title: redis-login-limitation
利用 redis 实现登陆次数限制, 注解 + aop, 核心代码很简单.
基本思路
比如希望达到的要求是这样: 在 1min 内登陆异常次数达到5次, 锁定该用户 1h
那么登陆请求的参数中, 会有一个参数唯一标识一个 user, 比如 邮箱/手机号/userName
用这个参数作为key存入redis, 对应的value为登陆错误的次数, string 类型, 并设置过期时间为 1min. 当获取到的 value == "4" , 说明当前请求为第 5 次登陆异常, 锁定.
所谓的锁定, 就是将对应的value设置为某个标识符, 比如"lock", 并设置过期时间为 1h
核心代码
定义一个注解, 用来标识需要登陆次数校验的方法
package io.github.xiaoyureed.redispractice.anno; import java.lang.annotation.*; @Documented @Target({ElementType.METHOD}) @Retention(RetentionPolicy.RUNTIME) public @interface RedisLimit { /** * 标识参数名, 必须是请求参数中的一个 */ String identifier(); /** * 在多长时间内监控, 如希望在 60s 内尝试 * 次数限制为5次, 那么 watch=60; unit: s */ long watch(); /** * 锁定时长, unit: s */ long lock(); /** * 错误的尝试次数 */ int times(); }
编写切面, 在目标方法前后进行校验, 处理...
package io.github.xiaoyureed.redispractice.aop; @Component @Aspect // Ensure that current advice is outer compared with ControllerAOP // so we can handling login limitation Exception in this aop advice. //@Order(9) @Slf4j public class RedisLimitAOP { @Autowired private StringRedisTemplate stringRedisTemplate; @Around("@annotation(io.github.xiaoyureed.redispractice.anno.RedisLimit)") public Object handleLimit(ProceedingJoinPoint joinPoint) { MethodSignature methodSignature = (MethodSignature) joinPoint.getSignature(); final Method method = methodSignature.getMethod(); final RedisLimit redisLimitAnno = method.getAnnotation(RedisLimit.class);// 貌似可以直接在方法参数中注入 todo final String identifier = redisLimitAnno.identifier(); final long watch = redisLimitAnno.watch(); final int times = redisLimitAnno.times(); final long lock = redisLimitAnno.lock(); // final ServletRequestAttributes att = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes(); // final HttpServletRequest request = att.getRequest(); // final String identifierValue = request.getParameter(identifier); String identifierValue = null; try { final Object arg = joinPoint.getArgs()[0]; final Field declaredField = arg.getClass().getDeclaredField(identifier); declaredField.setAccessible(true); identifierValue = (String) declaredField.get(arg); } catch (NoSuchFieldException e) { log.error("> invalid identifier [{}], cannot find this field in request params", identifier); } catch (IllegalAccessException e) { e.printStackTrace(); } if (StringUtils.isBlank(identifierValue)) { log.error("> the value of RedisLimit.identifier cannot be blank, invalid identifier: {}", identifier); } // check User locked final ValueOperations<String, String> ssOps = stringRedisTemplate.opsForValue(); final String flag = ssOps.get(identifierValue); if (flag != null && "lock".contentEquals(flag)) { final BaseResp result = new BaseResp(); result.setErrMsg("user locked"); result.setCode("1"); return new ResponseEntity<>(result, HttpStatus.OK); } ResponseEntity result; try { result = (ResponseEntity) joinPoint.proceed(); } catch (Throwable e) { result = handleLoginException(e, identifierValue, watch, times, lock); } return result; } private ResponseEntity handleLoginException(Throwable e, String identifierValue, long watch, int times, long lock) { final BaseResp result = new BaseResp(); result.setCode("1"); if (e instanceof LoginException) { log.info("> handle login exception..."); final ValueOperations<String, String> ssOps = stringRedisTemplate.opsForValue(); Boolean exist = stringRedisTemplate.hasKey(identifierValue); // key doesn't exist, so it is the first login failure if (exist == null || !exist) { ssOps.set(identifierValue, "1", watch, TimeUnit.SECONDS); result.setErrMsg(e.getMessage()); return new ResponseEntity<>(result, HttpStatus.OK); } String count = ssOps.get(identifierValue); // has been reached the limitation if (Integer.parseInt(count) + 1 == times) { log.info("> [{}] has been reached the limitation and will be locked for {}s", identifierValue, lock); ssOps.set(identifierValue, "lock", lock, TimeUnit.SECONDS); result.setErrMsg("user locked"); return new ResponseEntity<>(result, HttpStatus.OK); } ssOps.increment(identifierValue); result.setErrMsg(e.getMessage() + "; you have try " + ssOps.get(identifierValue) + "times."); } log.error("> RedisLimitAOP cannot handle {}", e.getClass().getName()); return new ResponseEntity<>(result, HttpStatus.OK); } }
这样使用:
package io.github.xiaoyureed.redispractice.web; @RestController public class SessionResources { @Autowired private SessionService sessionService; /** * 1 min 之内尝试超过5次, 锁定 user 1h */ @RedisLimit(identifier = "name", watch = 30, times = 5, lock = 10) @RequestMapping(value = "/session", method = RequestMethod.POST) public ResponseEntity<LoginResp> login(@Validated @RequestBody LoginReq req) { return new ResponseEntity<>(sessionService.login(req), HttpStatus.OK); } }
references
https://github.com/xiaoyureed/redis-login-limitation
总结
以上所述是小编给大家介绍的redis 实现登陆次数限制的思路详解,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对网站的支持!
如果你觉得本文对你有帮助,欢迎转载,烦请注明出处,谢谢!
免责声明:本站文章均来自网站采集或用户投稿,网站不提供任何软件下载或自行开发的软件!
如有用户或公司发现本站内容信息存在侵权行为,请邮件告知! 858582#qq.com
白云城资源网 Copyright www.dyhadc.com
暂无“redis 实现登陆次数限制的思路详解”评论...
更新日志
2024年05月10日
2024年05月10日
- 钱昭颖.2022-KNOWING【环星】【WAV分轨】
- 煲机极品《炸10Hz》[WAV分轨][550M]
- 《蔡琴127首单曲合集》单曲100M极品音质[WAV分轨][15G]
- 任贤齐《爱像太平洋/跨海三部曲》 2CD [WAV][561M]
- 欢乐钓鱼大师如何获得双倍经验 欢乐钓鱼大师获得双倍经验方法
- 物华弥新迷踪盘第二十关怎么过 迷踪盘第二十关通关方法
- 物华弥新迷踪盘第二十一关怎么过 迷踪盘第二十一关通关方法
- KOKIA-TokyoMermaid(2018mora)[96-24]flac
- VariousArtists《世界著名古典大师名版收藏15CD》古典音乐[FLAC+CUE]
- 群星《一人一首成名曲(滚石24K金碟珍藏版)》WAV
- 无处不在的DOOM!新Mod允许在《P5》中玩毁灭战士
- 岛哥哥人气爆棚!亮相漫展COS区引大量粉丝火速围观
- 虚幻5.4引擎技术演示超逼真!4080无法达到4K/60帧
- 陈冠希.2002-TRANSITION(国)【英皇娱乐】【WAV+CUE】
- 吴奇隆.2016-旅程【太阳动力】【WAV+CUE】