java - 未登录的注销日期和时间

Question

实际上我有一个严重的问题:我看到有人从日本访问了我的网站，而我没有向未经授权的用户提供任何登录 ID 和密码。我只向经过身份验证的用户分配了用户 ID 和密码，并且我正在跟踪经过身份验证的用户登录时的登录、注销时间以及登录和注销 IP 地址详细信息。但我发现在我的数据库中没有登录时间、登录用户 ID、登录 IP地址，但有注销时间，注销 IP 地址存在于我的数据库中，其中 userid 为空。这怎么可能？？？一个来自日本的人于 16:20:18 从我的网站注销，因为他还没有登录怎么办？没有登录就退出？

需要专家帮助

我的web应用程序是jsp、servlet、java类和oracle 10g:我已经提供了以下保护:

 1. CSRF Protection 
 2. SQL Injection protection 
 3. XSS Protection 
 4. No Broken Authentication and session 

很快我就会添加 SSL。

身份验证 servlet:

HttpSession session1 = request.getSession(false);
     PrintWriter out = response.getWriter();
      try{
   if(request.getMethod().equalsIgnoreCase("POST")){
String user="";
String timenow="";
String strQuery="";
String today="";
String tour="";
try{
String useridfinal = (String)request.getParameter("userid");
    String userpassfinal = (String)request.getParameter("userpassword");
         Pattern p10 = Pattern.compile("[A-Z0-9a-z]+");// XSS checking
Matcher m10 = p10.matcher(useridfinal);
boolean b10 = m10.matches();
Pattern p11 = Pattern.compile("[A-Z!_,.a-z0-9]+");// XSS checking
Matcher m11 = p11.matcher(userpassfinal);
boolean b11 = m11.matches();
if(useridfinal == null || b10==false){
session1.setAttribute("errorlogin", "Invalid Login ID or userpassword");
response.sendRedirect("login.jsp");
        }
else if(userpassfinal == null || b11==false){
session1.setAttribute("errorlogin", "Invalid Login ID or userpassword");
response.sendRedirect("login.jsp");
}
else{
try {
  dbconnection db= new dbconnection();
 db.getConnection();
PreparedStatement ps=null;
     PreparedStatement ps2=null;
 ResultSet  rs=null;
ResultSet  rs1=null;
String ipadd="";
     try {
ipadd= request.getRemoteAddr();//tracking IP address
}
catch(Exception e) {
}
               SimpleDateFormat sdfDate = new SimpleDateFormat("dd-MM-yy HH:mm:ss");         
Date now = new Date();
String strDate = sdfDate.format(now);
    if(request.getParameter("userid")!=null &&
        (request.getParameter("userid") == null ? "" != null : !request.getParameter("userid").equals("")) && request.getParameter("userpassword")!=null &&
        (request.getParameter("userpassword") == null ? "" != null : !request.getParameter("userpassword").equals("")))
    {
 if ( session1 != null) {
               session1.invalidate(); }
 session1 = request.getSession(true);
    String s=(String)useridfinal;
       MessageDigest m=MessageDigest.getInstance("MD5");
       m.update(s.getBytes(),0,s.length());
       String encuseridfinal=(new BigInteger(1,m.digest()).toString(16));
      String s1=(String)userpassfinal;
       MessageDigest m1=MessageDigest.getInstance("MD5");
       m1.update(s1.getBytes(),0,s1.length());
       String encuserpassfinal=(new BigInteger(1,m1.digest()).toString(16));
ps= db.con.prepareStatement("select * from login where loginid=? and  loginpass=? ");
ps.setString(1, useridfinal);
ps.setString(2, encuserpassfinal);// encrypted userpassword
     try {
      rs=ps.executeQuery();
       } catch (SQLException ex) { 
        }
      int count=0;
      while(rs.next())
      {
 count++;
try {
  //Initialize SecureRandom
  //This is a lengthy operation, to be done only upon
  //initialization of the application
  SecureRandom prng = SecureRandom.getInstance("SHA1PRNG");
  //generate a random number
  String randomNum = new Integer( prng.nextInt() ).toString();
  //get its digest
  MessageDigest sha = MessageDigest.getInstance("SHA-1");
  byte[] result =  sha.digest( randomNum.getBytes() );
String csrf="";

csrf=hexEncode(result);
                try{
Calendar calendar = new GregorianCalendar();
int hour = calendar.get(Calendar.HOUR_OF_DAY);
int minute = calendar.get(Calendar.MINUTE);
int second = calendar.get(Calendar.SECOND);
today=(+hour+":"+minute+":"+second +"");
Date date = new Date();
SimpleDateFormat sdf = null;
String strDate1 = "";
sdf = new SimpleDateFormat("dd-MM-yy");
strDate1 = sdf.format(date);
tour=strDate1+" "+today;
               try{
           ps2 = db.con.prepareStatement("insert into logindetails (login_id, login_dt, login_ipaddress) values (?, to_date(?, 'DD-MM-YY hh24:mi:ss'),?) ");
               }
               catch(Exception e){
               }
ps2.setString(1, useridfinal);
try{
ps2.setString(2, tour);
}
catch(Exception e){}
try{
ps2.setString(3, ipadd);
}
catch(Exception e){}
try {
 rs1=ps2.executeQuery();
}
catch(SQLException ex){
}
 rs1.close();
 ps2.close();
  } 
               catch(Exception e){
               }
         session1.setAttribute("useridfinal", useridfinal);
      session1.setAttribute("csrftoken", csrf); //csrf token generation      
    response.sendRedirect("home.jsp");
  session1.setAttribute("authenticated", true);  
}
catch(Exception e){}
 }
 try{
       rs.close();
       }
       catch(Exception e){}
       try{
       ps.close();
       }
       catch(Exception e){}
     try{
    db.removeConnection();
     }
 catch(Exception e){}
      if(count==0)
      {
 session1.setAttribute("errorlogin", "Invalid Login ID or userpassword");
 response.sendRedirect("login.jsp");
      }
    }
    else {   
 session1.setAttribute("errorlogin", "Invalid Login ID or userpassword");
 response.sendRedirect("login.jsp");
}
  } catch (Exception e) {
  }
 }
} catch (Exception e) {
      out.println("please try later");
  }
   }
else{
response.sendRedirect("login.jsp");
}
    } catch (Exception e) {
   response.sendRedirect("login.jsp");
   }
processRequest(request, response);
}
function() {// For generating secure token
return token;
}

退出代码

<html>
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>JSP Page</title>
    <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
<META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<META NAME="ROBOTS" CONTENT="NONE"> 
<META NAME="GOOGLEBOT" CONTENT="NOARCHIVE">
</head>
<body>
     <%
String user="";
HttpSession session1 = request.getSession(false);
if(session1.getAttribute("useridfinal")!=null &&
session1.getAttribute("useridfinal")!="")
{
user = session1.getAttribute("useridfinal").toString();
}
    String today="";
String tour="";
dbconnection db= new dbconnection();
db.getConnection();
PreparedStatement ps=null;
     PreparedStatement ps2=null;
ResultSet  rs=null;
ResultSet  rs1=null;
try{
Calendar calendar = new GregorianCalendar();
int hour = calendar.get(Calendar.HOUR_OF_DAY);
int minute = calendar.get(Calendar.MINUTE);
int second = calendar.get(Calendar.SECOND);
today=(+hour+":"+minute+":"+second +"");
Date date = new Date();
SimpleDateFormat sdf = null;
String strDate1 = "";
sdf = new SimpleDateFormat("dd-MM-yy");
strDate1 = sdf.format(date);
String useripadd="";
try {
useripadd= request.getRemoteAddr();
}
catch(Exception e) {
}
 tour=strDate1+" "+today;
               try{
           ps2 = db.con.prepareStatement("insert into logindetails 
(loginid,logoutdt,logoutipaddress) values (?,to_date(?, 'DD-MM-YY hh24:mi:ss'),?)");
               }
               catch(Exception e){
               }
ps2.setString(1, user);
try{
ps2.setString(2, tour);
}
catch(Exception e){          }
ps2.setString(3, useripadd);
try {
 rs1=ps2.executeQuery();
}
catch(SQLException ex){
out.println(ex);
}
 rs1.close();
 ps2.close();
db.removeConnection();
 }
               catch(Exception e){
               }
       String csrf="";
request.getSession(false).removeAttribute("useridfinal");
request.getSession(false).removeAttribute("csrftoken");
response.setHeader("Pragma","no-cache"); 
response.setHeader("Cache-Control","no-store"); 
response.setHeader("Expires","0"); 
response.setDateHeader("Expires",-1); 
session1.invalidate();
response.sendRedirect("login.jsp");
%>
</body>

从 IP 地址我知道该位置是日本。我不知道这是怎么发生的。有什么帮助吗？？？？？？？？？

Answer 1

假设您的应用程序托管在 http://your.host.com/app 上，并假设您的注销 JSP 名为 logout.jsp。如果我只使用浏览器并输入 http://your.host.com/app/logout.jsp在地址栏中输入并按 Enter 键，您将注销而无需登录数据库。无需破解任何东西。

另一种可能性是，由于您基本上忽略了发生的任何异常，因此登录成功，但插入数据库失败。这确实发生了，因为要在数据库中插入登录名，您使用 executeQuery 而不是使用 executeUpdate。

你的代码真的非常非常糟糕。您应该学习缩进代码，正确使用 JDBC，正确处理异常，使用事务而不是自动提交，并在finally block 中关闭结果集、语句和连接。 JSP 中的 Java 代码确实是不好的做法。

阅读教程，切勿执行catch(Exception) {}。