mirror of https://gitee.com/topiam/eiam
smallbun
2 years ago
373 changed files with 4778 additions and 6480 deletions
@ -0,0 +1,42 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<!-- |
||||
|
||||
eiam-authentication-captcha - Employee Identity and Access Management Program |
||||
Copyright © 2020-2023 TopIAM (support@topiam.cn) |
||||
|
||||
This program is free software: you can redistribute it and/or modify |
||||
it under the terms of the GNU Affero General Public License as published by |
||||
the Free Software Foundation, either version 3 of the License, or |
||||
(at your option) any later version. |
||||
|
||||
This program is distributed in the hope that it will be useful, |
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
GNU Affero General Public License for more details. |
||||
|
||||
You should have received a copy of the GNU Affero General Public License |
||||
along with this program. If not, see <http://www.gnu.org/licenses/>. |
||||
|
||||
--> |
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" |
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
||||
<parent> |
||||
<artifactId>eiam-authentication</artifactId> |
||||
<groupId>cn.topiam</groupId> |
||||
<version>1.0.0-beta1</version> |
||||
<relativePath>../pom.xml</relativePath> |
||||
</parent> |
||||
<modelVersion>4.0.0</modelVersion> |
||||
|
||||
<artifactId>eiam-authentication-captcha</artifactId> |
||||
<packaging>jar</packaging> |
||||
<dependencies> |
||||
<!-- common --> |
||||
<dependency> |
||||
<groupId>cn.topiam</groupId> |
||||
<artifactId>eiam-authentication-core</artifactId> |
||||
<version>${project.version}</version> |
||||
</dependency> |
||||
</dependencies> |
||||
</project> |
||||
@ -0,0 +1,121 @@
|
||||
/* |
||||
* eiam-authentication-captcha - Employee Identity and Access Management Program |
||||
* Copyright © 2020-2023 TopIAM (support@topiam.cn) |
||||
* |
||||
* This program is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License as published by |
||||
* the Free Software Foundation, either version 3 of the License, or |
||||
* (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/ |
||||
package cn.topiam.employee.authentication.captcha.filter; |
||||
|
||||
import java.io.IOException; |
||||
import java.util.Objects; |
||||
import java.util.UUID; |
||||
|
||||
import javax.servlet.FilterChain; |
||||
import javax.servlet.ServletException; |
||||
import javax.servlet.http.HttpServletRequest; |
||||
import javax.servlet.http.HttpServletResponse; |
||||
|
||||
import org.apache.commons.lang3.StringUtils; |
||||
import org.springframework.http.HttpMethod; |
||||
import org.springframework.http.HttpStatus; |
||||
import org.springframework.lang.NonNull; |
||||
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; |
||||
import org.springframework.security.web.util.matcher.OrRequestMatcher; |
||||
import org.springframework.web.context.request.RequestContextHolder; |
||||
import org.springframework.web.context.request.ServletRequestAttributes; |
||||
import org.springframework.web.filter.OncePerRequestFilter; |
||||
|
||||
import com.alibaba.fastjson2.JSONObject; |
||||
|
||||
import cn.topiam.employee.authentication.captcha.CaptchaValidator; |
||||
import cn.topiam.employee.common.constants.AuthorizeConstants; |
||||
import cn.topiam.employee.support.result.ApiRestResult; |
||||
import cn.topiam.employee.support.trace.TraceUtils; |
||||
import static cn.topiam.employee.common.constants.AuthorizeConstants.FORM_LOGIN; |
||||
import static cn.topiam.employee.support.constant.EiamConstants.CAPTCHA_CODE_SESSION; |
||||
import static cn.topiam.employee.support.exception.enums.ExceptionStatus.EX000102; |
||||
import static cn.topiam.employee.support.util.HttpResponseUtils.flushResponse; |
||||
|
||||
/** |
||||
* 验证码过滤器 |
||||
* |
||||
* @author TopIAM |
||||
* Created by support@topiam.cn on 2020/10/23 22:34 |
||||
*/ |
||||
public class CaptchaValidatorFilter extends OncePerRequestFilter { |
||||
|
||||
@Override |
||||
protected void doFilterInternal(@NonNull HttpServletRequest request, |
||||
@NonNull HttpServletResponse response, |
||||
@NonNull FilterChain filterChain) throws ServletException, |
||||
IOException { |
||||
if (requiresAuthentication(request)) { |
||||
TraceUtils.put(UUID.randomUUID().toString()); |
||||
boolean validate = captchaValidator.validate(request, response); |
||||
if (!validate) { |
||||
response.setStatus(HttpStatus.BAD_REQUEST.value()); |
||||
flushResponse(response, JSONObject.toJSONString(ApiRestResult.builder() |
||||
.status(EX000102.getCode()).message(EX000102.getMessage()).build())); |
||||
return; |
||||
} |
||||
filterChain.doFilter(request, response); |
||||
TraceUtils.remove(); |
||||
return; |
||||
} |
||||
filterChain.doFilter(request, response); |
||||
} |
||||
|
||||
/** |
||||
* 校验验证码 |
||||
* |
||||
* @param captcha {@link String} |
||||
* @return boolean |
||||
*/ |
||||
public boolean validate(String captcha) { |
||||
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder |
||||
.getRequestAttributes(); |
||||
HttpServletRequest request = Objects.requireNonNull(attributes).getRequest(); |
||||
String value = String.valueOf(request.getSession().getAttribute(CAPTCHA_CODE_SESSION)); |
||||
return StringUtils.equals(value, captcha); |
||||
} |
||||
|
||||
/** |
||||
* 需要认证 |
||||
* |
||||
* @param request {@link HttpServletRequest} |
||||
* @return {@link Boolean} |
||||
*/ |
||||
protected boolean requiresAuthentication(HttpServletRequest request) { |
||||
OrRequestMatcher requestMatcher = new OrRequestMatcher( |
||||
//登录
|
||||
new AntPathRequestMatcher(FORM_LOGIN, HttpMethod.POST.name()), |
||||
//发送OTP
|
||||
new AntPathRequestMatcher(AuthorizeConstants.LOGIN_OTP_SEND, HttpMethod.POST.name())); |
||||
return requestMatcher.matches(request); |
||||
} |
||||
|
||||
/** |
||||
* CaptchaValidator |
||||
*/ |
||||
private final CaptchaValidator captchaValidator; |
||||
|
||||
/** |
||||
* |
||||
* @param captchaValidator {@link CaptchaValidator} |
||||
*/ |
||||
public CaptchaValidatorFilter(CaptchaValidator captchaValidator) { |
||||
this.captchaValidator = captchaValidator; |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,18 @@
|
||||
/* |
||||
* eiam-authentication-captcha - Employee Identity and Access Management Program |
||||
* Copyright © 2020-2023 TopIAM (support@topiam.cn) |
||||
* |
||||
* This program is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License as published by |
||||
* the Free Software Foundation, either version 3 of the License, or |
||||
* (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/ |
||||
package cn.topiam.employee.authentication.captcha.filter; |
||||
@ -0,0 +1,120 @@
|
||||
/* |
||||
* eiam-authentication-captcha - Employee Identity and Access Management Program |
||||
* Copyright © 2020-2023 TopIAM (support@topiam.cn) |
||||
* |
||||
* This program is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License as published by |
||||
* the Free Software Foundation, either version 3 of the License, or |
||||
* (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/ |
||||
package cn.topiam.employee.authentication.captcha.geetest; |
||||
|
||||
import java.util.Map; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
import javax.servlet.http.HttpServletResponse; |
||||
|
||||
import org.apache.commons.codec.digest.HmacAlgorithms; |
||||
import org.apache.commons.codec.digest.HmacUtils; |
||||
import org.slf4j.Logger; |
||||
import org.slf4j.LoggerFactory; |
||||
import org.springframework.http.*; |
||||
import org.springframework.util.LinkedMultiValueMap; |
||||
import org.springframework.util.MultiValueMap; |
||||
import org.springframework.web.client.RestTemplate; |
||||
|
||||
import com.alibaba.fastjson2.JSONObject; |
||||
|
||||
import cn.topiam.employee.authentication.captcha.CaptchaValidator; |
||||
import cn.topiam.employee.common.util.RequestUtils; |
||||
|
||||
/** |
||||
* 极速验证 |
||||
* |
||||
* @author TopIAM |
||||
* Created by support@topiam.cn on 2022/8/14 19:11 |
||||
*/ |
||||
public class GeeTestCaptchaValidator implements CaptchaValidator { |
||||
private static final String RESULT = "result"; |
||||
private static final String SUCCESS = "success"; |
||||
|
||||
private final Logger logger = LoggerFactory.getLogger(GeeTestCaptchaValidator.class); |
||||
|
||||
/** |
||||
* 验证 |
||||
* |
||||
* @param request {@link HttpServletRequest} |
||||
* @param response {@link HttpServletResponse} |
||||
* @return {@link Boolean} |
||||
*/ |
||||
@Override |
||||
public boolean validate(HttpServletRequest request, HttpServletResponse response) { |
||||
Map<String, Object> getParams = RequestUtils.getParams(request); |
||||
// 1.初始化极验参数信息
|
||||
String captchaId = config.getCaptchaId(); |
||||
String captchaKey = config.getCaptchaKey(); |
||||
String domain = "https://gcaptcha4.geetest.com"; |
||||
|
||||
// 2.获取用户验证后前端传过来的验证流水号等参数
|
||||
String lotNumber = (String) getParams.get("lot_number"); |
||||
String captchaOutput = (String) getParams.get("captcha_output"); |
||||
String passToken = (String) getParams.get("pass_token"); |
||||
String genTime = (String) getParams.get("gen_time"); |
||||
|
||||
// 3.生成签名
|
||||
// 生成签名使用标准的hmac算法，使用用户当前完成验证的流水号lot_number作为原始消息message，使用客户验证私钥作为key
|
||||
// 采用sha256散列算法将message和key进行单向散列生成最终的签名
|
||||
String signToken = new HmacUtils(HmacAlgorithms.HMAC_SHA_256, captchaKey) |
||||
.hmacHex(lotNumber); |
||||
|
||||
// 4.上传校验参数到极验二次验证接口, 校验用户验证状态
|
||||
MultiValueMap<String, String> queryParams = new LinkedMultiValueMap<>(); |
||||
queryParams.add("lot_number", lotNumber); |
||||
queryParams.add("captcha_output", captchaOutput); |
||||
queryParams.add("pass_token", passToken); |
||||
queryParams.add("gen_time", genTime); |
||||
queryParams.add("sign_token", signToken); |
||||
// captcha_id 参数建议放在 url 后面, 方便请求异常时可以在日志中根据id快速定位到异常请求
|
||||
String url = String.format(domain + "/validate" + "?captcha_id=%s", captchaId); |
||||
HttpHeaders headers = new HttpHeaders(); |
||||
HttpMethod method = HttpMethod.POST; |
||||
headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED); |
||||
JSONObject jsonObject; |
||||
//注意处理接口异常情况，当请求极验二次验证接口异常时做出相应异常处理
|
||||
//保证不会因为接口请求超时或服务未响应而阻碍业务流程
|
||||
try { |
||||
HttpEntity<MultiValueMap<String, String>> requestEntity = new HttpEntity<>(queryParams, |
||||
headers); |
||||
ResponseEntity<String> responseEntity = restTemplate.exchange(url, method, |
||||
requestEntity, String.class); |
||||
String resBody = responseEntity.getBody(); |
||||
jsonObject = JSONObject.parseObject(resBody); |
||||
} catch (Exception e) { |
||||
logger.error("验证发生异常: {}", e.getMessage()); |
||||
return false; |
||||
} |
||||
// 5.根据极验返回的用户验证状态, 网站主进行自己的业务逻辑
|
||||
if (SUCCESS.equals(jsonObject.getString(RESULT))) { |
||||
logger.info("验证成功: {}", jsonObject.toJSONString()); |
||||
return true; |
||||
} |
||||
logger.info("验证失败: {}", jsonObject.toJSONString()); |
||||
return true; |
||||
} |
||||
|
||||
private final GeeTestCaptchaProviderConfig config; |
||||
private final RestTemplate restTemplate; |
||||
|
||||
public GeeTestCaptchaValidator(GeeTestCaptchaProviderConfig config, RestTemplate restTemplate) { |
||||
this.config = config; |
||||
this.restTemplate = restTemplate; |
||||
} |
||||
} |
||||
@ -0,0 +1,18 @@
|
||||
/* |
||||
* eiam-authentication-captcha - Employee Identity and Access Management Program |
||||
* Copyright © 2020-2023 TopIAM (support@topiam.cn) |
||||
* |
||||
* This program is free software: you can redistribute it and/or modify |
||||
* it under the terms of the GNU Affero General Public License as published by |
||||
* the Free Software Foundation, either version 3 of the License, or |
||||
* (at your option) any later version. |
||||
* |
||||
* This program is distributed in the hope that it will be useful, |
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||
* GNU Affero General Public License for more details. |
||||
* |
||||
* You should have received a copy of the GNU Affero General Public License |
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/ |
||||
package cn.topiam.employee.authentication.captcha.geetest; |
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue