1 Kaptcha 验证码

1.1 引言

为防止验证系统被暴力破解，很多系统都增加了验证码效验，比较常见的就是图片二维码，业内比较安全的是短信验证码，当然还有一些拼图验证码，加入人工智能的二维码等等，这次就是前后端分离的图片二维码登录方案。

基于验证码的轮子还是挺多的，就以 Kaptcha 这个项目为例，通过springboot项目集成Kaptcha来实现验证码生成和登录方案。

1.2 Kaptcha

Kaptcha 是一个基于SimpleCaptcha的验证码开源项目

1.2.1 pom.xml

<!--Kaptcha是一个基于SimpleCaptcha的验证码开源项目-->
<dependency><groupId>com.github.penggle</groupId><artifactId>kaptcha</artifactId><version>2.3.2</version>
</dependency><!-- 其他依赖 -->
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<!-- redis依赖commons-pool 这个依赖一定要添加 -->
<dependency><groupId>org.apache.commons</groupId><artifactId>commons-pool2</artifactId>
</dependency>

1.2.2 配置类

1.2.2.1 Redis配置类RedisConfig

java">@Configuration
public class RedisConfig {@Beanpublic RedisTemplate<String, Object> redisTemplate(LettuceConnectionFactory redisConnectionFactory){RedisTemplate<String, Object> redisTemplate = new RedisTemplate<String, Object>();redisTemplate.setKeySerializer(new StringRedisSerializer());redisTemplate.setValueSerializer(new GenericJackson2JsonRedisSerializer());redisTemplate.setHashKeySerializer(new StringRedisSerializer());redisTemplate.setHashValueSerializer(new GenericJackson2JsonRedisSerializer());redisTemplate.setConnectionFactory(redisConnectionFactory);return redisTemplate;}
}

1.2.2.2 验证码配置类KaptchaConfig

java">@Configuration
public class KaptchaConfig {@Beanpublic DefaultKaptcha producer(){DefaultKaptcha defaultKaptcha = new DefaultKaptcha();Properties properties = new Properties();properties.setProperty("kaptcha.border", "no");properties.setProperty("kaptcha.border.color", "105,179,90");properties.setProperty("kaptcha.textproducer.font.color", "black");properties.setProperty("kaptcha.image.width", "110");properties.setProperty("kaptcha.image.height", "40");properties.setProperty("kaptcha.textproducer.char.string","23456789abcdefghkmnpqrstuvwxyzABCDEFGHKMNPRSTUVWXYZ");properties.setProperty("kaptcha.textproducer.font.size", "30");properties.setProperty("kaptcha.textproducer.char.space","3");properties.setProperty("kaptcha.session.key", "code");properties.setProperty("kaptcha.textproducer.char.length", "4");properties.setProperty("kaptcha.textproducer.font.names", "宋体,楷体,微软雅黑");
//        properties.setProperty("kaptcha.obscurificator.impl","com.xxx");可以重写实现类properties.setProperty("kaptcha.noise.impl","com.google.code.kaptcha.impl.NoNoise");Config config = new Config(properties);defaultKaptcha.setConfig(config);return defaultKaptcha;}

1.2.3 验证码控制层

java">import com.google.code.kaptcha.impl.DefaultKaptcha;
import com.lzp.kaptcha.service.CaptchaService;
import com.lzp.kaptcha.vo.CaptchaVO;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import sun.misc.BASE64Encoder;import javax.imageio.ImageIO;
import java.awt.image.BufferedImage;
import java.io.ByteArrayOutputStream;
import java.io.IOException;@RestController
@RequestMapping("/captcha")
public class CaptchaController {@Autowiredprivate DefaultKaptcha producer;@Autowiredprivate CaptchaService captchaService;@ResponseBody@GetMapping("/get")public CaptchaVO getCaptcha() throws IOException {// 生成文字验证码String content = producer.createText();// 生成图片验证码ByteArrayOutputStream outputStream = null;BufferedImage image = producer.createImage(content);outputStream = new ByteArrayOutputStream();ImageIO.write(image, "jpg", outputStream);// 对字节数组Base64编码BASE64Encoder encoder = new BASE64Encoder();String str = "data:image/jpeg;base64,";String base64Img = str + encoder.encode(outputStream.toByteArray()).replace("\n", "").replace("\r", "");CaptchaVO captchaVO  =captchaService.cacheCaptcha(content);captchaVO.setBase64Img(base64Img);return  captchaVO;}
}

验证码返回对象CaptchaVO

java">@Data
public class CaptchaVO {/*** 验证码标识符*/private String captchaKey;/*** 验证码过期时间*/private Long expire;/*** base64字符串*/private String base64Img;
}

验证码方法层CaptchaService

java">import com.lzp.kaptcha.utils.RedisUtils;
import com.lzp.kaptcha.vo.CaptchaVO;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;import java.util.UUID;@Service
public class CaptchaService {@Value("${server.session.timeout:300}")private Long timeout;@Autowiredprivate RedisUtils redisUtils;private final String CAPTCHA_KEY = "captcha:verification:";public CaptchaVO cacheCaptcha(String captcha){//生成一个随机标识符String captchaKey = UUID.randomUUID().toString();//缓存验证码并设置过期时间redisUtils.set(CAPTCHA_KEY.concat(captchaKey),captcha,timeout);CaptchaVO captchaVO = new CaptchaVO();captchaVO.setCaptchaKey(captchaKey);captchaVO.setExpire(timeout);return captchaVO;}
}

1.2.4 登录控制层

用户登录对象封装LoginDTO

java">@Data
public class LoginDTO {private String userName;private String pwd;private String captchaKey;private String captcha; 
}

java">import com.lzp.kaptcha.dto.LoginDTO;
import com.lzp.kaptcha.utils.RedisUtils;
import com.lzp.kaptcha.vo.UserVO;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RestController
@RequestMapping("/user")
public class UserController {@Autowiredprivate RedisUtils redisUtils;@PostMapping("/login")public UserVO login(@RequestBody LoginDTO loginDTO)  {Object captch = redisUtils.get(loginDTO.getCaptchaKey());if(captch == null){// throw 验证码已过期}if(!loginDTO.getCaptcha().equals(captch)){// throw 验证码错误}// 查询用户信息//判断用户是否存在 不存在抛出用户名密码错误//判断密码是否正确，不正确抛出用户名密码错误//构造返回到前端的用户对象并封装信息和生成tokenreturn new UserVO();}
}