如何在Java中使用HttpSession跟踪登录尝试？
我有一个无框架的Web应用程序。 我需要使用会话实现一种简单的方法来检查不成功的登录。 如果用户尝试使用错误的用户名/密码组合登录3次，他们将获得20分钟的超时时间，然后再尝试登录。
目前，如果用户成功登录系统，我只会设置用户会话。 但是，似乎我应该在登录失败的情况下获得会话，并以某种方式计算登录尝试。
Login.jsp（简化版）：
CustomerData.java（简化版）：
// See if customer is a valid user String selectQuery = "Select firstName,lastName,email from customer where userName='"+userName+"' and password='"+password+"'"; selectResult = statement.executeQuery(selectQuery); if(selectResult.next()) { // We got a valid user, let's log them in .... HttpSession session = request.getSession(true); session.setAttribute("customer", customer); } else { // this is where I need to get the session id (??), // count the unsuccessful login attempts somehow, //and give them a 20 minutes timeout before they can try logging in again. request.setAttribute("message","Invalid username or password. Please try again!"); }
在进行研究时，我发现各种Java框架都有许多内置的安全function。 我还发现使用会话不是跟踪登录尝试的最佳方式，因为用户可以使用不同的浏览器登录。 但是，我正在为一个永远不会进入任何生产环境的简单Web项目创建此function。 我想知道如何使用Java HTTPSession对象实现此function。
好的，根据我收到的反馈，这是我的完整解决方案。 我发布这个，以防它可能帮助其他类似的问题：
// See if customer is a valid user String selectQuery = "Select firstName,lastName,email from customer where userName='"+userName+"' and password='"+password+"'"; selectResult = statement.executeQuery(selectQuery); if(selectResult.next()) { // We got a valid user, let's log them in Customer customer = new Customer(); customer.setFirstName(selectResult.getString("firstName")); customer.setLastName(selectResult.getString("lastName")); customer.setEmail(selectResult.getString("email")); customer.setUserName(userName); customer.setPassword(password); // establish a user session session.setAttribute("customer", customer); session.setAttribute("firstName", customer.getFristName()); url = "/index.jsp"; selectResult.close(); } else { int loginAttempt; if (session.getAttribute("loginCount") == null) { session.setAttribute("loginCount", 0); loginAttempt = 0; } else { loginAttempt = (Integer) session.getAttribute("loginCount"); } //this is 3 attempt counting from 0,1,2 if (loginAttempt >= 2 ) { long lastAccessedTime = session.getLastAccessedTime(); date = new Date(); long currentTime = date.getTime(); long timeDiff = currentTime - lastAccessedTime; // 20 minutes in milliseconds if (timeDiff >= 1200000) { //invalidate user session, so they can try again session.invalidate(); } else { // Error message session.setAttribute("message","You have exceeded the 3 failed login attempt. Please try loggin in in 20 minutes, or call our customer service center at 1-800 555-1212."); } } else { loginAttempt++; int allowLogin = 3-loginAttempt; session.setAttribute("message","loginAttempt= "+loginAttempt+". Invalid username or password. You have "+allowLogin+" attempts remaining. Please try again!
Not a registered cusomer? Please register!"); } session.setAttribute("loginCount",loginAttempt); url = "/login.jsp"; } RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(url); dispatcher.forward(request, response);
您可以尝试以下代码
int loginAttempt = (Integer)session.getAttribute("loginCount"); if (loginAttempt > 3 ){ // Error message/page redirection }else{ session.setAttribute("loginCount",loginAttempt++); }