javaCopy code
@RestController
public class LoginController {
    private final RedisTemplate<String, Integer> redisTemplate;
    private final int MAX_LOGIN_ATTEMPTS = 5;
    private final int LOCKOUT_DURATION_SECONDS = 600; // 鎖定時(shí)間為10分鐘
    public LoginController(RedisTemplate<String, Integer> redisTemplate) {
        this.redisTemplate = redisTemplate;
    }
    @PostMapping("/login")
    public ResponseEntity<String> login(@RequestBody LoginRequest request) {
        String username = request.getUsername();
        // 檢查賬戶是否已被鎖定
        if (isAccountLocked(username)) {
            return ResponseEntity.status(HttpStatus.LOCKED).body("Account locked. Please try again later.");
        }
        // 檢查登錄失敗次數(shù)
        int failedAttempts = getFailedLoginAttempts(username);
        if (failedAttempts >= MAX_LOGIN_ATTEMPTS) {
            // 鎖定賬戶
            lockAccount(username);
            return ResponseEntity.status(HttpStatus.LOCKED).body("Account locked. Please try again later.");
        }
        // 驗(yàn)證密碼邏輯
        // ...
        if (passwordIsValid(request.getPassword())) {
            // 登錄成功
            resetFailedLoginAttempts(username);
            return ResponseEntity.ok("Login successful.");
        } else {
            // 登錄失敗
            incrementFailedLoginAttempts(username);
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid username or password.");
        }
    }
    private boolean isAccountLocked(String username) {
        return redisTemplate.hasKey(getAccountLockKey(username));
    }
    private void lockAccount(String username) {
        redisTemplate.opsForValue().set(getAccountLockKey(username), 1, Duration.ofSeconds(LOCKOUT_DURATION_SECONDS));
    }
    private int getFailedLoginAttempts(String username) {
        Integer failedAttempts = redisTemplate.opsForValue().get(getFailedLoginAttemptsKey(username));
        return failedAttempts != null ? failedAttempts : 0;
    }
    private void incrementFailedLoginAttempts(String username) {
        redisTemplate.opsForValue().increment(getFailedLoginAttemptsKey(username), 1);
    }
    private void resetFailedLoginAttempts(String username) {
        redisTemplate.delete(getFailedLoginAttemptsKey(username));
    }
    private String getAccountLockKey(String username) {
        return "account:lock:" + username;
    }
    private String getFailedLoginAttemptsKey(String username) {
        return "account:failedLoginAttempts:" + username;
    }
    private boolean passwordIsValid(String password) {
        // 驗(yàn)證密碼的復(fù)雜性等
        // ...
        return true;
    }
}