当登录尝试超过 3 次时，用户无法使用 spring security Rest API 登录？

Question

我在 java 中使用 spring 安全引导。我有一个覆盖此方法 UserDetails lodUserByUsername(String email).

我希望当用户输入错误的电子邮件和密码时提供响应 "Invalid Username and password"

如果他们的电子邮件存在并且他们将输入错误的密码，那么该特定用户的尝试将增加一个并存储到列尝试的数据库中 table。

如果该用户的超出限制超过我想要的响应的 3 个 "Your Username is Blocked"

如果该用户前两次或一次尝试输入错误的密码，则增加唯一的尝试并显示响应 "Your attempt is"+MIN_ATTEMPTS.

如果用户输入了前两次或一次尝试输入错误的密码，然后在他们可以输入正确的用户名和密码之后，则该特定用户的尝试次数设置为 0。

 private static final int MAX_ATTEMPTS = 3;
    int MIN_ATTEMPTS = 0;

 @SneakyThrows
    @Override
    public UserDetails loadUserByUsername(String email) {
        Members members = membersDao.findByEmail(email);
        Set<GrantedAuthority> authorities = new HashSet<>();
        if (members == null) {

            throw new Exception("Invalid username and password");
        } else {
            MIN_ATTEMPTS = members.getAttempts();
            MIN_ATTEMPTS++;
            members.setAttempts(MIN_ATTEMPTS);
            membersDao.save(members);

        }
        if (members.getAttempts() <= MAX_ATTEMPTS) {
            APIResponseBuilder.build(true   , commonMessages.loginSuccess);
            return new User(members.getEmail(), members.getPassword(), authorities);
        } else {
            throw new Exception("You have exceed max +" + MAX_ATTEMPTS + "+limit of login");
        }
    }

Answer 1

我已将以上代码添加到我的身份验证控制器中，问题已解决

1.controller

private static final int MAX_ATTEMPTS = 3;

@PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginMembers loginMembers) throws AuthenticationException, IOException, ServletException {
        Members members = membersDao.findByEmail(loginMembers.getEmail());
        PasswordEncoder passencoder = new BCryptPasswordEncoder();

        if (members == null) {
            //Create Error Message for User
            throw new RuntimeException("Invalid Username and Password");
        }
        if (members.getAttempts() >= MAX_ATTEMPTS) {
            //Create Error Message for User
            throw new RuntimeException("Login Attempt exceeds "+MAX_ATTEMPTS);
        }

        if (passencoder.matches(loginMembers.getPassword(), members.getPassword())) {
            final Authentication authentication = authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(
                            loginMembers.getEmail(),
                            loginMembers.getPassword()
                    )
            );

            SecurityContextHolder.getContext().setAuthentication(authentication);
            final String token = jwtTokenUtil.generateToken(authentication);
            logger.info("You are log in successfully with token");
            return ResponseEntity.ok(new AuthTokenRequest(token));
        } else {
            int attempts = members.getAttempts();
            members.setAttempts(++attempts);
            membersDao.save(members);
            //Create Error Message for User
            throw new RuntimeException("Login attempts "+attempts);
        }
    }

方法

@Override
    public UserDetails loadUserByUsername(String email) {
        Members members = membersDao.findByEmail(email);
        Set<GrantedAuthority> authorities = new HashSet<>();
        try {
            Role role = members.getRoles();
            authorities.add(new SimpleGrantedAuthority(role.getRole()));
        } catch (Exception e) {
            APIResponseBuilder.build(false, e.getMessage(), commonMessages.exception);
        }
        return new User(members.getEmail(), members.getPassword(), authorities);
    }

当登录尝试超过 3 次时，用户无法使用 spring security Rest API 登录？

when login attempt is exceed more than 3 than user cant to login using spring security Rest API?

java

mysql

spring-security

spring-boot

jwt-auth