【add】添加用户登录时的等保机制

jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/LoginController.java

@@ -60,7 +60,10 @@ public class LoginController {
 	private BaseCommonService baseCommonService;
 
 	private static final String BASE_CHECK_CODES = "qwertyuiplkjhgfdsazxcvbnmQWERTYUPLKJHGFDSAZXCVBNM1234567890";
-
+	//密码登录错误的次数前缀
+	public static final String RETRY_LOGIN_PREFIX = "login:retryLoginCount_";
+	//密码登录错误的最大限制次数
+	public static final int RETRY_LOGIN_MAX_COUNT = 5;
 	@ApiOperation("登录接口")
 	@RequestMapping(value = "/login", method = RequestMethod.POST)
 	public Result<JSONObject> login(@RequestBody SysLoginModel sysLoginModel){
@@ -98,15 +101,34 @@ public class LoginController {
 		if(!result.isSuccess()) {
 			return result;
 		}
-		
+
+		// 若用户名有效，则查询该账号的登陆失败次数是否符合等保要求
+		int retryCount = 0 ;
+		if ( redisUtil.get(RETRY_LOGIN_PREFIX + username) != null){
+			retryCount = (int) redisUtil.get(RETRY_LOGIN_PREFIX + username);
+		}
+		if (retryCount >= RETRY_LOGIN_MAX_COUNT){
+			result.error500("密码错误次数过多，请稍后重试");
+			return result;
+		}
 		//2. 校验用户名或密码是否正确
 		String userpassword = PasswordUtil.encrypt(username, password, sysUser.getSalt());
 		String syspassword = sysUser.getPassword();
 		if (!syspassword.equals(userpassword)) {
-			result.error500("用户名或密码错误");
+			// 重试登录次数加一
+			retryCount++;
+			if( retryCount == 1){
+				redisUtil.set(RETRY_LOGIN_PREFIX + username,retryCount, 1000 * 60 * 30);
+			}else {
+				redisUtil.set(RETRY_LOGIN_PREFIX + username,retryCount,redisUtil.getExpire(RETRY_LOGIN_PREFIX + username));
+			}
+			String msg = retryCount == RETRY_LOGIN_MAX_COUNT ? "密码错误次数过多，请稍后重试":"用户名或密码错误，剩余可登录次数:"+(RETRY_LOGIN_MAX_COUNT - retryCount);
+			result.error500(msg);
 			return result;
 		}
-				
+		//登录成功，清除错误登录次数
+		redisUtil.del(RETRY_LOGIN_PREFIX + username);
+
 		//用户登录信息
 		userInfo(sysUser, result);
 		//update-begin--Author:wangshuai  Date:20200714  for：登录日志没有记录人员