diff --git a/CNAME b/CNAME new file mode 100644 index 0000000..ff4fdd1 --- /dev/null +++ b/CNAME @@ -0,0 +1 @@ +security.buession.com diff --git a/about/index.html b/about/index.html new file mode 100644 index 0000000..c8de553 --- /dev/null +++ b/about/index.html @@ -0,0 +1,4 @@ +
+ ... +
\ No newline at end of file diff --git a/docs/guide.md b/docs/guide.md new file mode 100644 index 0000000..7f6834d --- /dev/null +++ b/docs/guide.md @@ -0,0 +1 @@ +文档完善中 \ No newline at end of file diff --git a/docs/index.md b/docs/index.md new file mode 100644 index 0000000..436444a --- /dev/null +++ b/docs/index.md @@ -0,0 +1,32 @@ +# 框架介绍 + + +### Buession Security 框架是什么? +基于 Pac4j、Shiro 二次封装,集成 Spring Security,提供极验、阿里云、腾讯云行为验证码 SDK,封装了数据脱敏和多种密码加密方式工具类库的一款安全框架。 + + +#### 数据加密封装 +1. 封装了 MD5、SHA1、SHA256、SHA512、HmacSHA1、HmacSHA256、HmacSHA512 等散列算法 +2. 封装了 AES、DES 等对称加密算法 +3. 封装了 Base64、原 Discuz 论坛中的加解密算法 +4. 封装了基于以上部分算法的密码生成器,未来将会一一实现 + +未来将会提供更多的常用加密算法,如:RSA 等等... ... + + +#### 行为验证码 +封装了阿里云、极验、腾讯云行为验证码,实现标准的 SDK。 +您只需,更改一下 `CaptchaValidator`、`CaptchaClient` 实现类的初始化,即可快速完成行为验证码的更换(当然您还需要修改前端 WEB 代码) + +未来,我们将会接入更多的行为验证码... ... + + +#### 数据脱敏 +为保证返回给前端的数据的安全性,我们提供了数据脱敏处理的工具类 + + +#### 整合三方安全框架 +1. 对 pac4j、io.buji:buji-pac4j 进行了整合 +2. 整合了 apache shiro,并实现了基于 redis 的 session、cache 的缓存;并提供了对 velocity 的支持,未来会支持更多的模板引擎 +3. 整合了 spring security,以及对 spring security 默认 Configurer 的修改,支持 servlet 和 webflux +4. 提供了 XSS 过滤器 `XssFilter`,支持 servlet 和 webflux \ No newline at end of file diff --git a/docs/installation.html b/docs/installation.html new file mode 100644 index 0000000..2b86284 --- /dev/null +++ b/docs/installation.html @@ -0,0 +1,37 @@ +git clone https://github.com/buession/buession-security
+cd buession-security/buession-security-parent && mvn clean install
+
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-xxx</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+compile group: 'com.buession.security', name: 'buession-security-xxx', version: 'x.x.x'
+
+其中,artifactId 中的 xxx 表示对应的子模块;version 中的 x.x.x 代表版本号,根据需要使用特定版本,建议使用 maven 仓库中已构建好的最新版本的包。
+基于 Pac4j、Shiro 二次封装,集成 Spring Security,提供极验、阿里云、腾讯云行为验证码 SDK,封装了数据脱敏和多种密码加密方式工具类库的一款安全框架。
+未来将会提供更多的常用加密算法,如:RSA 等等... ...
+封装了阿里云、极验、腾讯云行为验证码,实现标准的 SDK。
+您只需,更改一下 CaptchaValidator
、CaptchaClient
实现类的初始化,即可快速完成行为验证码的更换(当然您还需要修改前端 WEB 代码)
未来,我们将会接入更多的行为验证码... ...
+为保证返回给前端的数据的安全性,我们提供了数据脱敏处理的工具类
+XssFilter
,支持 servlet 和 webflux Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+Definitions.
+"License" shall mean the terms and conditions for use, reproduction, +and distribution as defined by Sections 1 through 9 of this document.
+"Licensor" shall mean the copyright owner or entity authorized by +the copyright owner that is granting the License.
+"Legal Entity" shall mean the union of the acting entity and all +other entities that control, are controlled by, or are under common +control with that entity. For the purposes of this definition, +"control" means (i) the power, direct or indirect, to cause the +direction or management of such entity, whether by contract or +otherwise, or (ii) ownership of fifty percent (50%) or more of the +outstanding shares, or (iii) beneficial ownership of such entity.
+"You" (or "Your") shall mean an individual or Legal Entity +exercising permissions granted by this License.
+"Source" form shall mean the preferred form for making modifications, +including but not limited to software source code, documentation +source, and configuration files.
+"Object" form shall mean any form resulting from mechanical +transformation or translation of a Source form, including but +not limited to compiled object code, generated documentation, +and conversions to other media types.
+"Work" shall mean the work of authorship, whether in Source or +Object form, made available under the License, as indicated by a +copyright notice that is included in or attached to the work +(an example is provided in the Appendix below).
+"Derivative Works" shall mean any work, whether in Source or Object +form, that is based on (or derived from) the Work and for which the +editorial revisions, annotations, elaborations, or other modifications +represent, as a whole, an original work of authorship. For the purposes +of this License, Derivative Works shall not include works that remain +separable from, or merely link (or bind by name) to the interfaces of, +the Work and Derivative Works thereof.
+"Contribution" shall mean any work of authorship, including +the original version of the Work and any modifications or additions +to that Work or Derivative Works thereof, that is intentionally +submitted to Licensor for inclusion in the Work by the copyright owner +or by an individual or Legal Entity authorized to submit on behalf of +the copyright owner. For the purposes of this definition, "submitted" +means any form of electronic, verbal, or written communication sent +to the Licensor or its representatives, including but not limited to +communication on electronic mailing lists, source code control systems, +and issue tracking systems that are managed by, or on behalf of, the +Licensor for the purpose of discussing and improving the Work, but +excluding communication that is conspicuously marked or otherwise +designated in writing by the copyright owner as "Not a Contribution."
+"Contributor" shall mean Licensor and any individual or Legal Entity +on behalf of whom a Contribution has been received by Licensor and +subsequently incorporated within the Work.
+Grant of Copyright License. Subject to the terms and conditions of +this License, each Contributor hereby grants to You a perpetual, +worldwide, non-exclusive, no-charge, royalty-free, irrevocable +copyright license to reproduce, prepare Derivative Works of, +publicly display, publicly perform, sublicense, and distribute the +Work and such Derivative Works in Source or Object form.
+Grant of Patent License. Subject to the terms and conditions of +this License, each Contributor hereby grants to You a perpetual, +worldwide, non-exclusive, no-charge, royalty-free, irrevocable +(except as stated in this section) patent license to make, have made, +use, offer to sell, sell, import, and otherwise transfer the Work, +where such license applies only to those patent claims licensable +by such Contributor that are necessarily infringed by their +Contribution(s) alone or by combination of their Contribution(s) +with the Work to which such Contribution(s) was submitted. If You +institute patent litigation against any entity (including a +cross-claim or counterclaim in a lawsuit) alleging that the Work +or a Contribution incorporated within the Work constitutes direct +or contributory patent infringement, then any patent licenses +granted to You under this License for that Work shall terminate +as of the date such litigation is filed.
+Redistribution. You may reproduce and distribute copies of the +Work or Derivative Works thereof in any medium, with or without +modifications, and in Source or Object form, provided that You +meet the following conditions:
+(a) You must give any other recipients of the Work or +Derivative Works a copy of this License; and
+(b) You must cause any modified files to carry prominent notices +stating that You changed the files; and
+(c) You must retain, in the Source form of any Derivative Works +that You distribute, all copyright, patent, trademark, and +attribution notices from the Source form of the Work, +excluding those notices that do not pertain to any part of +the Derivative Works; and
+(d) If the Work includes a "NOTICE" text file as part of its +distribution, then any Derivative Works that You distribute must +include a readable copy of the attribution notices contained +within such NOTICE file, excluding those notices that do not +pertain to any part of the Derivative Works, in at least one +of the following places: within a NOTICE text file distributed +as part of the Derivative Works; within the Source form or +documentation, if provided along with the Derivative Works; or, +within a display generated by the Derivative Works, if and +wherever such third-party notices normally appear. The contents +of the NOTICE file are for informational purposes only and +do not modify the License. You may add Your own attribution +notices within Derivative Works that You distribute, alongside +or as an addendum to the NOTICE text from the Work, provided +that such additional attribution notices cannot be construed +as modifying the License.
+You may add Your own copyright statement to Your modifications and +may provide additional or different license terms and conditions +for use, reproduction, or distribution of Your modifications, or +for any such Derivative Works as a whole, provided Your use, +reproduction, and distribution of the Work otherwise complies with +the conditions stated in this License.
+Submission of Contributions. Unless You explicitly state otherwise, +any Contribution intentionally submitted for inclusion in the Work +by You to the Licensor shall be under the terms and conditions of +this License, without any additional terms or conditions. +Notwithstanding the above, nothing herein shall supersede or modify +the terms of any separate license agreement you may have executed +with Licensor regarding such Contributions.
+Trademarks. This License does not grant permission to use the trade +names, trademarks, service marks, or product names of the Licensor, +except as required for reasonable and customary use in describing the +origin of the Work and reproducing the content of the NOTICE file.
+Disclaimer of Warranty. Unless required by applicable law or +agreed to in writing, Licensor provides the Work (and each +Contributor provides its Contributions) on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or +implied, including, without limitation, any warranties or conditions +of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A +PARTICULAR PURPOSE. You are solely responsible for determining the +appropriateness of using or redistributing the Work and assume any +risks associated with Your exercise of permissions under this License.
+Limitation of Liability. In no event and under no legal theory, +whether in tort (including negligence), contract, or otherwise, +unless required by applicable law (such as deliberate and grossly +negligent acts) or agreed to in writing, shall any Contributor be +liable to You for damages, including any direct, indirect, special, +incidental, or consequential damages of any character arising as a +result of this License or out of the use or inability to use the +Work (including but not limited to damages for loss of goodwill, +work stoppage, computer failure or malfunction, or any and all +other commercial damages or losses), even if such Contributor +has been advised of the possibility of such damages.
+Accepting Warranty or Additional Liability. While redistributing +the Work or Derivative Works thereof, You may choose to offer, +and charge a fee for, acceptance of support, warranty, indemnity, +or other liability obligations and/or rights consistent with this +License. However, in accepting such obligations, You may act only +on Your own behalf and on Your sole responsibility, not on behalf +of any other Contributor, and only if You agree to indemnify, +defend, and hold each Contributor harmless for any liability +incurred by, or claims asserted against, such Contributor by reason +of your accepting any such warranty or additional liability.
+END OF TERMS AND CONDITIONS
+APPENDIX: How to apply the Apache License to your work.
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License.
+++TIP
+++官方指南假设您已了解"JAVA"方面的相关知识,并且对安全相关的知识有一定认知。
+
Buession Security 是一款安全方面的框架,实现了当前流行的行为验证码、加解密、数据脱敏、集成 pac4j 和 shiro、集成 spring security,提供浏览器相关的安全响应头。
+您对 Buession Security 大致了解后,您接下来可以做以下事情:
+ +JDK 8+
+构建工具 | +版本 | +
---|---|
Maven | +3.5+ | +
Gradle | +6.x+,推荐 6.3 及以上版本 | +
支持 servlet 3.1+,推荐使用 servlet 4.0 及以上版本。
+该项目基于 GNU 版风格定义项目版本,即:主版本号.子版本号.修正版本号。
+当引用的三方包,我们保证尽大可能兼容。但对于 springframework、springboot、springcloud、springsecurity、springdata 等 spring 家族组件,以及 servlet 兼容对应的主版本。
+随着互联网的发展,对应用的安全要求越来越高,在安全的前提下,也需要更加注重用户体验。行为式验证码的诞生,避免了用户去读懂扭曲的图片文字,且行为式验证码背景图片采用多种图像加密技术,采用多种字体,且添加了很多随机效果,能有效防止 OCR 文字识别和暴力破解。
+buession-security-captcha
目前集成了极验行为验证第三代和第四代、阿里云验证码、腾讯云验证码,屏蔽了各行为验证厂商的调用细节。后续会根据实际情况,接入更多厂商的行为验证码,欢迎各位大神可以提供其它厂商的 key 用于开发测试。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-captcha</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+我们通过实现接口 com.buession.security.captcha.core.RequestData
定义不同厂商行为验证码需要的请求参数。
import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunCaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new AliYunCaptchaClient("Your accessKeyId", "Your accessKeySecret", "Your appKey", httpClient);
+
+RequestData request = new AliYunRequestData();
+request.setToken("token");
+request.setSig("sig");
+request.setSessionId("session id");
+request.setScene("ecene");
+request.setRemoteIp("User client ip");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.geetest.GeetestCaptchaClient;
+import com.buession.security.captcha.geetest.api.v4.GeetestV4RequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new GeetestCaptchaClient("Your appId", "Your secretKey", "version", httpClient);
+
+RequestData request = new GeetestV4RequestData();
+request.setLotNumber("lot number");
+request.setCaptchaOutput("captcha Output");
+request.setPassToken("pass token");
+request.setGenTime("gen time");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.tencent.TencentCaptchaClient;
+import com.buession.security.captcha.tencent.TencentRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new TencentCaptchaClient("Your secretId", "Your secretKey", httpClient);
+
+RequestData request = new TencentRequestData();
+request.setRandstr("rand str");
+request.setTicket("ticket");
+request.setUserIp("User client ip");
+captchaClient.validate(request);
+
+当然,在您的应用中您可不必这么麻烦的使用,我们已经为您封装好了前端提交参数到 RequestData
的转换,您可不必这么麻烦的一个一个的去设置参数值。
在您的 controller 中您可以这么用。
+import com.buession.lang.Status;
+import com.buession.web.mvc.Response;
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliyunParameter;
+import com.buession.security.captcha.validator.servlet.ServletAliYunCaptchaValidator;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping(path = "/captcha")
+public class CaptchamentController {
+
+ @Autowired
+ private CaptchaClient captchaClient;
+
+ @RequestMapping(path = "/validate", method = RequestMethod.GET)
+ public Status validate(HttpServletRequest request){
+ ServletAliYunCaptchaValidator captchaValidator = new ServletAliYunCaptchaValidator(captchaClient, new AliyunParameter());
+ return captchaValidator.validate(request);
+ }
+
+}
+
+以上是基于 servlet 的一个简单实例,buession-security-captcha
基于上述模式也可以用于 webflux 环境。CaptchaValidator
的每个最终实现,均通过构造函数设置 com.buession.security.captcha.CaptchaClient
和 com.buession.security.captcha.core.Parameter
。通过 com.buession.security.captcha.core.Parameter
的实现配置,用户提交的参数名称,也就是说,您可以自定义行为验证码前端提交到后端的参数名称,每一个 com.buession.security.captcha.core.Parameter
均设置了默认值。
本文档用于说明 com.buession.security.captcha.core.Parameter
和官方参数的对应关系。
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
sessionId | +SessionId | +sessionId | +会话 ID | +
sig | +Sig | +sig | +签名串 | +
token | +Token | +token | +请求唯一标识 | +
scene | +Scene | +scene | +场景标识 | +
第三代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
challenge | +challenge | +challenge | +流水号 | +
seccode | +seccode | +seccode | +核心校验数据 | +
validate | +validate | +validate | +核心校验数据 | +
userId | +user_id | +user_id | +user_id作为终端用户的唯一标识,确定用户的唯一性 | +
clientType | +client_type | +client_type | +客户端类型 | +
第四代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
lotNumber | +lot_number | +lot_number | +验证流水号 | +
captchaOutput | +captcha_output | +captcha_output | +验证输出信息 | +
passToken | +pass_token | +pass_token | +验证通过标识 | +
genTime | +gen_time | +gen_time | +验证通过时间戳 | +
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
randStr | +Randstr | +Randstr | +客户端验证回调的随机串 | +
ticket | +Ticket | +Ticket | +票据 | +
该类库为核心包,目前仅实现了 SameSite
枚举的定义和数据脱敏工具 Desensitization
。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-core</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+数据脱敏:
+import com.buession.security.core.Desensitization;
+
+String str = Desensitization.encode("13800138000", 3); // 1380***8000
+
+Buession Security API 包含以下目录:
+模块 | +使用帮助 | +手册 | +
---|---|---|
buession-security-core | +使用帮助 | +API 手册 | +
buession-security-captcha | +使用帮助 | +API 手册 | +
buession-security-mcrypt | +使用帮助 | +API 手册 | +
buession-security-pac4j | +使用帮助 | +API 手册 | +
buession-security-shiro | +使用帮助 | +API 手册 | +
buession-security-spring | +使用帮助 | +API 手册 | +
buession-security-web | +使用帮助 | +API 手册 | +
数据加密、解密类库,支持:MD5、SHA1、SHA256、SHA512、BASE64 以及 Discuz 加密算法等等。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-mcrypt</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+随着互联网的发展,对应用的安全要求越来越高,需要通过各种不同的加密算法,对铭感数据加密,包括可逆的(如:手机号码、身份证号码)和不可逆的(如:密码)。buession-security-mcrypt
基于此背景封装了大量的加解密、散列/哈希等算法,尚未囊括市面上主流的加密算法,会在后续的版本中继续添加。
char[]
、byte[]
时,将会 new String
创建一个 String
对象,其它对象会调用 toString()
方法转换为字符串后,再进行加密CharSequence
进行解密import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt();
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt();
+mcrypt.encode(new Integer(100));
+
+您可以指定加密 key。
+import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt("UTF-8", "key");
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt("UTF-8", "key");
+mcrypt.encode(new Integer(100));
+
+对 pac4j 二次封装,集成了 pac4j 和 buji-pac4j。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-pac4j</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+apache shiro 二次封装,增加 redis 对 session 和 cache 的管理。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-shiro</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+集成 spring security 框架。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-spring</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+该模块无功能,仅仅整合把 spring security 的依赖整合进来了。
+web 安全相关的功能封装,支持 servlet 和 reactive,增加 XSS 过滤器。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-web</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+您可以通过 ServletWebSecurityConfigurerAdapterConfiguration
、ReactiveWebSecurityConfigurerAdapterConfiguration
来控制 HTTP 安全相关响应头,是 spring security 默认参配置的修改。
随着互联网的发展,对应用的安全要求越来越高,在安全的前提下,也需要更加注重用户体验。行为式验证码的诞生,避免了用户去读懂扭曲的图片文字,且行为式验证码背景图片采用多种图像加密技术,采用多种字体,且添加了很多随机效果,能有效防止 OCR 文字识别和暴力破解。
+buession-security-captcha
目前集成了极验行为验证第三代和第四代、阿里云验证码、腾讯云验证码,屏蔽了各行为验证厂商的调用细节。后续会根据实际情况,接入更多厂商的行为验证码,欢迎各位大神可以提供其它厂商的 key 用于开发测试。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-captcha</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+我们通过实现接口 com.buession.security.captcha.core.RequestData
定义不同厂商行为验证码需要的请求参数。
import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunCaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new AliYunCaptchaClient("Your accessKeyId", "Your accessKeySecret", "Your appKey", httpClient);
+
+RequestData request = new AliYunRequestData();
+request.setToken("token");
+request.setSig("sig");
+request.setSessionId("session id");
+request.setScene("ecene");
+request.setRemoteIp("User client ip");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.geetest.GeetestCaptchaClient;
+import com.buession.security.captcha.geetest.api.v4.GeetestV4RequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new GeetestCaptchaClient("Your appId", "Your secretKey", "version", httpClient);
+
+RequestData request = new GeetestV4RequestData();
+request.setLotNumber("lot number");
+request.setCaptchaOutput("captcha Output");
+request.setPassToken("pass token");
+request.setGenTime("gen time");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.tencent.TencentCaptchaClient;
+import com.buession.security.captcha.tencent.TencentRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new TencentCaptchaClient("Your secretId", "Your secretKey", httpClient);
+
+RequestData request = new TencentRequestData();
+request.setRandstr("rand str");
+request.setTicket("ticket");
+request.setUserIp("User client ip");
+captchaClient.validate(request);
+
+当然,在您的应用中您可不必这么麻烦的使用,我们已经为您封装好了前端提交参数到 RequestData
的转换,您可不必这么麻烦的一个一个的去设置参数值。
在您的 controller 中您可以这么用。
+import com.buession.lang.Status;
+import com.buession.web.mvc.Response;
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliyunParameter;
+import com.buession.security.captcha.validator.servlet.ServletAliYunCaptchaValidator;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping(path = "/captcha")
+public class CaptchamentController {
+
+ @Autowired
+ private CaptchaClient captchaClient;
+
+ @RequestMapping(path = "/validate", method = RequestMethod.GET)
+ public Status validate(HttpServletRequest request){
+ ServletAliYunCaptchaValidator captchaValidator = new ServletAliYunCaptchaValidator(captchaClient, new AliyunParameter());
+ return captchaValidator.validate(request);
+ }
+
+}
+
+以上是基于 servlet 的一个简单实例,buession-security-captcha
基于上述模式也可以用于 webflux 环境。CaptchaValidator
的每个最终实现,均通过构造函数设置 com.buession.security.captcha.CaptchaClient
和 com.buession.security.captcha.core.Parameter
。通过 com.buession.security.captcha.core.Parameter
的实现配置,用户提交的参数名称,也就是说,您可以自定义行为验证码前端提交到后端的参数名称,每一个 com.buession.security.captcha.core.Parameter
均设置了默认值。
本文档用于说明 com.buession.security.captcha.core.Parameter
和官方参数的对应关系。
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
sessionId | +SessionId | +sessionId | +会话 ID | +
sig | +Sig | +sig | +签名串 | +
token | +Token | +token | +请求唯一标识 | +
scene | +Scene | +scene | +场景标识 | +
第三代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
challenge | +challenge | +challenge | +流水号 | +
seccode | +seccode | +seccode | +核心校验数据 | +
validate | +validate | +validate | +核心校验数据 | +
userId | +user_id | +user_id | +user_id作为终端用户的唯一标识,确定用户的唯一性 | +
clientType | +client_type | +client_type | +客户端类型 | +
第四代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
lotNumber | +lot_number | +lot_number | +验证流水号 | +
captchaOutput | +captcha_output | +captcha_output | +验证输出信息 | +
passToken | +pass_token | +pass_token | +验证通过标识 | +
genTime | +gen_time | +gen_time | +验证通过时间戳 | +
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
randStr | +Randstr | +Randstr | +客户端验证回调的随机串 | +
ticket | +Ticket | +Ticket | +票据 | +
该类库为核心包,目前仅实现了 SameSite
枚举的定义和数据脱敏工具 Desensitization
。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-core</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+数据脱敏:
+import com.buession.security.core.Desensitization;
+
+String str = Desensitization.encode("13800138000", 3); // 1380***8000
+
+Buession Security API 包含以下目录:
+模块 | +使用帮助 | +手册 | +
---|---|---|
buession-security-core | +使用帮助 | +API 手册 | +
buession-security-captcha | +使用帮助 | +API 手册 | +
buession-security-mcrypt | +使用帮助 | +API 手册 | +
buession-security-pac4j | +使用帮助 | +API 手册 | +
buession-security-shiro | +使用帮助 | +API 手册 | +
buession-security-spring | +使用帮助 | +API 手册 | +
buession-security-web | +使用帮助 | +API 手册 | +
数据加密、解密类库,支持:MD5、SHA1、SHA256、SHA512、BASE64 以及 Discuz 加密算法等等。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-mcrypt</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+随着互联网的发展,对应用的安全要求越来越高,需要通过各种不同的加密算法,对铭感数据加密,包括可逆的(如:手机号码、身份证号码)和不可逆的(如:密码)。buession-security-mcrypt
基于此背景封装了大量的加解密、散列/哈希等算法,尚未囊括市面上主流的加密算法,会在后续的版本中继续添加。
char[]
、byte[]
时,将会 new String
创建一个 String
对象,其它对象会调用 toString()
方法转换为字符串后,再进行加密CharSequence
进行解密import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt();
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt();
+mcrypt.encode(new Integer(100));
+
+您可以指定加密 key。
+import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt("UTF-8", "key");
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt("UTF-8", "key");
+mcrypt.encode(new Integer(100));
+
+pac4j 原生的 AJAX 请求解析器 AjaxRequestResolver
的实现 DefaultAjaxRequestResolver
,以 XML 的形式响应 pac4j 重定向。
<?xml version='1.0' encoding='UTF-8'?>
+<partial-response>
+ <redirect url="redirect_url"></redirect>
+</partial-response>
+
+此种,场景增加了响应数据的大小和前端 Ajax 解析的成本和难度。为此,我们扩展了 JsonAjaxRequestResolver
和 TextAjaxRequestResolver
以 JSON 和文本的形式响应重定向地址,以简化前端 JavaScript 的解析成本和难度。
{"redirect": {"url": "redirect_url"}}
+
+redirect_url
+
+我们通过注解的形式封装了获取当前登录用户信息的 API。
+注解 | +作用域 | +说明 | +
---|---|---|
@Principal | +方法参数 | +获取当前登录用户信息,并可以以任何实体类、Map 对象的形式返回 | +
@Controller
+@RequestMapping(path = "/test")
+public class TestController {
+
+ @RequestMapping(path = "/principal1")
+ @ResponseBody
+ public User principal1(@Principal User user, ServerHttpResponse response){
+ return user;
+ }
+
+ @RequestMapping(path = "/principal2")
+ @ResponseBody
+ public Map<String, Object> principal2(@Principal Map<String, Object> user, ServerHttpResponse response){
+ return user;
+ }
+
+}
+
+对 pac4j 二次封装,集成了 pac4j 和 buji-pac4j。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-pac4j</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+apache shiro 二次封装,增加 redis 对 session 和 cache 的管理。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-shiro</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+集成 spring security 框架。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-spring</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+该模块无功能,仅仅整合把 spring security 的依赖整合进来了。
+web 安全相关的功能封装,支持 servlet 和 reactive,增加 XSS 过滤器。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-web</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+您可以通过 ServletWebSecurityConfigurerAdapterConfiguration
、ReactiveWebSecurityConfigurerAdapterConfiguration
来控制 HTTP 安全相关响应头,是 spring security 默认参配置的修改。
随着互联网的发展,对应用的安全要求越来越高,在安全的前提下,也需要更加注重用户体验。行为式验证码的诞生,避免了用户去读懂扭曲的图片文字,且行为式验证码背景图片采用多种图像加密技术,采用多种字体,且添加了很多随机效果,能有效防止 OCR 文字识别和暴力破解。
+buession-security-captcha
目前集成了极验行为验证第三代和第四代、阿里云验证码、腾讯云验证码,屏蔽了各行为验证厂商的调用细节。后续会根据实际情况,接入更多厂商的行为验证码,欢迎各位大神可以提供其它厂商的 key 用于开发测试。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-captcha</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+我们通过实现接口 com.buession.security.captcha.core.RequestData
定义不同厂商行为验证码需要的请求参数。
import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunCaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new AliYunCaptchaClient("Your accessKeyId", "Your accessKeySecret", "Your appKey", httpClient);
+
+RequestData request = new AliYunRequestData();
+request.setToken("token");
+request.setSig("sig");
+request.setSessionId("session id");
+request.setScene("ecene");
+request.setRemoteIp("User client ip");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.geetest.GeetestCaptchaClient;
+import com.buession.security.captcha.geetest.api.v4.GeetestV4RequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new GeetestCaptchaClient("Your appId", "Your secretKey", "version", httpClient);
+
+RequestData request = new GeetestV4RequestData();
+request.setLotNumber("lot number");
+request.setCaptchaOutput("captcha Output");
+request.setPassToken("pass token");
+request.setGenTime("gen time");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.tencent.TencentCaptchaClient;
+import com.buession.security.captcha.tencent.TencentRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new TencentCaptchaClient("Your secretId", "Your secretKey", httpClient);
+
+RequestData request = new TencentRequestData();
+request.setRandstr("rand str");
+request.setTicket("ticket");
+request.setUserIp("User client ip");
+captchaClient.validate(request);
+
+当然,在您的应用中您可不必这么麻烦的使用,我们已经为您封装好了前端提交参数到 RequestData
的转换,您可不必这么麻烦的一个一个的去设置参数值。
在您的 controller 中您可以这么用。
+import com.buession.lang.Status;
+import com.buession.web.mvc.Response;
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliyunParameter;
+import com.buession.security.captcha.validator.servlet.ServletAliYunCaptchaValidator;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping(path = "/captcha")
+public class CaptchamentController {
+
+ @Autowired
+ private CaptchaClient captchaClient;
+
+ @RequestMapping(path = "/validate", method = RequestMethod.GET)
+ public Status validate(HttpServletRequest request){
+ ServletAliYunCaptchaValidator captchaValidator = new ServletAliYunCaptchaValidator(captchaClient, new AliyunParameter());
+ return captchaValidator.validate(request);
+ }
+
+}
+
+以上是基于 servlet 的一个简单实例,buession-security-captcha
基于上述模式也可以用于 webflux 环境。CaptchaValidator
的每个最终实现,均通过构造函数设置 com.buession.security.captcha.CaptchaClient
和 com.buession.security.captcha.core.Parameter
。通过 com.buession.security.captcha.core.Parameter
的实现配置,用户提交的参数名称,也就是说,您可以自定义行为验证码前端提交到后端的参数名称,每一个 com.buession.security.captcha.core.Parameter
均设置了默认值。
本文档用于说明 com.buession.security.captcha.core.Parameter
和官方参数的对应关系。
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
sessionId | +SessionId | +sessionId | +会话 ID | +
sig | +Sig | +sig | +签名串 | +
token | +Token | +token | +请求唯一标识 | +
scene | +Scene | +scene | +场景标识 | +
第三代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
challenge | +challenge | +challenge | +流水号 | +
seccode | +seccode | +seccode | +核心校验数据 | +
validate | +validate | +validate | +核心校验数据 | +
userId | +user_id | +user_id | +user_id作为终端用户的唯一标识,确定用户的唯一性 | +
clientType | +client_type | +client_type | +客户端类型 | +
第四代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
lotNumber | +lot_number | +lot_number | +验证流水号 | +
captchaOutput | +captcha_output | +captcha_output | +验证输出信息 | +
passToken | +pass_token | +pass_token | +验证通过标识 | +
genTime | +gen_time | +gen_time | +验证通过时间戳 | +
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
randStr | +Randstr | +Randstr | +客户端验证回调的随机串 | +
ticket | +Ticket | +Ticket | +票据 | +
该类库为核心包,目前仅实现了 SameSite
枚举的定义和数据脱敏工具 Desensitization
。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-core</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+数据脱敏:
+import com.buession.security.core.Desensitization;
+
+String str = Desensitization.encode("13800138000", 3); // 1380***8000
+
+Buession Security API 包含以下目录:
+模块 | +使用帮助 | +手册 | +
---|---|---|
buession-security-core | +使用帮助 | +API 手册 | +
buession-security-captcha | +使用帮助 | +API 手册 | +
buession-security-mcrypt | +使用帮助 | +API 手册 | +
buession-security-pac4j | +使用帮助 | +API 手册 | +
buession-security-shiro | +使用帮助 | +API 手册 | +
buession-security-spring | +使用帮助 | +API 手册 | +
buession-security-web | +使用帮助 | +API 手册 | +
数据加密、解密类库,支持:MD5、SHA1、SHA256、SHA512、BASE64 以及 Discuz 加密算法等等。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-mcrypt</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+随着互联网的发展,对应用的安全要求越来越高,需要通过各种不同的加密算法,对铭感数据加密,包括可逆的(如:手机号码、身份证号码)和不可逆的(如:密码)。buession-security-mcrypt
基于此背景封装了大量的加解密、散列/哈希等算法,尚未囊括市面上主流的加密算法,会在后续的版本中继续添加。
char[]
、byte[]
时,将会 new String
创建一个 String
对象,其它对象会调用 toString()
方法转换为字符串后,再进行加密CharSequence
进行解密import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt();
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt();
+mcrypt.encode(new Integer(100));
+
+您可以指定加密 key。
+import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt("UTF-8", "key");
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt("UTF-8", "key");
+mcrypt.encode(new Integer(100));
+
+pac4j 原生的 AJAX 请求解析器 AjaxRequestResolver
的实现 DefaultAjaxRequestResolver
,以 XML 的形式响应 pac4j 重定向。
<?xml version='1.0' encoding='UTF-8'?>
+<partial-response>
+ <redirect url="redirect_url"></redirect>
+</partial-response>
+
+此种,场景增加了响应数据的大小和前端 Ajax 解析的成本和难度。为此,我们扩展了 JsonAjaxRequestResolver
和 TextAjaxRequestResolver
以 JSON 和文本的形式响应重定向地址,以简化前端 JavaScript 的解析成本和难度。
{"redirect": {"url": "redirect_url"}}
+
+redirect_url
+
+我们通过注解的形式封装了获取当前登录用户信息的 API。
+注解 | +作用域 | +说明 | +
---|---|---|
@Principal | +方法参数 | +获取当前登录用户信息,并可以以任何实体类、Map 对象的形式返回 | +
@Controller
+@RequestMapping(path = "/test")
+public class TestController {
+
+ @RequestMapping(path = "/principal1")
+ @ResponseBody
+ public User principal1(@Principal User user, ServerHttpResponse response){
+ return user;
+ }
+
+ @RequestMapping(path = "/principal2")
+ @ResponseBody
+ public Map<String, Object> principal2(@Principal Map<String, Object> user, ServerHttpResponse response){
+ return user;
+ }
+
+}
+
+对 pac4j 二次封装,集成了 pac4j 和 buji-pac4j。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-pac4j</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+apache shiro 二次封装,增加 redis 对 session 和 cache 的管理。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-shiro</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+集成 spring security 框架。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-spring</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+该模块无功能,仅仅整合把 spring security 的依赖整合进来了。
+web 安全相关的功能封装,支持 servlet 和 reactive,增加 XSS 过滤器。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-web</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+您可以通过 ServletWebSecurityConfigurerAdapterConfiguration
、ReactiveWebSecurityConfigurerAdapterConfiguration
来控制 HTTP 安全相关响应头,是 spring security 默认参配置的修改。
随着互联网的发展,对应用的安全要求越来越高,在安全的前提下,也需要更加注重用户体验。行为式验证码的诞生,避免了用户去读懂扭曲的图片文字,且行为式验证码背景图片采用多种图像加密技术,采用多种字体,且添加了很多随机效果,能有效防止 OCR 文字识别和暴力破解。
+buession-security-captcha
目前集成了极验行为验证第三代和第四代、阿里云验证码、腾讯云验证码,屏蔽了各行为验证厂商的调用细节。后续会根据实际情况,接入更多厂商的行为验证码,欢迎各位大神可以提供其它厂商的 key 用于开发测试。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-captcha</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+我们通过实现接口 com.buession.security.captcha.core.RequestData
定义不同厂商行为验证码需要的请求参数。
import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunCaptchaClient;
+import com.buession.security.captcha.aliyun.AliYunRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new AliYunCaptchaClient("Your accessKeyId", "Your accessKeySecret", "Your appKey", httpClient);
+
+RequestData request = new AliYunRequestData();
+request.setToken("token");
+request.setSig("sig");
+request.setSessionId("session id");
+request.setScene("ecene");
+request.setRemoteIp("User client ip");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.geetest.GeetestCaptchaClient;
+import com.buession.security.captcha.geetest.api.v4.GeetestV4RequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new GeetestCaptchaClient("Your appId", "Your secretKey", "version", httpClient);
+
+RequestData request = new GeetestV4RequestData();
+request.setLotNumber("lot number");
+request.setCaptchaOutput("captcha Output");
+request.setPassToken("pass token");
+request.setGenTime("gen time");
+captchaClient.validate(request);
+
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.tencent.TencentCaptchaClient;
+import com.buession.security.captcha.tencent.TencentRequestData;
+import com.buession.security.captcha.core.RequestData;
+import com.buession.httpclient.HttpClient;
+
+HttpClient httpClient;
+CaptchaClient captchaClient = new TencentCaptchaClient("Your secretId", "Your secretKey", httpClient);
+
+RequestData request = new TencentRequestData();
+request.setRandstr("rand str");
+request.setTicket("ticket");
+request.setUserIp("User client ip");
+captchaClient.validate(request);
+
+当然,在您的应用中您可不必这么麻烦的使用,我们已经为您封装好了前端提交参数到 RequestData
的转换,您可不必这么麻烦的一个一个的去设置参数值。
在您的 controller 中您可以这么用。
+import com.buession.lang.Status;
+import com.buession.web.mvc.Response;
+import com.buession.security.captcha.CaptchaClient;
+import com.buession.security.captcha.aliyun.AliyunParameter;
+import com.buession.security.captcha.validator.servlet.ServletAliYunCaptchaValidator;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping(path = "/captcha")
+public class CaptchamentController {
+
+ @Autowired
+ private CaptchaClient captchaClient;
+
+ @RequestMapping(path = "/validate", method = RequestMethod.GET)
+ public Status validate(HttpServletRequest request){
+ ServletAliYunCaptchaValidator captchaValidator = new ServletAliYunCaptchaValidator(captchaClient, new AliyunParameter());
+ return captchaValidator.validate(request);
+ }
+
+}
+
+以上是基于 servlet 的一个简单实例,buession-security-captcha
基于上述模式也可以用于 webflux 环境。CaptchaValidator
的每个最终实现,均通过构造函数设置 com.buession.security.captcha.CaptchaClient
和 com.buession.security.captcha.core.Parameter
。通过 com.buession.security.captcha.core.Parameter
的实现配置,用户提交的参数名称,也就是说,您可以自定义行为验证码前端提交到后端的参数名称,每一个 com.buession.security.captcha.core.Parameter
均设置了默认值。
本文档用于说明 com.buession.security.captcha.core.Parameter
和官方参数的对应关系。
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
sessionId | +SessionId | +sessionId | +会话 ID | +
sig | +Sig | +sig | +签名串 | +
token | +Token | +token | +请求唯一标识 | +
scene | +Scene | +scene | +场景标识 | +
第三代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
challenge | +challenge | +challenge | +流水号 | +
seccode | +seccode | +seccode | +核心校验数据 | +
validate | +validate | +validate | +核心校验数据 | +
userId | +user_id | +user_id | +user_id作为终端用户的唯一标识,确定用户的唯一性 | +
clientType | +client_type | +client_type | +客户端类型 | +
第四代
+参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
lotNumber | +lot_number | +lot_number | +验证流水号 | +
captchaOutput | +captcha_output | +captcha_output | +验证输出信息 | +
passToken | +pass_token | +pass_token | +验证通过标识 | +
genTime | +gen_time | +gen_time | +验证通过时间戳 | +
参数名 | +官方参数名 | +默认值 | +说明 | +
---|---|---|---|
randStr | +Randstr | +Randstr | +客户端验证回调的随机串 | +
ticket | +Ticket | +Ticket | +票据 | +
该类库为核心包,目前仅实现了 SameSite
枚举的定义和数据脱敏工具 Desensitization
。
<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-core</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+数据脱敏:
+import com.buession.security.core.Desensitization;
+
+String str = Desensitization.encode("13800138000", 3); // 1380***8000
+
+数据加密、解密类库,支持:MD5、SHA1、SHA256、SHA512、BASE64 以及 Discuz 加密算法等等接口。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-crypto</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+随着互联网的发展,对应用的安全要求越来越高,需要通过各种不同的加密算法,对铭感数据加密,包括可逆的(如:手机号码、身份证号码)和不可逆的(如:密码)。buession-security-crypto
基于此背景封装了大量的加解密、散列/哈希等算法,尚未囊括市面上主流的加密算法,会在后续的版本中继续添加。
Buession Security API 包含以下目录:
+模块 | +使用帮助 | +手册 | +
---|---|---|
buession-security-core | +使用帮助 | +API 手册 | +
buession-security-captcha | +使用帮助 | +API 手册 | +
buession-security-crypto | +使用帮助 | +API 手册 | +
buession-security-mcrypt | +使用帮助 | +API 手册 | +
buession-security-pac4j | +使用帮助 | +API 手册 | +
buession-security-shiro | +使用帮助 | +API 手册 | +
buession-security-spring | +使用帮助 | +API 手册 | +
buession-security-web | +使用帮助 | +API 手册 | +
数据加密、解密类库,支持:MD5、SHA1、SHA256、SHA512、BASE64 以及 Discuz 加密算法等等。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-mcrypt</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+随着互联网的发展,对应用的安全要求越来越高,需要通过各种不同的加密算法,对铭感数据加密,包括可逆的(如:手机号码、身份证号码)和不可逆的(如:密码)。buession-security-mcrypt
基于此背景封装了大量的加解密、散列/哈希等算法,尚未囊括市面上主流的加密算法,会在后续的版本中继续添加。
char[]
、byte[]
时,将会 new String
创建一个 String
对象,其它对象会调用 toString()
方法转换为字符串后,再进行加密CharSequence
进行解密import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt();
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt();
+mcrypt.encode(new Integer(100));
+
+您可以指定加密 key。
+import com.buession.security.mcrypt.Sha1Mcrypt;
+
+Sha1Mcrypt mcrypt = new Sha1Mcrypt("UTF-8", "key");
+mcrypt.encode("Abc");
+
+import com.buession.security.mcrypt.HmacSha512Mcrypt;
+
+HmacSha512Mcrypt mcrypt = new HmacSha512Mcrypt("UTF-8", "key");
+mcrypt.encode(new Integer(100));
+
+pac4j 原生的 AJAX 请求解析器 AjaxRequestResolver
的实现 DefaultAjaxRequestResolver
,以 XML 的形式响应 pac4j 重定向。
<?xml version='1.0' encoding='UTF-8'?>
+<partial-response>
+ <redirect url="redirect_url"></redirect>
+</partial-response>
+
+此种,场景增加了响应数据的大小和前端 Ajax 解析的成本和难度。为此,我们扩展了 JsonAjaxRequestResolver
和 TextAjaxRequestResolver
以 JSON 和文本的形式响应重定向地址,以简化前端 JavaScript 的解析成本和难度。
{"redirect": {"url": "redirect_url"}}
+
+redirect_url
+
+我们通过注解的形式封装了获取当前登录用户信息的 API。
+注解 | +作用域 | +说明 | +
---|---|---|
@Principal | +方法参数 | +获取当前登录用户信息,并可以以任何实体类、Map 对象的形式返回 | +
@Controller
+@RequestMapping(path = "/test")
+public class TestController {
+
+ @RequestMapping(path = "/principal1")
+ @ResponseBody
+ public User principal1(@Principal User user, ServerHttpResponse response){
+ return user;
+ }
+
+ @RequestMapping(path = "/principal2")
+ @ResponseBody
+ public Map<String, Object> principal2(@Principal Map<String, Object> user, ServerHttpResponse response){
+ return user;
+ }
+
+}
+
+对 pac4j 二次封装,集成了 pac4j 和 buji-pac4j。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-pac4j</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+apache shiro 二次封装,增加 redis 对 session 和 cache 的管理。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-shiro</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+集成 spring security 框架。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-spring</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+该模块无功能,仅仅整合把 spring security 的依赖整合进来了。
+web 安全相关的功能封装,支持 servlet 和 reactive,增加 XSS 过滤器。
+<dependency>
+ <groupId>com.buession.security</groupId>
+ <artifactId>buession-security-web</artifactId>
+ <version>x.x.x</version>
+</dependency>
+
+您可以通过 ServletWebSecurityConfigurerAdapterConfiguration
、ReactiveWebSecurityConfigurerAdapterConfiguration
来控制 HTTP 安全相关响应头,是 spring security 默认参配置的修改。