use of com.albedo.java.common.core.annotation.AnonymousAccess in project albedo by somowhere.
the class SecurityUtil method getAnonymousUrl.
public static Map<String, Set<String>> getAnonymousUrl(Map<RequestMappingInfo, HandlerMethod> handlerMethodMap) {
Map<String, Set<String>> anonymousUrls = new HashMap<>(6);
Set<String> get = new HashSet<>();
Set<String> post = new HashSet<>();
Set<String> put = new HashSet<>();
Set<String> patch = new HashSet<>();
Set<String> delete = new HashSet<>();
Set<String> all = new HashSet<>();
for (Map.Entry<RequestMappingInfo, HandlerMethod> infoEntry : handlerMethodMap.entrySet()) {
HandlerMethod handlerMethod = infoEntry.getValue();
AnonymousAccess anonymousAccess = handlerMethod.getMethodAnnotation(AnonymousAccess.class);
if (null != anonymousAccess) {
List<RequestMethod> requestMethods = new ArrayList<>(infoEntry.getKey().getMethodsCondition().getMethods());
RequestMethodEnum request = RequestMethodEnum.find(requestMethods.size() == 0 ? RequestMethodEnum.ALL.getType() : requestMethods.get(0).name());
switch(Objects.requireNonNull(request)) {
case GET:
get.addAll(getPatterns(infoEntry));
break;
case POST:
post.addAll(getPatterns(infoEntry));
break;
case PUT:
put.addAll(getPatterns(infoEntry));
break;
case PATCH:
patch.addAll(getPatterns(infoEntry));
break;
case DELETE:
delete.addAll(getPatterns(infoEntry));
break;
default:
all.addAll(getPatterns(infoEntry));
break;
}
}
}
anonymousUrls.put(RequestMethodEnum.GET.getType(), get);
anonymousUrls.put(RequestMethodEnum.POST.getType(), post);
anonymousUrls.put(RequestMethodEnum.PUT.getType(), put);
anonymousUrls.put(RequestMethodEnum.PATCH.getType(), patch);
anonymousUrls.put(RequestMethodEnum.DELETE.getType(), delete);
anonymousUrls.put(RequestMethodEnum.ALL.getType(), all);
return anonymousUrls;
}
use of com.albedo.java.common.core.annotation.AnonymousAccess in project albedo by somowhere.
the class AccoutJwtResource method logout.
/**
* @return org.springframework.http.ResponseEntity
* @description 登出
* @Param: [authHeader, request, response]
* @author somewhere
* @date 2020/5/30
*/
@AnonymousAccess
@GetMapping(value = "/logout")
@Operation(summary = "登出")
public ResponseEntity<Result> logout(@RequestHeader(value = HttpHeaders.AUTHORIZATION, required = false) String authHeader, HttpServletRequest request, HttpServletResponse response) {
String tokenValue = authHeader.replace("Bearer ", StrUtil.EMPTY).trim();
RedisUtil.delete(tokenValue);
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth != null) {
new SecurityContextLogoutHandler().logout(request, response, auth);
}
WebUtil.removeCookie(response, HttpHeaders.AUTHORIZATION);
request.getSession().invalidate();
return ResponseEntityBuilder.buildOk("退出登录成功");
}
use of com.albedo.java.common.core.annotation.AnonymousAccess in project albedo by somowhere.
the class AccoutJwtResource method authorize.
/**
* 功能描述: 认证授权
*/
@AnonymousAccess
@PostMapping(SecurityConstants.AUTHENTICATE_URL)
@Operation(summary = "认证授权")
public ResponseEntity<Result> authorize(@Valid @RequestBody LoginVo loginVo) {
Date canLoginDate = RedisUtil.getCacheObject(SecurityConstants.DEFAULT_LOGIN_AFTER_24_KEY + loginVo.getUsername());
if (canLoginDate != null) {
return ResponseEntityBuilder.buildFail(HttpStatus.UNAUTHORIZED, "您的账号在" + DateUtil.format(canLoginDate) + "后才可登录");
}
if (!SpringContextHolder.isDevelopment()) {
LoginUtil.checkCode(loginVo);
}
try {
String s = PasswordDecoderFilter.decryptAes(loginVo.getPassword(), applicationProperties.getSecurity().getEncodeKey());
loginVo.setPassword(s.trim());
} catch (Exception e) {
}
UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginVo.getUsername(), loginVo.getPassword());
String keyLoginCount = SecurityConstants.DEFAULT_LOGIN_KEY + loginVo.getUsername();
try {
Authentication authentication = this.authenticationManager.authenticate(authenticationToken);
SecurityContextHolder.getContext().setAuthentication(authentication);
boolean rememberMe = (loginVo.getRememberMe() == null) ? false : loginVo.getRememberMe();
String jwt = tokenProvider.createToken(authentication, rememberMe);
log.info("jwt:{}", jwt);
RedisUtil.delete(keyLoginCount);
return ResponseEntityBuilder.buildOkData(new LinkedHashMap<String, Object>() {
{
put("access_token", jwt);
put("expires_in", tokenProvider.getExpirationDateSecondsFromToken(jwt));
}
});
} catch (AuthenticationException ae) {
log.warn("Authentication exception trace: {}", ae);
String msg = ae.getMessage();
if (ae instanceof BadCredentialsException) {
Integer cacheObject = RedisUtil.getCacheObject(keyLoginCount);
if (cacheObject == null) {
cacheObject = 1;
}
msg = "密码错误,请重试";
boolean level1 = cacheObject >= 5 && cacheObject < 9;
boolean level2 = cacheObject == 9;
boolean level3 = cacheObject > 9;
if (level1) {
msg = "您还剩" + (10 - cacheObject) + "次密码输入机会,建议点击‘忘记密码’";
} else if (level2) {
msg = "您还剩1次密码输入机会,再次错误,您的账号将被暂时锁定24小时,24小时内禁止登录";
} else if (level3) {
msg = "您密码错误次数已超过10次,您的账号将被暂时锁定24小时,建议点击‘忘记密码’,凭手机号码重置密码,24小时后再尝试登录";
cacheObject = 0;
// RedisUtil.setCacheObject(SecurityConstants.DEFAULT_LOGIN_AFTER_24_KEY
// +loginVo.getUsername(),
// DateUtil.addDays(PublicUtil.getCurrentDate(), 1), 1,
// TimeUnit.DAYS);
}
RedisUtil.setCacheObject(keyLoginCount, 1 + cacheObject);
}
return ResponseEntityBuilder.buildFail(HttpStatus.UNAUTHORIZED, msg);
}
}
use of com.albedo.java.common.core.annotation.AnonymousAccess in project albedo by somowhere.
the class AccoutResource method valicode.
@AnonymousAccess
@GetMapping(path = "/code/{randomStr}", produces = MediaType.IMAGE_JPEG_VALUE)
@Operation(summary = "获取验证码")
public void valicode(@PathVariable("randomStr") String randomStr, HttpServletResponse response) throws IOException {
ArgumentAssert.notEmpty(randomStr, "机器码不能为空");
response.setHeader("Cache-Control", "no-store, no-cache");
response.setHeader("Transfer-Encoding", "JPG");
response.setContentType("image/jpeg");
ArithmeticCaptcha captcha = new ArithmeticCaptcha(DEFAULT_IMAGE_WIDTH, DEFAULT_IMAGE_HEIGHT);
String result = captcha.text();
RedisUtil.setCacheString(CommonConstants.DEFAULT_CODE_KEY + randomStr, result, CommonConstants.DEFAULT_IMAGE_EXPIRE, TimeUnit.SECONDS);
// 创建输出流
ServletOutputStream out = response.getOutputStream();
captcha.out(out);
IoUtil.close(out);
}
use of com.albedo.java.common.core.annotation.AnonymousAccess in project albedo by somowhere.
the class AliPayResource method notify.
@RequestMapping("/notify")
@AnonymousAccess
@SuppressWarnings("all")
@Operation(hidden = true, summary = "支付异步通知(要公网访问),接收异步通知,检查通知内容app_id、out_trade_no、total_amount是否与请求中的一致,根据trade_status进行后续业务处理")
public ResponseEntity<Object> notify(HttpServletRequest request) {
AlipayConfigDo alipay = alipayService.find();
Map<String, String[]> parameterMap = request.getParameterMap();
// 内容验签,防止黑客篡改参数
if (alipayUtils.rsaCheck(request, alipay)) {
// 交易状态
String tradeStatus = new String(request.getParameter("trade_status").getBytes(StandardCharsets.ISO_8859_1), StandardCharsets.UTF_8);
// 商户订单号
String outTradeNo = new String(request.getParameter("out_trade_no").getBytes(StandardCharsets.ISO_8859_1), StandardCharsets.UTF_8);
// 支付宝交易号
String tradeNo = new String(request.getParameter("trade_no").getBytes(StandardCharsets.ISO_8859_1), StandardCharsets.UTF_8);
// 付款金额
String totalAmount = new String(request.getParameter("total_amount").getBytes(StandardCharsets.ISO_8859_1), StandardCharsets.UTF_8);
// 验证
if (tradeStatus.equals(AliPayStatusEnum.SUCCESS.getValue()) || tradeStatus.equals(AliPayStatusEnum.FINISHED.getValue())) {
// 验证通过后应该根据业务需要处理订单
}
return new ResponseEntity<>(HttpStatus.OK);
}
return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
}
Aggregations