java - 使激活链接不可过期

Question

我有一个关于通过电子邮件激活新帐户的问题。

我关注这个 Registration – Activate a New Account by Email

我的问题是关于

It will expire within 24 hours following its creation

@Entity
public class VerificationToken {
    private static final int EXPIRATION = 60 * 24;
[...]

我想知道我们是否可以确保链接没有过期时间，或者它是否处于良好的安全实践中，为什么？

Answer 1

只需进行此修改即可。

删除 2.1 上不再需要的属性和方法:

@Entity
public class VerificationToken {
    //private static final int EXPIRATION = 60 * 24;

    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;

    private String token;

    @OneToOne(targetEntity = User.class, fetch = FetchType.EAGER)
    @JoinColumn(nullable = false, name = "user_id")
    private User user;

    //private Date expiryDate;

    //private Date calculateExpiryDate(int expiryTimeInMinutes) {
        //Calendar cal = Calendar.getInstance();
        //cal.setTime(new Timestamp(cal.getTime().getTime()));
        //cal.add(Calendar.MINUTE, expiryTimeInMinutes);
        //return new Date(cal.getTime().getTime());
    //}

    // standard constructors, getters and setters
}

去掉example 3.1.1上的注释if语句(这样系统就不会验证它是否过期):

@Autowired
private IUserService service;

@RequestMapping(value = "/regitrationConfirm", method = RequestMethod.GET)
public String confirmRegistration
  (WebRequest request, Model model, @RequestParam("token") String token) {

    Locale locale = request.getLocale();

    VerificationToken verificationToken = service.getVerificationToken(token);
    if (verificationToken == null) {
        String message = messages.getMessage("auth.message.invalidToken", null, locale);
        model.addAttribute("message", message);
        return "redirect:/badUser.html?lang=" + locale.getLanguage();
    }

    User user = verificationToken.getUser();
    //Calendar cal = Calendar.getInstance();
   // if ((verificationToken.getExpiryDate().getTime() - cal.getTime().getTime()) <= 0) {
     //   String messageValue = messages.getMessage("auth.message.expired", null, locale)
       // model.addAttribute("message", messageValue);
       // return "redirect:/badUser.html?lang=" + locale.getLanguage();
    //} 

    user.setEnabled(true); 
    service.saveRegisteredUser(user); 
    return "redirect:/login.html?lang=" + request.getLocale().getLanguage(); 
}

尽管它完全可行，但出于安全原因，不建议这样做。作为用户 second说，在 Security StackExchange您将获得有关电子邮件确认背后的安全性的适当回复。