Shiro+Redis实现登录次数冻结的示例

 @PostMapping(value = "/login")
 public AccountVO login(String userName, String password){
  
  //尝试登录
  Subject subject = SecurityUtils.getSubject();
  try {
   //通过shiro提供的安全接口来进行认证
   subject.login(new UsernamePasswordToken(userName, password));
  } catch (ExcessiveAttemptsException e1) {
   //新增一个账户锁定类错误
   throw new AccountLockedException();
  } catch (Exception e) {
   //其他的错误判定
   throw new LoginFailed();
  }
  //聚合登录信息
  AccountVO account = accountService.getAccountByUserName(userName);
  //返回正确登录的结果
  return account;
 }

 /**
  * This implementation first hashes the {@code token}'s credentials, potentially using a
  * {@code salt} if the {@code info} argument is a
  * {@link org.apache.shiro.authc.SaltedAuthenticationInfo SaltedAuthenticationInfo}. It then compares the hash
  * against the {@code AuthenticationInfo}'s
  * {@link #getCredentials(org.apache.shiro.authc.AuthenticationInfo) already-hashed credentials}. This method
  * returns {@code true} if those two values are {@link #equals(Object, Object) equal}, {@code false} otherwise.
  *
  * @param token the {@code AuthenticationToken} submitted during the authentication attempt.
  * @param info the {@code AuthenticationInfo} stored in the system matching the token principal
  * @return {@code true} if the provided token credentials hash match to the stored account credentials hash,
  *   {@code false} otherwise
  * @since 1.1
  */
 @Override
 public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
  Object tokenHashedCredentials = hashProvidedCredentials(token, info);
  Object accountCredentials = getCredentials(info);
  return equals(tokenHashedCredentials, accountCredentials);
 }

import com.imlehr.internship.redis.RedisStringService;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.ExcessiveAttemptsException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.springframework.beans.factory.annotation.Autowired;

/**
 * @author Lehr
 * @create: 2020-02-25
 */
public class CustomMatcher extends HashedCredentialsMatcher {

	//这个是redis里的key的统一前缀
 private static final String PREFIX = "USER_LOGIN_FAIL:";

 @Autowired
 RedisStringService redisUtils;

 @Override
 public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {

  //检查本账号是否被冻结

  //先获取用户的登录名字 
  UsernamePasswordToken myToken = (UsernamePasswordToken) token;

  String userName = myToken.getUsername();

  //初始化错误登录次数
  Integer errorNum = 0;

  //从数据库里获取错误次数
  String errorTimes = (String)redisUtils.get(PREFIX+userName);

  if(errorTimes!=null && errorTimes.trim().length()>0)
  {
   //如果得到的字符串不为空不为空
   errorNum = Integer.parseInt(errorTimes);
  }

  //如果用户错误登录次数超过十次
  if (errorNum >= 10) {
   //抛出账号锁定异常类
   throw new ExcessiveAttemptsException();
  }

  //先按照父类的规则来比对密码
  boolean matched = super.doCredentialsMatch(token, info);

  if(matched)
  {
   //清空错误次数
   redisUtils.remove(PREFIX+userName);
  }
  else{
   //添加一次错误次数 秒为单位
   redisUtils.set(PREFIX+userName,String.valueOf(++errorNum),60*30L);
  }

  return matched;
 }
}

subject.login(new UsernamePasswordToken(userName, password));

import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.serializer.JdkSerializationRedisSerializer;
import org.springframework.data.redis.serializer.StringRedisSerializer;

@Configuration
public class RedisConfig {

 @Bean
 public RedisTemplate<String, Object> redisTemplate(RedisConnectionFactory redisConnectionFactory)
 {
	//我就用的默认的序列化处理器
  StringRedisSerializer stringRedisSerializer = new StringRedisSerializer();
  JdkSerializationRedisSerializer ser = new JdkSerializationRedisSerializer();

  RedisTemplate<String, Object> template = new RedisTemplate<String, Object>();
  template.setConnectionFactory(redisConnectionFactory);

  template.setKeySerializer(stringRedisSerializer);
  template.setValueSerializer(ser);
  return template;
 }

 @Bean
 public RedisStringService myStringRedisTemplate()
 {
  return new RedisStringService();
 }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.StringRedisTemplate;
import org.springframework.data.redis.core.ValueOperations;
import org.springframework.stereotype.Service;

import java.util.concurrent.TimeUnit;

public class RedisStringService {

 @Autowired
 protected StringRedisTemplate redisTemplate;

 /**
  * 写入redis缓存（不设置expire存活时间）
  * @param key
  * @param value
  * @return
  */
 public boolean set(final String key, String value){
  boolean result = false;
  try {
   ValueOperations operations = redisTemplate.opsForValue();
   operations.set(key, value);
   result = true;
  } catch (Exception e) {
   e.getMessage();
  }
  return result;
 }

 /**
  * 写入redis缓存（设置expire存活时间）
  * @param key
  * @param value
  * @param expire
  * @return
  */
 public boolean set(final String key, String value, Long expire){
  boolean result = false;
  try {
   ValueOperations operations = redisTemplate.opsForValue();
   operations.set(key, value);
   redisTemplate.expire(key, expire, TimeUnit.SECONDS);
   result = true;
  } catch (Exception e) {
   e.getMessage();
  }
  return result;
 }


 /**
  * 读取redis缓存
  * @param key
  * @return
  */
 public Object get(final String key){
  Object result = null;
  try {
   ValueOperations operations = redisTemplate.opsForValue();
   result = operations.get(key);
  } catch (Exception e) {
   e.getMessage();
  }
  return result;
 }

 /**
  * 判断redis缓存中是否有对应的key
  * @param key
  * @return
  */
 public boolean exists(final String key){
  boolean result = false;
  try {
   result = redisTemplate.hasKey(key);
  } catch (Exception e) {
   e.getMessage();
  }
  return result;
 }

 /**
  * redis根据key删除对应的value
  * @param key
  * @return
  */
 public boolean remove(final String key){
  boolean result = false;
  try {
   if(exists(key)){
    redisTemplate.delete(key);
   }
   result = true;
  } catch (Exception e) {
   e.getMessage();
  }
  return result;
 }

 /**
  * redis根据keys批量删除对应的value
  * @param keys
  * @return
  */
 public void remove(final String... keys){
  for(String key : keys){
   remove(key);
  }
 }
}