Spring Boot 使用 Passay 库的自定义密码验证器

        <dependency>
            <groupId>org.passaygroupId>
            <artifactId>passayartifactId>
            <version>1.6.0version>
        dependency>

您可以在此处找到所有版本。

package com.passay.sample.custompasswordvalidation.annotation;
 
 
 
import com.passay.sample.custompasswordvalidation.utils.PasswordConstraintValidator;
 
import javax.validation.Constraint;
import javax.validation.Payload;
import java.lang.annotation.Documented;
import java.lang.annotation.Retention;
import java.lang.annotation.Target;
 
import static java.lang.annotation.ElementType.*;
import static java.lang.annotation.RetentionPolicy.RUNTIME;
 
 
/**
 * 
ValidPassword
 *
 * @author aek
 */
@Documented
@Constraint(validatedBy = PasswordConstraintValidator.class)
@Target({ TYPE, FIELD, ANNOTATION_TYPE })
@Retention(RUNTIME)
public @interface ValidPassword {
 
    String message() default "Invalid Password";
 
    Class[] groups() default {};
 
    Classextends Payload>[] payload() default {};
}

请考虑以下简单密码策略：

package com.passay.sample.custompasswordvalidation.utils;
 
import com.passay.sample.custompasswordvalidation.annotation.ValidPassword;
import lombok.SneakyThrows;
import org.passay.*;
 
import javax.validation.ConstraintValidator;
import javax.validation.ConstraintValidatorContext;
import java.io.InputStream;
import java.util.Arrays;
import java.util.List;
import java.util.Properties;
 
 
/**
 * 
PasswordConstraintValidator
 *
 * @author aek
 */
public class PasswordConstraintValidator implements ConstraintValidator {
 
    @Override
    public void initialize(final ValidPassword arg0) {
 
    }
 
    @SneakyThrows
    @Override
    public boolean isValid(String password, ConstraintValidatorContext context) {
 
        //customizing validation messages
        Properties props = new Properties();
        InputStream inputStream = getClass()
                .getClassLoader().getResourceAsStream("passay.properties");
        props.load(inputStream);
        MessageResolver resolver = new PropertiesMessageResolver(props);
 
        PasswordValidator validator = new PasswordValidator(resolver, Arrays.asList(
 
                // length between 8 and 16 characters
                new LengthRule(8, 16),
 
                // at least one upper-case character
                new CharacterRule(EnglishCharacterData.UpperCase, 1),
 
                // at least one lower-case character
                new CharacterRule(EnglishCharacterData.LowerCase, 1),
 
                // at least one digit character
                new CharacterRule(EnglishCharacterData.Digit, 1),
 
                // at least one symbol (special character)
                new CharacterRule(EnglishCharacterData.Special, 1),
 
                // no whitespace
                new WhitespaceRule(),
 
                // rejects passwords that contain a sequence of >= 5 characters alphabetical  (e.g. abcdef)
                 new IllegalSequenceRule(EnglishSequenceData.Alphabetical, 5, false),
                // rejects passwords that contain a sequence of >= 5 characters numerical   (e.g. 12345)
                new IllegalSequenceRule(EnglishSequenceData.Numerical, 5, false)
        ));
 
        RuleResult result = validator.validate(new PasswordData(password));
 
        if (result.isValid()) {
            return true;
        }
 
        List messages = validator.getMessages(result);
        String messageTemplate = String.join(",", messages);
        context.buildConstraintViolationWithTemplate(messageTemplate)
                .addConstraintViolation()
                .disableDefaultConstraintViolation();
        return false;
    }
 
}

Passay 列出了几个规则来帮助验证密码。可以使用Passay编写的规则的完整列表可以在官方网站上找到。

package com.passay.sample.custompasswordvalidation.web;
 
import lombok.extern.slf4j.Slf4j;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.MethodArgumentNotValidException;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseStatus;
import org.springframework.web.bind.annotation.RestControllerAdvice;
 
import java.util.HashMap;
import java.util.Map;
 
@Slf4j
@RestControllerAdvice
public class BaseExceptionHandler {
 
 
    @ResponseStatus(HttpStatus.BAD_REQUEST)
    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ApiResponse handleValidationExceptions(MethodArgumentNotValidException ex) {
 
        Map errors = new HashMap<>();
 
        ex.getBindingResult().getFieldErrors().forEach(error -> {
                    if (errors.containsKey(error.getField())) {
                        errors.put(error.getField(), String.format("%s, %s", errors.get(error.getField()), error.getDefaultMessage()));
                    } else {
                        errors.put(error.getField(), error.getDefaultMessage());
                    }
                }
        );
        return new ApiResponse(errors, "VALIDATION_FAILED");
    }
}

启动后端项目。http://localhost:8080/