• 超级简单学会：盐加密&Shiro认证

    目录

    一、盐加密

    二、Shiro认证

    一、盐加密

            ①数据库密码发展史

    第一个阶段：明文密码        123456  （安全性较低）

    第二个阶段：md5加密        e10adc3949ba59abbe56e057f20f883e （安全性较高）

    第三个阶段：md5加盐加密        （安全性更高）

    第四个阶段：md5加盐加密加次数        （安全性最高）

            ②初步实现盐加密：

     我们使用盐加密，一般是在新增用户数据或会自动修改用户数据时将密码自动加密：

    1. package com.zq.ssm.util;
    2.  
    3. import org.apache.shiro.crypto.RandomNumberGenerator;
    4. import org.apache.shiro.crypto.SecureRandomNumberGenerator;
    5. import org.apache.shiro.crypto.hash.SimpleHash;
    6.  
    7. public class PasswordHelper {
    8.  
    9.     /**
    10.      * 随机数生成器
    11.      */
    12.     private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
    13.  
    14.     /**
    15.      * 指定hash算法为MD5
    16.      */
    17.     private static final String hashAlgorithmName = "md5";
    18.  
    19.     /**
    20.      * 指定散列次数为1024次，即加密1024次
    21.      */
    22.     private static final int hashIterations = 1024;
    23.  
    24.     /**
    25.      * true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储
    26.      */
    27.     private static final boolean storedCredentialsHexEncoded = true;
    28.  
    29.     /**
    30.      * 获得加密用的盐
    31.      *
    32.      * @return
    33.      */
    34.     public static String createSalt() {
    35.         return randomNumberGenerator.nextBytes().toHex();
    36.     }
    37.  
    38.     /**
    39.      * 获得加密后的凭证
    40.      *
    41.      * @param credentials 凭证(即密码)
    42.      * @param salt        盐
    43.      * @return
    44.      */
    45.     public static String createCredentials(String credentials, String salt) {
    46.         SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, credentials,
    47.                 salt, hashIterations);
    48.         return storedCredentialsHexEncoded ? simpleHash.toHex() : simpleHash.toBase64();
    49.     }
    50.  
    51.  
    52.     /**
    53.      * 进行密码验证
    54.      *
    55.      * @param credentials        未加密的密码
    56.      * @param salt               盐
    57.      * @param encryptCredentials 加密后的密码
    58.      * @return
    59.      */
    60.     public static boolean checkCredentials(String credentials, String salt, String encryptCredentials) {
    61.         return encryptCredentials.equals(createCredentials(credentials, salt));
    62.     }
    63.  
    64.  
    65.     public static void main(String[] args) {
    66.         //盐
    67.         String salt = createSalt();
    68.         System.out.println(salt);
    69.         System.out.println(salt.length());
    70.         //凭证+盐加密后得到的密码
    71.         String credentials = createCredentials("123", salt);
    72.         System.out.println(credentials);
    73.         System.out.println(credentials.length());
    74.         boolean b = checkCredentials("123", salt, credentials);
    75.         System.out.println(b);
    76.     }
    77. }

    二、Shiro认证

            ①导入POM依赖

    1. <dependency>
    2.     <groupId>org.apache.shirogroupId>
    3.     <artifactId>shiro-coreartifactId>
    4.     <version>1.3.2version>
    5. dependency>
    6.  
    7. <dependency>
    8.     <groupId>org.apache.shirogroupId>
    9.     <artifactId>shiro-webartifactId>
    10.     <version>1.3.2version>
    11. dependency>
    12.  
    13. <dependency>
    14.     <groupId>org.apache.shirogroupId>
    15.     <artifactId>shiro-springartifactId>
    16.     <version>1.3.2version>
    17. dependency>

            ②web.xml配置

    3.   shiroFilter
    4.   org.springframework.web.filter.DelegatingFilterProxy
    5.   
    6.     
    7.     targetFilterLifecycle
    8.     true
    9.   
    12.   shiroFilter
    13.   /*

            ③修改配置 

     完成准备工作后逆向生成完我们的数据       

    UserMapper.xml中新增一个方法：

    1.  
    2. <select id="queryByName" resultType="com.zq.ssm.model.ShiroUser" parameterType="java.lang.String">
    3.   select
    4.   <include refid="Base_Column_List" />
    5.   from t_shiro_user
    6.   where userName = #{userName}
    7. select>

    UserMapper.java:

    1. package com.zq.ssm.mapper;
    2.  
    3. import com.ruojuan.ssm.model.User;
    4. import org.apache.ibatis.annotations.Param;
    5. import org.springframework.stereotype.Repository;
    6.  
    7. @Repository
    8. public interface UserMapper {
    9.     int deleteByPrimaryKey(Integer userid);
    10.  
    11.     int insert(User record);
    12.  
    13.     int insertSelective(User record);
    14.  
    15.     User queryByName(@Param("userName") String userName);
    16.  
    17.     User selectByPrimaryKey(Integer userid);
    18.  
    19.     int updateByPrimaryKeySelective(User record);
    20.  
    21.     int updateByPrimaryKey(User record);
    22. }

    UserBizImpl.java:

    1. package com.zq.ssm.impl;
    2.  
    3. import com.zq.ssm.biz.UserBiz;
    4. import com.zq.ssm.mapper.UserMapper;
    5. import com.zq.ssm.model.User;
    6. import org.springframework.beans.factory.annotation.Autowired;
    7. import org.springframework.stereotype.Service;
    8.  
    9.  
    10. @Service("userBiz")
    11. public class UserBizImpl implements UserBiz {
    12.  
    13.     @Autowired
    14.     private UserMapper userMapper;
    15.  
    16.  
    17.  
    18.     @Override
    19.     public int deleteByPrimaryKey(Integer userid) {
    20.         return userMapper.deleteByPrimaryKey(userid);
    21.     }
    22.  
    23.     @Override
    24.     public int insert(User record) {
    25.         return userMapper.insert(record);
    26.     }
    27.  
    28.     @Override
    29.     public int insertSelective(User record) {
    30.         return userMapper.insertSelective(record);
    31.     }
    32.  
    33.     @Override
    34.     public User queryByName(String userName) {
    35.         return userMapper.queryByName(userName);
    36.     }
    37.  
    38.     @Override
    39.     public User selectByPrimaryKey(Integer userid) {
    40.         return userMapper.selectByPrimaryKey(userid);
    41.     }
    42.  
    43.     @Override
    44.     public int updateByPrimaryKeySelective(User record) {
    45.         return userMapper.updateByPrimaryKeySelective(record);
    46.     }
    47.  
    48.     @Override
    49.     public int updateByPrimaryKey(User record) {
    50.         return userMapper.updateByPrimaryKey(record);
    51.     }
    52. }

            ④自定义Realm

    Myrealm.java：

    1. package com.zq.ssm.shiro;
    2.  
    3. import com.zq.ssm.biz.UserBiz;
    4. import com.zq.ssm.model.User;
    5. import org.apache.shiro.authc.AuthenticationException;
    6. import org.apache.shiro.authc.AuthenticationInfo;
    7. import org.apache.shiro.authc.AuthenticationToken;
    8. import org.apache.shiro.authc.SimpleAuthenticationInfo;
    9. import org.apache.shiro.authz.AuthorizationInfo;
    10. import org.apache.shiro.realm.AuthorizingRealm;
    11. import org.apache.shiro.subject.PrincipalCollection;
    12. import org.apache.shiro.util.ByteSource;
    13.  
    14.  
    15. public class MyRealm extends AuthorizingRealm{
    16.  
    17.     private UserBiz userBiz;
    18.  
    19.     public UserBiz getUserBiz() {
    20.         return userBiz;
    21.     }
    22.  
    23.     public void setUserBiz(UserBiz userBiz) {
    24.         this.userBiz = userBiz;
    25.     }
    26.  
    27.     @Override
    28.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    29.         return null;
    30.     }
    31.  
    32.     @Override
    33.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    34.         System.out.println("身份认证...");
    35.         String username = token.getPrincipal().toString();
    36.         //String password = token.getCredentials().toString();
    37.         User user = userBiz.queryByName(username);
    38. //        拿到数据库中的用户信息，放入token凭证中，用于controler进行对比
    39.         AuthenticationInfo info = new SimpleAuthenticationInfo(
    40.                 user.getUsername(),
    41.                 user.getPassword(),
    42.                 ByteSource.Util.bytes(user.getSalt()),
    43.                 this.getName()
    44.         );
    45.         return info;
    46.     }
    47. }

    applicationContext-shiro.xml

    1. "1.0" encoding="UTF-8"?>
    2. <beans xmlns="http://www.springframework.org/schema/beans"
    3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    4.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    5.  
    6.     
    7.     <bean id="shiroRealm" class="com.javaxl.ssm.shiro.MyRealm">
    8.         <property name="shiroUserService" ref="shiroUserService" />
    9.         
    10.         
    11.         
    12.         
    13.         <property name="credentialsMatcher">
    14.             <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    15.                 
    16.                 <property name="hashAlgorithmName" value="md5"/>
    17.                 
    18.                 <property name="hashIterations" value="1024"/>
    19.                 
    20.                 <property name="storedCredentialsHexEncoded" value="true"/>
    21.             bean>
    22.         property>
    23.     bean>
    24.  
    25.     
    26.     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    27.         <property name="realm" ref="shiroRealm" />
    28.     bean>
    29.  
    30.     
    31.     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    32.         
    33.         <property name="securityManager" ref="securityManager" />
    34.         
    35.         <property name="loginUrl" value="/login"/>
    36.         
    37.         
    38.         
    39.         <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    40.         
    41.         <property name="filterChainDefinitions">
    42.             <value>
    43.                 
    44.                 
    45.                 
    46.                 
    47.                 /user/login=anon
    48.                 /user/updatePwd.jsp=authc
    49.                 /admin/*.jsp=roles[admin]
    50.                 /user/teacher.jsp=perms["user:update"]
    51.                
    52.             value>
    53.         property>
    54.     bean>
    55.  
    56.     
    57.     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    58. beans>

    controller：

    1. package com.zq.ssm.web;
    2.  
    3. import org.apache.shiro.SecurityUtils;
    4. import org.apache.shiro.authc.UsernamePasswordToken;
    5. import org.apache.shiro.subject.Subject;
    6. import org.springframework.stereotype.Controller;
    7. import org.springframework.web.bind.annotation.RequestMapping;
    8.  
    9. import javax.servlet.ServletException;
    10. import javax.servlet.http.HttpServletRequest;
    11. import javax.servlet.http.HttpServletResponse;
    12. import java.io.IOException;
    13.  
    14.  
    15. @Controller
    16. public class UserController {
    17.  
    18.  
    19.     @RequestMapping("/login")
    20.     public String login(HttpServletRequest req, HttpServletResponse resp){
    21.         String username = req.getParameter("username");
    22.         String password = req.getParameter("password");
    23.         UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
    24.         Subject subject = SecurityUtils.getSubject();
    25.         try {
    26.             subject.login(usernamePasswordToken);
    27.             req.getRequestDispatcher("main.jsp").forward(req, resp);
    28.         } catch (Exception e) {
    29.             req.setAttribute("message", "您的用户名密码输入有误！！！");
    30.             try {
    31.                 req.getRequestDispatcher("login.jsp").forward(req, resp);
    32.             } catch (ServletException e1) {
    33.                 e1.printStackTrace();
    34.             } catch (IOException e1) {
    35.                 e1.printStackTrace();
    36.             }
    37.         }
    38.         return null;
    39.     }
    40.  
    41.     @RequestMapping("/logout")
    42.     public String logout(HttpServletRequest req, HttpServletResponse resp){
    43.         Subject subject = SecurityUtils.getSubject();
    44.         subject.logout();
    45.         return "login";
    46.     }
    47.  
    48.  
    49. }

  • 相关阅读:
    Spring总结
    解密Kerberos流量
    Linux下Apache与Nginx服务器配置与优化
    基础会计学知识点汇总
    牛血清白蛋白标记微囊藻毒素(MCLR)(BSA-MCLR)
    架构师之路：中台和微服务区别
    SpringMVC常用注解的详细解析
    Apache Storm 2.5.0 单机安装与配置
    AI与制药相结合，能否弯道超车
    【无标题】
  • 原文地址：https://blog.csdn.net/weixin_66110079/article/details/126541073