简介
- 在实现登录功能时,大多数情况需要验证码支持,目的是防止机器人暴力破解密码。
- 目前比较简单的验证码通过一些OCR工具就可以解析出来,复杂的验证码(一般通过扭曲、加线条或噪点等干扰)能够防止OCR识别。更复杂的如填字、算数等验证码则需要人工识别。
- 目前比较可靠的是手机验证码,但是对于用户来说比普通验证码要麻烦得多。
- 验证码图片可以通过Java提供的图片API实现,也可以借助如JCaptcha(Completely Automated Public Turing Test To Tell Computers adn Humans Apart)这种开源Java类库生成,它提供了常见的扭曲、加线条和噪点等干扰的支持。
示例
基于第十六章,是一个权限管理系统,但本例中后台管理不是主要内容,现新增一个jcaptcha包,放置所有和验证码有关的类,用于实现用户登录时获取验证码和提交表单后校验验证码的功能。
依赖:
<!--jcaptcha核心--> <dependency> <groupId>com.octo.captcha</groupId> <artifactId>jcaptcha</artifactId> <version>2.0-alpha-1</version> </dependency> <!--支持与servlet集成--> <dependency> <groupId>com.octo.captcha</groupId> <artifactId>jcaptcha-integration-simple-servlet</artifactId> <version>2.0-alpha-1</version> <exclusions> <exclusion> <artifactId>servlet-api</artifactId> <groupId>javax.servlet</groupId> </exclusion> </exclusions> </dependency>
实际能用的依赖如下:
<!--jcaptcha验证码工具--> <dependency><!--jcaptcha核心--> <groupId>com.octo.captcha</groupId> <artifactId>jcaptcha</artifactId> <version>1.0</version> <exclusions> <!--不排除此包,tomcat启动出错--> <exclusion> <artifactId>servlet-api</artifactId> <groupId>javax.servlet</groupId> </exclusion> </exclusions>
com.octo.captcha
jcaptcha-api
1.0
GMailEngine:验证码图片生成引擎,继承自ListImageCaptchaEngine,只需要简单设置以下图片和字体大小等,即可仿照jcaptcha2.0生成类似GMail验证码的样式。
public class GMailEngine extends ListImageCaptchaEngine {
@Override
protected void buildInitialFactories() {
// 图片和字体大小设置
int minWordLength = 4;
int maxWordLength = 5;
int fontSize = 20;
int imageWidth = 100;
int imageHeight = 36;
WordGenerator dictionnaryWords = new ComposeDictionaryWordGenerator(
new FileDictionary("toddlist"));
// word2image components
TextPaster randomPaster = new DecoratedRandomTextPaster(minWordLength,
maxWordLength, new RandomListColorGenerator(new Color[]{
new Color(23, 170, 27), new Color(220, 34, 11),
new Color(23, 67, 172)}), new TextDecorator[]{});
BackgroundGenerator background = new UniColorBackgroundGenerator(
imageWidth, imageHeight, Color.white);
FontGenerator font = new RandomFontGenerator(fontSize, fontSize,
new Font[]{new Font("nyala", Font.BOLD, fontSize),
new Font("Bell MT", Font.PLAIN, fontSize),
new Font("Credit valley", Font.BOLD, fontSize)});
ImageDeformation postDef = new ImageDeformationByFilters(
new ImageFilter[]{});
ImageDeformation backDef = new ImageDeformationByFilters(
new ImageFilter[]{});
ImageDeformation textDef = new ImageDeformationByFilters(
new ImageFilter[]{});
WordToImage word2image = new DeformedComposedWordToImage(font,
background, randomPaster, backDef, textDef, postDef);
addFactory(new GimpyFactory(dictionnaryWords, word2image));
}
}
- MyManageableImageCaptchaService:使用GMailEngine生成验证码图片、比对验证码(每验证一次无论成功与否都会删除该验证码)。
public class MyManageableImageCaptchaService
extends DefaultManageableImageCaptchaService {
/**
* @Author haien
* @Description 构造器,生成验证码图片
* @Date 16:08 2019/4/19
* @Param [captchaStore, captchaEngine, minGuarantedStorageDelayInSeconds,
maxCaptchaStoreSize, captchaStoreLoadBeforeGarbageCollection]
**/
public MyManageableImageCaptchaService(CaptchaStore captchaStore,
CaptchaEngine captchaEngine,
int minGuarantedStorageDelayInSeconds,
int maxCaptchaStoreSize,
int captchaStoreLoadBeforeGarbageCollection)
{
super(captchaStore,captchaEngine,minGuarantedStorageDelayInSeconds,
maxCaptchaStoreSize, captchaStoreLoadBeforeGarbageCollection);
}
/**
* @Author haien
* @Description 根据会话id获取当前会话的验证码,与用户输入的比对
* @Date 2019/4/11
* @Param [id会话id, userCaptchaResponse用户输入的验证码]
* @return boolean
**/
public boolean validate(String id,String userCaptchaResponse){
//验证但不删除
return store.getCaptcha(id).validateResponse(userCaptchaResponse);
}
}
- JCaptcha:jcaptcha工具类,利用MyManageableImageCaptchaService生成和验证验证码。
public class JCaptcha {
public static final MyManageableImageCaptchaService captchaService=
new MyManageableImageCaptchaService(new FastHashMapCaptchaStore(),
new GMailEngine(),180,
100000,75000);
/**
* @Author haien
* @Description 比对当前请求输入的验证码是否正确,
并从CaptchaService中移除已使用过的验证码
* @Date 2019/4/11
* @Param [request, userCaptchaResponse用户输入的验证码]
* @return boolean
**/
public static boolean validateResponse(HttpServletRequest request,
String userCaptchaResponse){
//为true应该是没有session则新建
if(request.getSession(false)==null) return false;
boolean validated=false;
try {
//获取会话id
String id = request.getSession().getId();
//将用户输入的验证码与库存比对,并移除验证码与id(无论正确与否)
validated = captchaService.validateResponseForID(id, userCaptchaResponse)
.booleanValue();
}catch (CaptchaServiceException e){
e.printStackTrace();
}
return validated;
}
/**
* @Author haien
* @Description 比对,但不移除验证码,适用于Ajax异步验证,
此时不是真的验证,还不能删除验证码
* @Date 2019/4/11
* @Param [request, userCaptchaResponse]
* @return boolean
**/
public static boolean validate(HttpServletRequest request,
String userCaptchaResponse){
if (request.getSession(false)==null) return false;
boolean validated=false;
try {
String id=request.getSession().getId();
validated=captchaService.validate(id,userCaptchaResponse);
}catch (CaptchaServiceException e){
e.printStackTrace();
}
return validated;
}
}
- JCaptchaFilter:拦截前端的验证码请求,调用JCaptcha工具类生成并向前端写验证码图片。
//保证只执行一次,注:继承的是spring的Filter
public class JCaptchaFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,FilterChain chain)
throws ServletException, IOException {
//响应内容不缓存
response.setDateHeader("Expires",0L);
response.setHeader("Cache-Control","no-store,no-cache,must-revalidate");
response.addHeader("Cache-Control","post-check=0,pre-check=0");
response.setHeader("Pragma","no-cache");
response.setContentType("image/jpeg");
String id=request.getRequestedSessionId();
//captchaService使用当前会话的id作为key获取相应的验证码图片
BufferedImage bi=JCaptcha.captchaService.getImageChallengeForID(id);
ServletOutputStream out=response.getOutputStream();
ImageIO.write(bi,"jpg",out);
try {
out.flush();
}finally {
out.close();
}
}
}
login.jsp: 前端登录页面请求验证码。
//若支持验证码 <c:if test="${jcaptchaEbabled}"> 验证码: <input type="text" name="jcaptchaCode"> <img class="jcaptcha-btn jcaptcha-img" src="${pageContext.request.contextPath}/jcaptcha.jpg" title="点击更换验证码"> <a class="jcaptcha-btn" href="javascript:;">换一张</a><br/> </c:if> <script> $(function() { $(".jcaptcha-btn").click(function() { $(".jcaptcha-img").attr("src", '${pageContext.request.contextPath}/jcaptcha.jpg?' //按钮对应url, //触发JCaptchaFilter +new Date().getTime()); }); }); </script>
web.xml:分配验证码请求给JCaptchaFilter拦截。
<!--验证码过滤器需要放到ShiroFilter之后,因为Shiro将包装HttpSession; 否则可能造成两次的session id不同--> <filter> <filter-name>JCaptchaFilter</filter-name> <filter-class>com.haien.chapter22.jcaptcha.JCaptchaFilter</filter-class> <async-supported>true</async-supported> </filter> <filter-mapping> <filter-name>JCaptchaFilter</filter-name> <!--前台登录页面点击“获取验证码”,其url为此,则执行该过滤链, 生成验证码图片并写到客户端--> <url-pattern>/jcaptcha.jpg</url-pattern> </filter-mapping>
JCaptchaValidateFilter:拦截验证码验证请求的拦截器,主要是调用JCaptcha工具类进行验证。
public class JCaptchaValidateFilter extends AccessControlFilter {
//是否开启验证码支持
private boolean jcaptchaEnabled=true;
//前台提交的验证码参数名
private String jcaptchaParam="jcaptchaCode";
//验证失败后存储到的属性名
private String failureKeyAttribute="shiroLoginFailure";
public void setJcaptchaEnabled(boolean jcaptchaEnabled) {
this.jcaptchaEnabled = jcaptchaEnabled;
}
public void setJcaptchaParam(String jcaptchaParam) {
this.jcaptchaParam = jcaptchaParam;
}
public void setFailureKeyAttribute(String failureKeyAttribute) {
this.failureKeyAttribute = failureKeyAttribute;
}
/**
* @Author haien
* @Description 验证验证码
* @Date 2019/4/19
* @Param [request, response, mappedValue]
* @return boolean
**/
@Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response,
Object mappedValue) throws Exception {
//1. 设置验证码是否开启属性,页面据此决定是否显示验证码
request.setAttribute("jcaptchaEnabled",jcaptchaEnabled);
//将HttpServlet的request转为HttpServlet类型
HttpServletRequest httpServletRequest=WebUtils.toHttp(request);
//2. 判断验证码是否禁用|不是由表单提交的
if(jcaptchaEnabled==false ||
! "post".equalsIgnoreCase(httpServletRequest.getMethod())){
//则不用验证,直接结束
return true;
}
//3. 验证 验证码,正确则返回true,否则false
return JCaptcha.validateResponse(httpServletRequest,
httpServletRequest.getParameter(jcaptchaParam));
}
/**
* @Author haien
* @Description 验证失败处理
* @Date 2019/4/19
* @Param [request, response]
* @return boolean
**/
@Override
protected boolean onAccessDenied(ServletRequest request, ServletResponse response)
throws Exception {
//若验证失败,则存储failureKeyAttribute属性;可通过getFailureKeyAttribute()获取
request.setAttribute(failureKeyAttribute,"jCaptcha.error");
return true;
}
}
- MyFormAuthenticationFilter:继承FormAuthenticationFilter,自定义身份验证拦截器,主要是增加验证码错误情况下不验证身份的条件。
public class MyFormAuthenticationFilter extends FormAuthenticationFilter {
@Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response,
Object mappedValue) {
//若为登录请求,无论登录与否,直接进入onAccessDenied
if(isLoginRequest(request,response)) return false;
return super.isAccessAllowed(request, response, mappedValue);
}
@Override
protected boolean onAccessDenied(ServletRequest request, ServletResponse response,
Object mappedValue) throws Exception {
//验证码错误则直接返回,不用身份验证了
if(request.getAttribute(getFailureKeyAttribute()) != null) return true;
return super.onAccessDenied(request,response,mappedValue);
}
}
spring-config-shiro.xml:
<!-- 基于Form表单的身份验证过滤器 --> <bean id="authcFilter" class="com.haien.chapter22.jcaptcha.MyFormAuthenticationFilter"> <property name="usernameParam" value="username"/> <property name="passwordParam" value="password"/> <property name="rememberMeParam" value="rememberMe"/> <property name="failureKeyAttribute" value="shiroLoginFailure"/><!--值同JCaptchaValidateFilter--> </bean> <bean id="JCaptchaValidateFilter" class="com.haien.chapter22.jcaptcha.JCaptchaValidateFilter"> <property name="jcaptchaEnabled" value="true"/> <property name="jcaptchaParam" value="jcaptchaCode"/> <property name="failureKeyAttribute" value="shiroLoginFailure"/> </bean> <bean id="sysUserFilter" class="com.haien.chapter22.web.shiro.filter.SysUserFilter"/> <!-- Shiro的Web过滤器 --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager"/> <property name="loginUrl" value="/login"/> <property name="filters"> <util:map> <entry key="authc" value-ref="authcFilter"/> <entry key="sysUser" value-ref="sysUserFilter"/> <entry key="JCaptchaValidate" value-ref="JCaptchaValidateFilter"/> </util:map> </property> <property name="filterChainDefinitions"> <!--其实第一行可以不配置,因为spring-mvc.xml已经映射了静态资源?--> <value> /static/**=anon /jcaptcha*=anon /login = JCaptchaValidate,authc /logout = logout /authenticated = authc /** = user,sysUser </value> </property> </bean>
测试:访问http://localhost:8080/chapter22,将重定向到登录页面,显示验证码图片,点击可换一张。输入验证码,错误则返回登录页面,并提示验证码错误。
![](http://zhuzhuzai.oss-cn-shenzhen.aliyuncs.com/6a835cfd-530c-36de-8e97-a4c3ba5d3db3.png)
- 代码示例:ideaProjects/shiro-chapter22
- 《跟我学Shiro》第二十二章