SpringBoot 多点互斥登录(web应用安全) 保姆级教程

1.什么是互斥登录

        在实际生活中，很多网站都做了多点**登录互斥**的操作，简单来说就是同一个账号，只能在一台电脑上登录，如果有人在其他地方登录，那么原来登录的地方就会自动下线，再进行操作就会弹出登录界面。

2.实现思路

     添加拦截器,设置UUID让**token**作为唯一标识，存入redis中当value，当前登陆者的账户为key，当前登陆者的token与我们redis中的**token**值相同则通过,否则返回false,表示设备已在其他地方登录。

3.代码实现

3.1 创建boot项目选择依赖

3.2 pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.7.5</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.gitkeki</groupId>
    <artifactId>boot_exclusive_login</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>boot_exclusive_login</name>
    <description>boot_exclusive_login</description>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-pool2</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>
        <dependency>
            <groupId>cn.hutool</groupId>
            <artifactId>hutool-all</artifactId>
            <version>5.7.17</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

3.2 修改核心配置文件

server:
  port: 80
spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/jpa
    username: root
    password: root
  redis:
    host: 192.168.164.129
    port: 6379
    password: redis123
    lettuce:
      pool:
        max-active: 10
        max-idle: 10
        min-idle: 1
        time-between-eviction-runs: 10s
    database: 2
  jackson:
    default-property-inclusion: non_null # JSON处理时忽略非空字段
logging:
  level:
    com.hmdp: debug

3.2 编写TokenUtil

@Data
public class TokenUtil {

    //用户存储登录者账户
    private String account;

    //唯一token码
    private String token;
}

3.3 编写HandlerInterceptor

public class LoginInterceptor implements HandlerInterceptor {

    private StringRedisTemplate redisTemplate;

    public LoginInterceptor(StringRedisTemplate redisTemplate) {
        this.redisTemplate = redisTemplate;
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        String token = request.getParameter("token");
        String account = request.getParameter("account");
        if(token == null){
            response.setStatus(401);
            return false;
        }

        String tokenValue = redisTemplate.opsForValue().get(account);
        if(tokenValue!=null&&tokenValue.equals(token)){
            System.out.println("token正确,放行");
            return true;
        }
        response.setStatus(520);
        return false;
    }
}

3.4 编写config(配置类)

@Configuration
public class MvcConfig implements WebMvcConfigurer {

    @Autowired(required = false)
    private StringRedisTemplate redisTemplate;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new LoginInterceptor(redisTemplate))
                .excludePathPatterns("/jump","/login");
    }
}

3.5 编写controller(控制层)

@Controller
public class UserController {

    @Autowired(required = false)
    private StringRedisTemplate redisTemplate;

    /**
     * 登录校验
     * @param account
     * @param password
     * @param model
     * @return
     */
    @PostMapping("/login")
    public String checkLogin(String account, String password, Model model){
        if (account.equals("[email protected]") && password.equals("123456")){
            String token = UUID.randomUUID().toString();
            TokenUtil tokenUtil = new TokenUtil();
            tokenUtil.setToken(token);
            tokenUtil.setAccount(account);
            model.addAttribute("tokenUtil",tokenUtil);
            redisTemplate.opsForValue().set(account,token);
        }
        return "add";
    }

    /**
     * 登录页
     * @return
     */
    @GetMapping("/jump")
    public String jump(){
        return "index";
    }

    /**
     * 测试页
     * @return
     */
    @PostMapping("/test")
    @ResponseBody
    public String test(){
        return "添加";
    }
}

3.6 编写前端login页

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>登录</title>
</head>
<body>
<form th:action="@{/login}" method="post">
  账号:<input type="text" name="account">
  密码:<input type="text" name="password">
  <input type="submit" value="登录">
</form>
</body>
</html>

3.7 编写前端test页

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>测试页</title>
</head>
<body>
<form th:action="@{/test}" method="post">
    <input type="hidden" name="token" th:value="${tokenUtil.token}">
    <input type="hidden" name="account" th:value="${tokenUtil.account}">
    <input type="submit" value="添加">
</form>
</body>
</html>

4.页面效果

5.总结

    这里我没有使用数据库做账号校验，如果需要做校验，向contoller中添加校验...

    其实不论账号冻结还是多点登录的互斥，都是对用户账号的一种保护机制，避免用户的账号被不法利用。