基于SpringBoot + Redis实现密码暴力破解防护

javaCopy code
@RestController
public class LoginController {
    private final RedisTemplate<String, Integer> redisTemplate;
    private final int MAX_LOGIN_ATTEMPTS = 5;
    private final int LOCKOUT_DURATION_SECONDS = 600; // 锁定时间为10分钟
    public LoginController(RedisTemplate<String, Integer> redisTemplate) {
        this.redisTemplate = redisTemplate;
    }
    @PostMapping("/login")
    public ResponseEntity<String> login(@RequestBody LoginRequest request) {
        String username = request.getUsername();
        // 检查账户是否已被锁定
        if (isAccountLocked(username)) {
            return ResponseEntity.status(HttpStatus.LOCKED).body("Account locked. Please try again later.");
        }
        // 检查登录失败次数
        int failedAttempts = getFailedLoginAttempts(username);
        if (failedAttempts >= MAX_LOGIN_ATTEMPTS) {
            // 锁定账户
            lockAccount(username);
            return ResponseEntity.status(HttpStatus.LOCKED).body("Account locked. Please try again later.");
        }
        // 验证密码逻辑
        // ...
        if (passwordIsValid(request.getPassword())) {
            // 登录成功
            resetFailedLoginAttempts(username);
            return ResponseEntity.ok("Login successful.");
        } else {
            // 登录失败
            incrementFailedLoginAttempts(username);
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid username or password.");
        }
    }
    private boolean isAccountLocked(String username) {
        return redisTemplate.hasKey(getAccountLockKey(username));
    }
    private void lockAccount(String username) {
        redisTemplate.opsForValue().set(getAccountLockKey(username), 1, Duration.ofSeconds(LOCKOUT_DURATION_SECONDS));
    }
    private int getFailedLoginAttempts(String username) {
        Integer failedAttempts = redisTemplate.opsForValue().get(getFailedLoginAttemptsKey(username));
        return failedAttempts != null ? failedAttempts : 0;
    }
    private void incrementFailedLoginAttempts(String username) {
        redisTemplate.opsForValue().increment(getFailedLoginAttemptsKey(username), 1);
    }
    private void resetFailedLoginAttempts(String username) {
        redisTemplate.delete(getFailedLoginAttemptsKey(username));
    }
    private String getAccountLockKey(String username) {
        return "account:lock:" + username;
    }
    private String getFailedLoginAttemptsKey(String username) {
        return "account:failedLoginAttempts:" + username;
    }
    private boolean passwordIsValid(String password) {
        // 验证密码的复杂性等
        // ...
        return true;
    }
}