连续登陆错误上锁

src/main/java/cn/quantgroup/xyqb/Constants.java

@@ -149,7 +149,18 @@ public interface Constants {
      * redis中token的key值前缀
      */
     String SESSION_PREFIX = "spring:session:sessions:";
-
+    /**
+     * 账号密码锁定阈值
+     */
+    Long PASSWORD_ERROR_LOCK_COUNT = 5L;
+    /**
+     * 账号密码错误锁定时间 30分钟
+     */
+    Long PASSWORD_ERROR_LOCK_TIME = 30L;
+    /**
+     * 密码错误次数过多锁定key前缀
+     */
+    String PASSWORD_LOCK_PRE = "password_error_lock:";
     /**
      * 默认随机密码长度
      */

src/main/java/cn/quantgroup/xyqb/aspect/captcha/CaptchaFiniteValidateAdvisor.java

@@ -30,6 +30,7 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.concurrent.TimeUnit;
 
 /**
  * 限次图形验证码校验标记
@@ -89,6 +90,18 @@ public class CaptchaFiniteValidateAdvisor {
             return JsonResult.buildErrorStateResult("用户名或密码不正确", null);
         }
         if (countErrorByPhone > Constants.Image_Need_Count) {
+
+            if (countErrorByPhone > Constants.PASSWORD_ERROR_LOCK_COUNT) {
+
+                String lock_key = Constants.PASSWORD_LOCK_PRE.concat(phoneNo);
+
+                Long expire = redisTemplate.opsForValue().getOperations().getExpire(lock_key);
+
+                if (expire != null && expire > 0L) {
+                    return JsonResult.buildErrorStateResult("密码错误已超过次数，请"+expire+"分钟后再试", null);
+                }
+            }
+
             String registerFrom = Optional.ofNullable(request.getParameter("registerFrom")).orElse("");
             String captchaId = Optional.ofNullable(request.getParameter(Constants.QG_CAPTCHA_ID)).orElse("");
             String captchaValue = request.getParameter(Constants.QG_CAPTCHA_VALUE);

src/main/java/cn/quantgroup/xyqb/controller/external/UserController.java

@@ -506,8 +506,12 @@ public class UserController implements IBaseController {
             lockIpv4Service.countErrorByPhoneNo(phoneNo);
             return null;
         }
+
         // 向该ipv4添加成功计数器
         lockIpv4Service.countSuccessByIpv4(clientIp);
+        //尝试解锁
+        lockIpv4Service.unLockPhone(phoneNo);
+
         return user;
     }
 

src/main/java/cn/quantgroup/xyqb/service/user/ILockIpv4Service.java

@@ -45,4 +45,12 @@ public interface ILockIpv4Service {
      */
     void lockSuccessIpv4(String ip, long count);
 
+    /**
+     * 锁定手机号
+     */
+    void lockPhone(String phone , long count);
+    /**
+     * 解锁手机号
+     */
+    void unLockPhone(String phone);
 }

src/main/java/cn/quantgroup/xyqb/service/user/impl/LockIpv4ServiceImpl.java

@@ -42,6 +42,9 @@ public class LockIpv4ServiceImpl implements ILockIpv4Service {
         }
         // 密码错误计数
         Long errorCount = stringRedisTemplate.opsForValue().increment(key, 1L);
+        //判断上锁
+        lockPhone(phoneNo, errorCount);
+
         if (errorCount > Constants.Image_Need_Count) {
             log.info("用户名或密码不正确，phoneNo={}", phoneNo);
             throw new PasswordErrorLimitException("用户名或密码不正确");
@@ -124,6 +127,32 @@ public class LockIpv4ServiceImpl implements ILockIpv4Service {
         log.info("Lock_ipv4: locked success ip access:{}, success overstep {} times in {} minutes, do lock {} minutes", ip, Constants.IPV4_LOCK_ON_SUCCESS_COUNTS, Constants.IPV4_SUCCESS_COUNT_MINUTES, Constants.IPV4_SUCCESS_LOCK_MINUTES);
     }
 
+    /**
+     * 锁定手机号
+     *
+     * @param phone
+     * @param count
+     */
+    @Override
+    public void lockPhone(String phone, long count) {
+
+        if (count >= Constants.PASSWORD_ERROR_LOCK_COUNT) {
+
+            String lock_key = Constants.PASSWORD_LOCK_PRE.concat(phone);
+            //Constants.PASSWORD_LOCK_PRE
+            boolean isLock = stringRedisTemplate.hasKey(lock_key);
+
+            if (!isLock) {
+                stringRedisTemplate.opsForValue().set(lock_key, "lock", Constants.PASSWORD_ERROR_LOCK_TIME, TimeUnit.MINUTES);
+            }
+        }
+    }
+
+    @Override
+    public void unLockPhone(String phone) {
+        stringRedisTemplate.delete(Constants.PASSWORD_LOCK_PRE.concat(phone));
+    }
+
     private static String getErrorIpKey(String ipv4) {
         return Constants.REDIS_PASSWORD_ERROR_COUNT_FOR_IPV4 + ipv4;
     }