首页 > 其他分享 >SpringBoot项目添加2FA双因素身份认证

SpringBoot项目添加2FA双因素身份认证

时间:2024-04-25 11:01:04浏览次数:28  
标签:return String 认证 secretKey 2FA new byte public SpringBoot

什么是 2FA(双因素身份验证)?

双因素身份验证(2FA)是一种安全系统,要求用户提供两种不同的身份验证方式才能访问某个系统或服务。国内普遍做短信验证码这种的用的比较少,不过在国外的网站中使用双因素身份验证的还是很多的。用户通过使用验证器扫描二维码,就能在app上获取登录的动态口令,进一步加强了账户的安全性。

主要步骤

pom.xml中增加依赖

<!-- 用于SecureKey生成 -->
<dependency>
    <groupId>commons-codec</groupId>
    <artifactId>commons-codec</artifactId>
    <version>1.15</version>
</dependency>
<!-- 二维码依赖 -->
<dependency>
    <groupId>org.iherus</groupId>
    <artifactId>qrext4j</artifactId>
    <version>1.3.1</version>
</dependency>

用户表中增加secretKey列

为用户绑定secretKey字段,用以生成二维码及后期校验
image

工具类

谷歌身份验证器工具类


/**
 * 谷歌身份验证器工具类
 */
public class GoogleAuthenticator {

    /**
     * 时间前后偏移量
     * 用于防止客户端时间不精确导致生成的TOTP与服务器端的TOTP一直不一致
     * 如果为0,当前时间为 10:10:15
     * 则表明在 10:10:00-10:10:30 之间生成的TOTP 能校验通过
     * 如果为1,则表明在
     * 10:09:30-10:10:00
     * 10:10:00-10:10:30
     * 10:10:30-10:11:00 之间生成的TOTP 能校验通过
     * 以此类推
     */
    private static int WINDOW_SIZE = 0;

    /**
     * 加密方式,HmacSHA1、HmacSHA256、HmacSHA512
     */
    private static final String CRYPTO = "HmacSHA1";

    /**
     * 生成密钥,每个用户独享一份密钥
     *
     * @return
     */
    public static String getSecretKey() {
        SecureRandom random = new SecureRandom();
        byte[] bytes = new byte[20];
        random.nextBytes(bytes);
        Base32 base32 = new Base32();
        String secretKey = base32.encodeToString(bytes);
        // make the secret key more human-readable by lower-casing and
        // inserting spaces between each group of 4 characters
        return secretKey.toUpperCase();
    }

    /**
     * 生成二维码内容
     *
     * @param secretKey 密钥
     * @param account   账户名
     * @param issuer    网站地址(可不写)
     * @return
     */
    public static String getQrCodeText(String secretKey, String account, String issuer) {
        String normalizedBase32Key = secretKey.replace(" ", "").toUpperCase();
        try {
            return "otpauth://totp/"
                    + URLEncoder.encode((!StringUtils.isEmpty(issuer) ? (issuer + ":") : "") + account, "UTF-8").replace("+", "%20")
                    + "?secret=" + URLEncoder.encode(normalizedBase32Key, "UTF-8").replace("+", "%20")
                    + (!StringUtils.isEmpty(issuer) ? ("&issuer=" + URLEncoder.encode(issuer, "UTF-8").replace("+", "%20")) : "");
        } catch (UnsupportedEncodingException e) {
            throw new IllegalStateException(e);
        }
    }

    /**
     * 获取验证码
     *
     * @param secretKey
     * @return
     */
    public static String getCode(String secretKey) {
        String normalizedBase32Key = secretKey.replace(" ", "").toUpperCase();
        Base32 base32 = new Base32();
        byte[] bytes = base32.decode(normalizedBase32Key);
        String hexKey = Hex.encodeHexString(bytes);
        long time = (System.currentTimeMillis() / 1000) / 30;
        String hexTime = Long.toHexString(time);
        return TOTP.generateTOTP(hexKey, hexTime, "6", CRYPTO);
    }

    /**
     * 检验 code 是否正确
     *
     * @param secret 密钥
     * @param code   code
     * @param time   时间戳
     * @return
     */
    public static boolean checkCode(String secret, long code, long time) {
        Base32 codec = new Base32();
        byte[] decodedKey = codec.decode(secret);
        // convert unix msec time into a 30 second "window"
        // this is per the TOTP spec (see the RFC for details)
        long t = (time / 1000L) / 30L;
        // Window is used to check codes generated in the near past.
        // You can use this value to tune how far you're willing to go.
        long hash;
        for (int i = -WINDOW_SIZE; i <= WINDOW_SIZE; ++i) {
            try {
                hash = verifyCode(decodedKey, t + i);
            } catch (Exception e) {
                // Yes, this is bad form - but
                // the exceptions thrown would be rare and a static
                // configuration problem
                // e.printStackTrace();
                throw new RuntimeException(e.getMessage());
            }
            if (hash == code) {
                return true;
            }
        }
        return false;
    }

    /**
     * 根据时间偏移量计算
     *
     * @param key
     * @param t
     * @return
     * @throws NoSuchAlgorithmException
     * @throws InvalidKeyException
     */
    private static long verifyCode(byte[] key, long t) throws NoSuchAlgorithmException, InvalidKeyException {
        byte[] data = new byte[8];
        long value = t;
        for (int i = 8; i-- > 0; value >>>= 8) {
            data[i] = (byte) value;
        }
        SecretKeySpec signKey = new SecretKeySpec(key, CRYPTO);
        Mac mac = Mac.getInstance(CRYPTO);
        mac.init(signKey);
        byte[] hash = mac.doFinal(data);
        int offset = hash[20 - 1] & 0xF;
        // We're using a long because Java hasn't got unsigned int.
        long truncatedHash = 0;
        for (int i = 0; i < 4; ++i) {
            truncatedHash <<= 8;
            // We are dealing with signed bytes:
            // we just keep the first byte.
            truncatedHash |= (hash[offset + i] & 0xFF);
        }
        truncatedHash &= 0x7FFFFFFF;
        truncatedHash %= 1000000;
        return truncatedHash;
    }

    public static void main(String[] args) {
        for (int i = 0; i < 100; i++) {
            String secretKey = getSecretKey();
            System.out.println("secretKey:" + secretKey);
            String code = getCode(secretKey);
            System.out.println("code:" + code);
            boolean b = checkCode(secretKey, Long.parseLong(code), System.currentTimeMillis());
            System.out.println("isSuccess:" + b);
        }
    }
}

二维码工具类

/**
 * 验证码生成工具类
 */
public class TOTP {

    private static final int[] DIGITS_POWER = {1, 10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000};

    /**
     * This method uses the JCE to provide the crypto algorithm. HMAC computes a
     * Hashed Message Authentication Code with the crypto hash algorithm as a
     * parameter.
     *
     * @param crypto   : the crypto algorithm (HmacSHA1, HmacSHA256, HmacSHA512)
     * @param keyBytes : the bytes to use for the HMAC key
     * @param text     : the message or text to be authenticated
     */
    private static byte[] hmac_sha(String crypto, byte[] keyBytes, byte[] text) {
        try {
            Mac hmac;
            hmac = Mac.getInstance(crypto);
            SecretKeySpec macKey = new SecretKeySpec(keyBytes, "RAW");
            hmac.init(macKey);
            return hmac.doFinal(text);
        } catch (GeneralSecurityException gse) {
            throw new UndeclaredThrowableException(gse);
        }
    }

    /**
     * This method converts a HEX string to Byte[]
     *
     * @param hex : the HEX string
     * @return: a byte array
     */
    private static byte[] hexStr2Bytes(String hex) {
        // Adding one byte to get the right conversion
        // Values starting with "0" can be converted
        byte[] bArray = new BigInteger("10" + hex, 16).toByteArray();

        // Copy all the REAL bytes, not the "first"
        byte[] ret = new byte[bArray.length - 1];
        System.arraycopy(bArray, 1, ret, 0, ret.length);
        return ret;
    }

    /**
     * This method generates a TOTP value for the given set of parameters.
     *
     * @param key          : the shared secret, HEX encoded
     * @param time         : a value that reflects a time
     * @param returnDigits : number of digits to return
     * @param crypto       : the crypto function to use
     * @return: a numeric String in base 10 that includes
     */
    public static String generateTOTP(String key, String time, String returnDigits, String crypto) {
        int codeDigits = Integer.decode(returnDigits);
        String result = null;

        // Using the counter
        // First 8 bytes are for the movingFactor
        // Compliant with base RFC 4226 (HOTP)
        while (time.length() < 16) {
            time = "0" + time;
        }

        // Get the HEX in a Byte[]
        byte[] msg = hexStr2Bytes(time);
        byte[] k = hexStr2Bytes(key);
        byte[] hash = hmac_sha(crypto, k, msg);

        // put selected bytes into result int
        int offset = hash[hash.length - 1] & 0xf;

        int binary = ((hash[offset] & 0x7f) << 24)
                | ((hash[offset + 1] & 0xff) << 16)
                | ((hash[offset + 2] & 0xff) << 8) | (hash[offset + 3] & 0xff);

        int otp = binary % DIGITS_POWER[codeDigits];

        result = Integer.toString(otp);
        while (result.length() < codeDigits) {
            result = "0" + result;
        }
        return result;
    }
}

Service

@Transactional(isolation = Isolation.REPEATABLE_READ, propagation = Propagation.REQUIRED)
@Service
public class TwoFAService {
    @Autowired
    private UserMapper userMapper;

   /**
    * 获取SecureKey
    */
    public String getSecureKey(Integer userId) {
        User user = userMapper.selectUserById(userId);
        return user.getSecretKey();
    }

    /**
     * 更新secureKey
     */
    public Integer updateSecureKey(Integer userId, String secureKey) {
        return userMapper.updateSecureKeyById(userId, secureKey);
    }

   /**
    * 校验动态码
    */
    public boolean chek2FACode(User user, String twoFACode) throws Exception {
        String secretKey = user.getSecretKey();
        // 没绑定设备就先验证通过
        if(secretKey == null || secretKey.isEmpty()) {
            return true;
        } else  {
           if(twoFACode.isEmpty()) { throw new Exception("已绑定设备,请输入动态码"); }
           boolean checkRes = GoogleAuthenticator.checkCode(secretKey, Long.parseLong(twoFACode), System.currentTimeMillis());
           if(!checkRes) {
               throw new Exception("动态码错误");
           } else {
               return true;
           }
        }
    }
}

Controller

用户登录中增加两步验证:

@Controller
@RequestMapping(value = "/mgr")
public class UserController {
    @Autowired
    private UserService userService;
    @Autowired
    private LogService logService;
    @Autowired
    private TwoFAService twoFAService;

    /**
     * @Description: 用户登录
     */
    @RequestMapping(value = "/user/login", method = RequestMethod.POST)
    @ResponseBody
    public GlobalResult login(String userCode, String userPwd, String twoFACode) {
        try {
            UsernamePasswordToken token = new UsernamePasswordToken(userCode, userPwd);
            Subject subject = SecurityUtils.getSubject();
            subject.login(token);

            // 2FA验证
            User user = (User) subject.getPrincipal();
            twoFAService.chek2FACode(user, twoFACode);

            Log log = new Log();
            .......
        }
    }
}

两步验证的Controler

@RestController
@RequestMapping(value = "/2fa")
public class TwoFAController {
    @Autowired
    private TwoFAService twoFAService;

    /**
     * 生成二维码信息对象
     */
    @GetMapping("/getQrcode")
    public QrCodeResponse getQrcode(@RequestParam("userId") Integer userId, @RequestParam("userCode") String userCode, HttpServletResponse response) throws Exception {
        try {
            String secretKey = twoFAService.getSecureKey(userId);
            QrCodeResponse qrCodeResponse = new QrCodeResponse();
            if(secretKey == null || secretKey.isEmpty()) {
                secretKey = GoogleAuthenticator.getSecretKey();
                qrCodeResponse.setBind(false);
                // userMapper.updateSecureKeyById(userId, secretKey);
            } else {
                qrCodeResponse.setBind(true);
            }

            // 生成二维码内容
            String qrCodeText = GoogleAuthenticator.getQrCodeText(secretKey, userCode, "suggest-mgr");
            // 以流的形式返回生成二维码输出
            // new SimpleQrcodeGenerator().generate(qrCodeText).toStream(response.getOutputStream());
            BufferedImage image = new SimpleQrcodeGenerator().generate(qrCodeText).getImage();
            // 将图片转换为Base64字符串
            String base64Image = convertImageToBase64(image);
            qrCodeResponse.setQrCodeText(secretKey);
            qrCodeResponse.setBase64Image(base64Image);

            return qrCodeResponse;
        } catch (Exception e) {
            // 处理异常
            e.printStackTrace();
            return null; // 或者返回适当的错误信息
        }
    }

    /**
     * 更新SecretKey
     * @param userId
     * @param secretKey
     */
    @GetMapping("/updateSecretKey")
    public void updateSecretKey(@RequestParam("userId") Integer userId, @RequestParam("secretKey") String secretKey) {
        twoFAService.updateSecureKey(userId, secretKey);
    }

    /**
     * 获取新的secretKey 重置用
     * @param userId
     * @param userCode
     * @return
     */
    @GetMapping("/getNewSecretKey")
    public QrCodeResponse getNewSecretKey(@RequestParam("userId") Integer userId, @RequestParam("userCode") String userCode, HttpServletResponse response) throws Exception {
        try {
            String secretKey = secretKey = GoogleAuthenticator.getSecretKey();
            QrCodeResponse qrCodeResponse = new QrCodeResponse();
            qrCodeResponse.setBind(false);

            // 生成二维码内容
            String qrCodeText = GoogleAuthenticator.getQrCodeText(secretKey, userCode, "xxx-site");
            BufferedImage image = new SimpleQrcodeGenerator().generate(qrCodeText).getImage();
            // 将图片转换为Base64字符串
            String base64Image = convertImageToBase64(image);
            qrCodeResponse.setQrCodeText(secretKey);
            qrCodeResponse.setBase64Image(base64Image);

            // 返回包含qrCodeText和Base64编码图片的信息
            return qrCodeResponse;
        } catch (Exception e) {
            // 处理异常
            e.printStackTrace();
            return null; // 或者返回适当的错误信息
        }
    }

    /**
     * 将图片文件流转为base64
     */
    private String convertImageToBase64(BufferedImage image) {
        try {
            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            ImageIO.write(image, "png", baos);
            byte[] imageBytes = baos.toByteArray();
            return Base64.getEncoder().encodeToString(imageBytes);
        } catch (Exception e) {
            // 处理异常
            return "";
        }
    }

    static public class QrCodeResponse {
        private String secretKey;
        private String base64Image;
        private boolean isBind;

        public String getSecretKey() {
            return secretKey;
        }

        public void setSecretKeyt(String secretKey) {
            this.secretKey = secretKey;
        }

        public String getBase64Image() {
            return base64Image;
        }

        public void setBase64Image(String base64Image) {
            this.base64Image = base64Image;
        }

        public boolean isBind() {
            return isBind;
        }

        public void setBind(boolean bind) {
            isBind = bind;
        }
    }
}

常用2FA验证工具

  1. Google Authenticator: google play, apple store
  2. Microsoft Authenticator: google play , apple store
  3. AuthenticatorPro(开源):https://github.com/jamie-mh/AuthenticatorPro

标签:return,String,认证,secretKey,2FA,new,byte,public,SpringBoot
From: https://www.cnblogs.com/flytree/p/18157098

相关文章

  • SpringBoot项目实现日志打印SQL明细(包括SQL语句和参数)几种方式
    前言我们在开发项目的时候,都会连接数据库。有时候遇到问题需要根据我们编写的SQL进行分析,但如果不进行一些开发或者配置的话,这些SQL是不会打印到控制台的,它们默认是隐藏的。下面给大家介绍几种常用的方法。第一种、代码形式Mybatis框架是Java程序员最常用的数据库映射框架,MyBa......
  • 9.prometheus监控--监控springboot2.x(Java)
    一、环境部署yumsearchjava|grepjdkyuminstall-yjava-11-openjdk-devel二、监控java应用(tomcat/jar)JMXexporter负责收集Java虚拟机信息---没举例,等以后再做测试进入到tomcat安装目录,vimPROMETHEUS_JMX_EXPORTER_OPTS="-javaagent:../prometheus-exporter......
  • springboot的netty代码实操
    参考:https://www.cnblogs.com/mc-74120/p/13622008.htmlpom文件<dependency><groupId>io.netty</groupId><artifactId>netty-all</artifactId></dependency>启动类@EnableFeignClients@EnableDiscoveryClient@EnableSchedu......
  • springboot 结合jackson数据脱敏
     在返回字段时有时需要对电话,地址等字段进行脱敏处理1.定义枚举脱敏类使用函数编程,绑定函数操作publicenumDataMaskEnum{/***名称脱敏*/USERNAME(s->s.replaceAll("(\\S)\\S(\\S*)","$1*$2")),/***手机号脱敏*/......
  • springboot源码:容器启动过程(扩展业务对象、bean 生命周期)&动态注册自己的业务对象&
    0.SpringbootRun方法启动org.springframework.boot.SpringApplication#run(java.lang.String...)启动 publicConfigurableApplicationContextrun(String...args){ longstartTime=System.nanoTime(); DefaultBootstrapContextbootstrapContext=createBootstrap......
  • springboot~mybatis-plus中使用TypeHandler做类型映射
    mybatis-plus中,如果数据表字段类型与java实体字段类型不一样,这时就需要做类型映射与转换了,我们一般可以实现TypeHandler接口,或者继承抽象类BaseTypeHandler,我们下面举例来说明一下它的使用方法。场景数据表里字段是varchar,java里是List集合,例如:我的爱好标签数据表里字段是varc......
  • SpringBoot整合OpenAPI 3生成在线接口文档
    SpringBoot整合springdoc-openapi,自动生成在线接口文档。1、引入pom依赖<dependency><groupId>org.springdoc</groupId><artifactId>springdoc-openapi-starter-webmvc-ui</artifactId><version>2.3.0</version></dependenc......
  • springboot 接口限制访问频率
     1.自定义注解@Target({ElementType.METHOD})@Retention(RetentionPolicy.RUNTIME)public@interfaceRateLimit{//默认最大访问次数intvalue()default3;//默认时间窗口(秒)longduration()default60;} 2.创建拦截器处理频率逻辑@Slf4......
  • springboot 统计接口耗时及指定时间接口访问次数
     1.使用AOP在不改变原有方法的基础上对接口方法增强,引入依赖<!--引入AOP依赖--><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-aop</artifactId></dependency><!--引入Redis依赖--><depen......
  • springboot项目找不到符号问题以及模块聚合项目maven插件使用的相关问题 问题如图
    参考:https://www.cnblogs.com/coderxiaobai/p/15005181.html问题:更换maven,清空缓存重新导入依赖依然无效后(1)解决方法:方式一:删除项目中.idea文件夹,重新打开项目,选中jdk版本,重新导入依赖即可。(2)如果不是上述的原因可能是项目是模块聚合项目,原因就是父工程的pom中存在maven插......