网站未做安全隐患检测怎么拿shell百度提交

1.问题

账密登录方式中用户输入密码后，把账号、密码通过http传输到后端进行校验，然而密码属于敏感信息，不能以明文传输，否则容易被拦截窃取，因此需要考虑如何安全传输密码

2.解决方案

使用rsa加密方式，rsa属于非对称加密，特点就是公钥加密私钥解密

2.1后端生成公钥私钥

生成公私钥，把公钥返回给前端，私钥用redis缓存

ManagerController.java

    @GetMapping("/key")public ResponseEntity<ApiResponse> key(@RequestParam("loginNo") String loginNo) {String key = managerService.generateKey(loginNo);return ApiResponse.success(key);}

ManagerServiceImpl.java

    @Overridepublic String generateKey(String loginNo) {QueryWrapper<Manager> wrapper = new QueryWrapper<>();wrapper.eq("loginNo", loginNo);Manager entity = this.getOne(wrapper);if (Objects.isNull(entity)) {throw new CodeException("用户不存在：loginNo=" + loginNo);}try {KeyPair keyPair = RSAUtil.generateKeyPair();String publicKey = RSAUtil.getPublicKey(keyPair);String privateKey = RSAUtil.getPrivateKey(keyPair);log.info("publicKey={}", publicKey);log.info("privateKey={}", privateKey);String redisKey = RedisKey.MANAGE_LOGIN_RSA_PRIVATEKEY + "$" + loginNo;// 清除缓存redisService.del(redisKey);// 私钥添加到缓存redisService.set(redisKey, privateKey, 5, TimeUnit.MINUTES);return publicKey;} catch (Exception e) {log.error("生成rsa密钥失败", e);}return null;}

RSAUtil.java

public class RSAUtil {private static final Charset CHARSET = StandardCharsets.UTF_8;private static final String ALGORITHM = "RSA";/*** 生成密钥对* @return* @throws NoSuchAlgorithmException*/public static KeyPair generateKeyPair() throws NoSuchAlgorithmException {KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(ALGORITHM);keyPairGenerator.initialize(1024);return keyPairGenerator.generateKeyPair();}/*** 生成公钥* @param keyPair* @return*/public static String getPublicKey(KeyPair keyPair) {PublicKey publicKey = keyPair.getPublic();byte[] bytes = base64Encode(publicKey.getEncoded());return new String(bytes, CHARSET);}/*** 生成私钥* @param keyPair* @return*/public static String getPrivateKey(KeyPair keyPair) {PrivateKey privateKey = keyPair.getPrivate();byte[] bytes = base64Encode(privateKey.getEncoded());return new String(bytes, CHARSET);}/*** base64加密* @param bytes* @return*/public static byte[] base64Encode(byte[] bytes) {return Base64.getEncoder().encode(bytes);}/*** base64解密* @param bytes* @return*/public static byte[] base64Decode(byte[] bytes) {return Base64.getDecoder().decode(bytes);}/*** base64解密* @param src* @return*/public static byte[] base64Decode(String src) {return Base64.getDecoder().decode(src);}/*** 解密* @param key* @param data* @return* @throws NoSuchAlgorithmException* @throws InvalidKeySpecException* @throws NoSuchPaddingException* @throws InvalidKeyException* @throws IllegalBlockSizeException* @throws BadPaddingException*/public static String decrypt(String key, String data) throws NoSuchAlgorithmException, InvalidKeySpecException, NoSuchPaddingException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException {byte[] bytes = base64Decode(key);PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(bytes);KeyFactory keyFactory = KeyFactory.getInstance(ALGORITHM);PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");cipher.init(Cipher.DECRYPT_MODE, privateKey);return new String(cipher.doFinal(base64Decode(data.getBytes(CHARSET))), CHARSET);}

2.2前端使用公钥加密

安装这个依赖

npm install jsencrypt@3.2.0

import JSEncrypt from 'jsencrypt';// key为后端返回的公钥，this.form.password为明文密码
const jsEncrypt = new JSEncrypt();
jsEncrypt.setPublicKey(key);
// pwd为加密后的密码
var pwd = jsEncrypt.encrypt(this.form.password);

2.3后端使用私钥解密

从redis获取私钥，用私钥解密，得到明文后和数据库保存的密码比对，数据库的密码是以用户id为盐值对明文密码作md5加密，相同则放行，否则报错，注意登录成功的话需要把redis的密钥移除

ManagerController.java

    @PostMapping("/login")public ResponseEntity<ApiResponse> login(@RequestParam("loginNo") String loginNo, @RequestParam("password") String password)throws Exception {UserDTOWithToken dto = managerService.login(loginNo, password);return ApiResponse.success(dto);}

ManagerServiceImpl.java

    @Overridepublic UserDTOWithToken login(String loginNo, String password) throws Exception {QueryWrapper<Manager> wrapper = new QueryWrapper<>();wrapper.eq("loginNo", loginNo);Manager entity = this.getOne(wrapper);if (Objects.isNull(entity)) {throw new CodeException("用户不存在：loginNo=" + loginNo);}String redisKey = RedisKey.MANAGE_LOGIN_RSA_PRIVATEKEY + "$" + loginNo;// 从缓存获取私钥String privateKey = (String) redisService.get(redisKey);if (StrUtil.isEmpty(privateKey)) {throw new CodeException("私钥不存在");}// 用私钥解密String realPassword = RSAUtil.decrypt(privateKey, password);log.info("realPassword={}", realPassword);// 校验密码Digester digester = new Digester(DigestAlgorithm.MD5);digester.setSalt(entity.getId().getBytes(StandardCharsets.UTF_8));String encodePassword = digester.digestHex(realPassword);log.info("encodePassword={}", encodePassword);if (!encodePassword.equals(entity.getPassword())) {throw new CodeException("密码错误");}//从认证服务获取tokenResponseEntity<ApiResponse> responseEntity = authClient.token(AuthConst.PASSWORD_GRANT_TYPE, AuthConst.ADMIN_CLIENT_ID,AuthConst.ADMIN_CLIENT_SECRET, null, loginNo, password);ApiResponse response = responseEntity.getBody();TokenDTO tokenDTO = response.toObject(TokenDTO.class);if (Objects.isNull(tokenDTO)) {throw new CodeException("获取token失败：" + response.getMessage());}UserDTOWithToken dto = new UserDTOWithToken();dto.setUserId(entity.getId());dto.setToken(tokenDTO);entity.setLoginTime(LocalDateTime.now());Integer loginCount = entity.getLoginCount();entity.setLoginCount(Objects.isNull(loginCount) ? 1 : loginCount + 1);entity.setUpdateTime(LocalDateTime.now());this.updateById(entity);// 成功则清除缓存的私钥redisService.del(redisKey);return dto;}

3.总结

非对称加密还有其它算法，rsa是其中一种

后端存储私钥除了redis也可以用其它缓存工具如J2Cache