Spring 后端安全双剑之JWT 无状态认证 + 密码加盐加密实战指南

public class SecurityUtil {
    //加密
    //返回盐值＋md5(盐值+明文)
    public static String encrypt(String password) {
        String salt = UUID.randomUUID().toString().replace("-", "");
        String securityPassword = DigestUtils.md5DigestAsHex((salt + password).getBytes(StandardCharsets.UTF_8));
        return salt + securityPassword;
    }
    //解密
    public static boolean verify(String inputPassword, String sqlPassword){
        if(!StringUtils.hasLength(inputPassword)){
            return false;
        }
        if(sqlPassword==null||sqlPassword.length()!=64){
            return false;
        }
        String salt = sqlPassword.substring(0,32);
        String securityPassword = DigestUtils.md5DigestAsHex((salt + inputPassword).getBytes(StandardCharsets.UTF_8));
        return sqlPassword.equals(salt + securityPassword);
    }
}

   public static void main(String[] args) {
        String encrypt = encrypt("123456");
        boolean verify = verify("123456", encrypt);
        System.out.println(verify);
    }

@Data
public class UserLoginRequest {
    @NotNull(message = "用户名不能为空")
    private String userName;
    @NotNull(message = "密码不能为空")
    private String password;
}

@Data
@AllArgsConstructor
public class UserLoginResponse {
    private Integer userId;
    private String token;
}

@RequestMapping("/login")
    public UserLoginResponse login(@RequestBody @Validated UserLoginRequest userLoginRequest){
        log.info("用户登录,用户名:{}",userLoginRequest.getUserName());
         return userService.checkPassword(userLoginRequest);
    }

@Service
public class UserServiceImpl implements UserService {
    @Autowired
    private UserInfoMapper userInfoMapper;
    @Resource(name = "blogServiceImpl")
    private BlogService blogService;
    @Override
    public UserLoginResponse checkPassword(UserLoginRequest userLoginRequest) {
        QueryWrapper<UserInfo> queryWrapper = new QueryWrapper<>();
        queryWrapper.lambda().eq(UserInfo::getUserName,userLoginRequest.getUserName())
                .eq(UserInfo::getDeleteFlag,0);
        UserInfo userInfo = userInfoMapper.selectOne(queryWrapper);
        if(userInfo==null){
            //用户不存在
            throw  new BlogException("用户不存在");
        }
        //判断密码是否一致
if(!SecurityUtil.verify(userLoginRequest.getPassword(),userInfo.getPassword())){
            throw new BlogException("用户密码错误");
        }
        //密码正确
        Map<String,Object> map=new HashMap<>();
        map.put("id",userInfo.getId());
        map.put("name",userInfo.getUserName());
        String token = JwtUtils.genToken(map);
        return  new UserLoginResponse(userInfo.getId(),token);
    }