java - 当登录尝试超过 3 次时，用户无法使用 Spring Security Rest API 登录？

Question

我在java中使用带有安全性的spring boot。我有一个覆盖此方法UserDetails lodUserByUsername(String email)。

我希望当用户输入错误的电子邮件和密码时提供响应“无效的用户名和密码”

如果他们的电子邮件存在并且他们将输入错误的密码，则该尝试的特定用户将增加 1 并存储到列尝试的数据库表中。

如果该用户的超出限制超过 3 个，超出我想要的响应“您的用户名已被阻止”

如果该用户前两次或一次尝试输入错误的密码，则唯一的尝试次数会增加并显示响应“您的尝试是”+MIN_ATTEMPTS。

如果用户输入了前两次或一次尝试输入错误的密码，那么在他们可以输入正确的用户名和密码后，该特定用户的尝试次数将设置为 0。

 private static final int MAX_ATTEMPTS = 3;
    int MIN_ATTEMPTS = 0;

 @SneakyThrows
    @Override
    public UserDetails loadUserByUsername(String email) {
        Members members = membersDao.findByEmail(email);
        Set<GrantedAuthority> authorities = new HashSet<>();
        if (members == null) {

            throw new Exception("Invalid username and password");
        } else {
            MIN_ATTEMPTS = members.getAttempts();
            MIN_ATTEMPTS++;
            members.setAttempts(MIN_ATTEMPTS);
            membersDao.save(members);

        }
        if (members.getAttempts() <= MAX_ATTEMPTS) {
            APIResponseBuilder.build(true   , commonMessages.loginSuccess);
            return new User(members.getEmail(), members.getPassword(), authorities);
        } else {
            throw new Exception("You have exceed max +" + MAX_ATTEMPTS + "+limit of login");
        }
    }

Answer 1

我已将上述代码添加到我的身份验证 Controller 中，问题已解决

1. Controller

private static final int MAX_ATTEMPTS = 3;

@PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginMembers loginMembers) throws AuthenticationException, IOException, ServletException {
        Members members = membersDao.findByEmail(loginMembers.getEmail());
        PasswordEncoder passencoder = new BCryptPasswordEncoder();

        if (members == null) {
            //Create Error Message for User
            throw new RuntimeException("Invalid Username and Password");
        }
        if (members.getAttempts() >= MAX_ATTEMPTS) {
            //Create Error Message for User
            throw new RuntimeException("Login Attempt exceeds "+MAX_ATTEMPTS);
        }

        if (passencoder.matches(loginMembers.getPassword(), members.getPassword())) {
            final Authentication authentication = authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(
                            loginMembers.getEmail(),
                            loginMembers.getPassword()
                    )
            );

            SecurityContextHolder.getContext().setAuthentication(authentication);
            final String token = jwtTokenUtil.generateToken(authentication);
            logger.info("You are log in successfully with token");
            return ResponseEntity.ok(new AuthTokenRequest(token));
        } else {
            int attempts = members.getAttempts();
            members.setAttempts(++attempts);
            membersDao.save(members);
            //Create Error Message for User
            throw new RuntimeException("Login attempts "+attempts);
        }
    }

方法

@Override
    public UserDetails loadUserByUsername(String email) {
        Members members = membersDao.findByEmail(email);
        Set<GrantedAuthority> authorities = new HashSet<>();
        try {
            Role role = members.getRoles();
            authorities.add(new SimpleGrantedAuthority(role.getRole()));
        } catch (Exception e) {
            APIResponseBuilder.build(false, e.getMessage(), commonMessages.exception);
        }
        return new User(members.getEmail(), members.getPassword(), authorities);
    }