice.web;

@RestController
public class SessionResources {

    @Autowired
    private SessionService sessionService;

    /**
     * 1 min 之內(nèi)嘗試超過(guò)5次, 鎖定 user 1h
     */
    @RedisLimit(identifier = "name", watch = 30, times = 5, lock = 10)
    @RequestMapping(value = "/session", method = RequestMethod.POST)
    public ResponseEntity login(@Validated @RequestBody LoginReq req) {
        return new ResponseEntity<>(sessionService.login(req), HttpStatus.OK);
    }
}

references

https://github.com/xiaoyureed...