17-安全

// Maven 依赖：jjwt
// <dependency>
//   <groupId>io.jsonwebtoken</groupId>
//   <artifactId>jjwt-api</artifactId>
//   <version>0.12.5</version>
// </dependency>

public class Jwt asymmetricExample {

    // 加载密钥对（实际生产应从密钥管理系统获取）
    public static KeyPair loadKeyPair() throws Exception {
        KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
        kpg.initialize(2048);
        return kpg.generateKeyPair();
    }

    // 使用私钥签发 JWT
    public static String generateJwt(KeyPair keyPair) {
        return Jwts.builder()
            .setHeaderParam("alg", "RS256")
            .setSubject("user-123")
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + 3600_000))
            .claim("role", "ADMIN")
            .signWith(keyPair.getPrivate(), SignatureAlgorithm.RS256)
            .compact();
    }

    // 使用公钥验证 JWT
    public static Claims validateJwt(String jwt, PublicKey publicKey) {
        return Jwts.parserBuilder()
            .setSigningKey(publicKey)
            .requireAudience(null)
            .build()
            .parseClaimsJws(jwt)
            .getBody();
    }
}

// 强制指定验签算法，不接受 Header 中的 alg 声明
Jwts.parserBuilder()
    .setSigningKey(publicKey)
    .require("alg", "RS256")  // 硬编码要求 RS256
    .build();

用户登出/令牌被窃取
    ↓
前端调用登出接口，将令牌 jti（JWT ID）发送到认证中心
    ↓
认证中心将 jti 存入 Redis SET，设置 TTL = 令牌剩余有效期
    ↓
各微服务网关在验签前先查 Redis 黑名单
    ↓
如果 jti 在黑名单中，拒绝请求

登录成功 → 返回 Access Token（10min）+ Refresh Token（7d）
    ↓
Access Token 用于日常请求，过期后自动失效
    ↓
Refresh Token 用于换取新 Access Token（需校验用户凭据）
    ↓
即使 Access Token 被窃取，攻击窗口仅限 10 分钟
    ↓
Refresh Token 存储在 HttpOnly Cookie 中，前端 JS 无法读取

签发 JWT 时，将客户端指纹（IP+UA 哈希）写入 Payload 的 jti 或自定义 claim
    ↓
每次验证时比对当前请求的客户端指纹与令牌绑定的指纹
    ↓
如果不一致，拒绝请求（攻击者窃取令牌后从其他设备使用会失败）

// 1. 登出时将令牌加入黑名单
public void logout(String jwt) {
    String jti = extractJti(jwt);
    long remainingTtl = extractRemainingTtl(jwt);
    if (remainingTtl > 0) {
        redisTemplate.opsForSet().add("jwt:blacklist", jti);
        redisTemplate.expire("jwt:blacklist", remainingTtl, TimeUnit.SECONDS);
    }
}

// 2. 网关验签时检查黑名单
public Jws<Claims> validateWithBlacklist(String jwt) {
    Jws<Claims> claims = jwtUtil.parse(jwt);
    String jti = claims.getBody().getId();
    if (redisTemplate.hasKey("jti:" + jti)) {
        throw new JwtException("Token已被吊销");
    }
    return claims;
}

// 3. 黑名单存储优化：使用 SET 按过期时间分散存储
// 避免一个大 Key 导致 Redis 性能问题
public void addToBlacklist(String jti, long expireAt) {
    long now = System.currentTimeMillis();
    long ttl = expireAt - now;
    if (ttl > 0) {
        String key = "jwt:bl:" + jti;
        redisTemplate.opsForValue().set(key, "1", ttl, TimeUnit.MILLISECONDS);
    }
}

@Component
public class JwtBlacklistFilter implements GlobalFilter, Ordered {

    @Autowired
    private RedisTemplate<String, String> redisTemplate;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String token = extractToken(exchange.getRequest());
        if (token != null) {
            try {
                Jws<Claims> claims = jwtUtil.parse(token);
                String jti = claims.getBody().getId();
                if (redisTemplate.hasKey("jwt:bl:" + jti)) {
                    exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                    return exchange.getResponse().setComplete();
                }
            } catch (Exception e) {
                exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
                return exchange.getResponse().setComplete();
            }
        }
        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return -100;
    }
}

客户端 ←→ 服务端：Session ID（Cookie）
服务端存储：Session 数据（用户信息、权限、状态）
鉴权方式：根据 Session ID 查找服务端存储的会话数据

客户端 ←→ 服务端：JWT 令牌（Header.Payload.Signature）
服务端存储：无（或仅存储黑名单/刷新令牌）
鉴权方式：验证签名 + 解析 Payload 获取用户信息

1. 用户登录 → 服务端创建 Session 对象，分配 Session ID
2. 服务端将 Session ID 通过 Set-Cookie 返回给客户端
3. 客户端后续请求自动携带 Cookie（Session ID）
4. 服务端根据 Session ID 查找 Session 数据 → 验证用户身份和权限
5. 登出时，服务端销毁 Session 数据

1. 用户登录 → 服务端验证凭据，签发 JWT（包含用户ID、权限、过期时间）
2. 客户端保存 JWT（localStorage 或 Cookie）
3. 后续请求在 Header 中携带 JWT：Authorization: Bearer <token>
4. 服务端验证 JWT 签名 + 检查过期时间 → 直接获取用户信息
5. 无需服务端存储，任意节点可独立完成鉴权

@Configuration
@EnableWebSecurity
public class SessionConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .maximumSessions(1)
                .maxSessionsPreventsLogin(true);
        return http.build();
    }

    // 分布式 Session 存储：使用 Spring Session + Redis
    // pom.xml 添加：spring-session-data-redis
    // 配置文件：spring.session.store-type=redis
}

@Component
public class JwtTokenProvider {

    @Value("${jwt.private-key}")
    private PrivateKey privateKey;

    @Value("${jwt.public-key}")
    private PublicKey publicKey;

    public String generateToken(Long userId, String roles) {
        return Jwts.builder()
            .setSubject(String.valueOf(userId))
            .claim("roles", roles)
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + 600_000))
            .signWith(privateKey, SignatureAlgorithm.RS256)
            .compact();
    }

    public Claims parseToken(String token) {
        return Jwts.parserBuilder()
            .setSigningKey(publicKey)
            .build()
            .parseClaimsJws(token)
            .getBody();
    }
}

// JWT 负责身份认证，Redis 负责会话状态
@Service
public class HybridAuthService {

    @Autowired
    private JwtTokenProvider jwtTokenProvider;
    @Autowired
    private RedisTemplate<String, UserSession> redisTemplate;

    // 登录：签发 JWT + 初始化 Redis 会话
    public AuthResponse login(LoginRequest request) {
        User user = userRepository.findByUsername(request.getUsername());
        // ... 密码验证
        String jwt = jwtTokenProvider.generateToken(user.getId(), user.getRoles());
        UserSession session = new UserSession(user.getId(), user.getRoles(), new ArrayList<>());
        redisTemplate.opsForValue().set("session:" + user.getId(), session, 30, TimeUnit.MINUTES);
        return new AuthResponse(jwt, session);
    }

    // 鉴权：JWT 验签 + Redis 会话检查
    public UserSession authenticate(String jwt) {
        Claims claims = jwtTokenProvider.parseToken(jwt);
        Long userId = Long.parseLong(claims.getSubject());
        UserSession session = redisTemplate.opsForValue().get("session:" + userId);
        if (session == null) {
            throw new AuthenticationException("会话已过期");
        }
        return session;
    }

    // 强制下线：清除 Redis 会话
    public void forceLogout(Long userId) {
        redisTemplate.delete("session:" + userId);
    }
}

客户端请求
  → Filter.doFilter()  ← Servlet 规范层（更外层）
    → DispatcherServlet
      → Interceptor.preHandle()  ← Spring MVC 层
        → Controller 方法
      → Interceptor.postHandle()
      → 视图渲染
    → Interceptor.afterCompletion()
  → Filter.doFilter()（响应过滤）
→ 客户端响应

1. 客户端发送请求（携带 JWT 或 Cookie）
2. Servlet 容器调用 Filter 链
3. JwtAuthenticationFilter.doFilter():
   a. 检查请求路径是否在白名单（登录接口、公开资源）
   b. 提取 JWT（从 Header Authorization 或 Cookie）
   c. 验证 JWT 签名和有效期
   d. 检查 Redis 黑名单（如已实现）
   e. 将用户信息存入 SecurityContextHolder 或请求属性
   f. 传递到下一个 Filter 或 Servlet
4. Controller 正常执行业务逻辑
5. 响应返回前可进行 Token 续期

1. 客户端发送请求
2. DispatcherServlet 接收
3. HandlerMapping 匹配 Controller
4. Interceptor.preHandle() 执行（仅此时可拦截）
5. 如果请求的是静态资源，DispatcherServlet 直接处理，不会进入拦截器
6. 如果是 OPTIONS 预检请求，Spring MVC 默认处理，不经过拦截器（需特殊配置）

@Component
@Order(1)
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Autowired
    private JwtTokenProvider jwtTokenProvider;

    @Autowired
    private UserDetailsService userDetailsService;

    private static final Set<String> WHITELIST = Set.of(
        "/api/auth/login",
        "/api/auth/register",
        "/public/**",
        "/actuator/**",
        "/swagger-ui/**",
        "/v3/api-docs/**"
    );

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        String requestPath = request.getRequestURI();

        if (isWhitelisted(requestPath)) {
            filterChain.doFilter(request, response);
            return;
        }

        String token = extractToken(request);
        if (token == null || !jwtTokenProvider.validateToken(token)) {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setContentType("application/json;charset=UTF-8");
            response.getWriter().write("{\"error\":\"Unauthorized\",\"message\":\"Invalid or missing token\"}");
            return;
        }

        Claims claims = jwtTokenProvider.parseToken(token);
        String username = claims.getSubject();
        List<String> roles = claims.get("roles", List.class);

        request.setAttribute("currentUser", username);
        request.setAttribute("currentRoles", roles);

        filterChain.doFilter(request, response);
    }

    private String extractToken(HttpServletRequest request) {
        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            return header.substring(7);
        }
        String cookieToken = WebUtils.getCookie(request, "JWT_TOKEN")
            .map(Cookie::getValue).orElse(null);
        return cookieToken;
    }

    private boolean isWhitelisted(String path) {
        return WHITELIST.stream().anyMatch(path::startsWith);
    }
}

// 拦截器只能拦截 Controller 请求，无法覆盖静态资源
public class JwtAuthInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        // 如果 handler 不是 Controller 方法（如静态资源），此方法根本不会被调用
        if (!(handler instanceof HandlerMethod)) {
            return true;
        }
        // 只能处理 Controller 级别的认证
        String token = extractToken(request);
        // ... 验证逻辑
        return true;
    }
}

// 注册拦截器
@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Autowired
    private JwtAuthInterceptor jwtAuthInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(jwtAuthInterceptor)
            .addPathPatterns("/api/**")
            .excludePathPatterns("/api/auth/**", "/public/**");
        // 无法覆盖 /static/**, /webjars/** 等静态资源
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http,
                                                     JwtAuthenticationFilter jwtFilter) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**", "/public/**", "/actuator/**").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}

是否需要覆盖所有请求？（含静态资源）
  ├── 是 → 使用 Filter 或 Spring Security
  └── 否 → 是否需要方法级权限控制？
              ├── 是 → 使用 Spring AOP + @PreAuthorize
              └── 否 → 使用 Interceptor

// 方式一：Spring 管理（推荐）
@Component
public class JwtFilter extends OncePerRequestFilter { ... }

// 方式二：手动获取
public class JwtFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) {
        ServletContext servletContext = filterConfig.getServletContext();
        WebApplicationContext ctx = WebApplicationContextUtils
            .getRequiredWebApplicationContext(servletContext);
        this.jwtTokenProvider = ctx.getBean(JwtTokenProvider.class);
    }
}

客户端
  │
  ▼
[HTTPS/TLS 终端] ← 传输层加密，防止中间人
  │
  ▼
[CORS 预检处理] ← 处理跨域，限制来源
  │
  ▼
[CSRF 防护] ← 检查 Origin/Referer，验证 CSRF Token
  │
  ▼
[JWT 提取与验签] ← 硬编码算法，拒绝 alg:none
  │
  ▼
[黑名单检查] ← Redis 分布式黑名单
  │
  ▼
[客户端特征校验] ← IP+UA 哈希比对
  │
  ▼
[频率限制] ← 令牌/IP 级别的请求频率控制
  │
  ▼
[权限校验] ← 基于角色/资源的访问控制
  │
  ▼
[路由转发] → 后端微服务

网关接收 JWT
  │
  ▼
解析 Header 部分
  │
  ▼
检查 alg 字段：
  ├── 如果是 none → 直接拒绝
  ├── 如果非白名单算法 → 直接拒绝
  └── 如果在白名单 → 使用对应公钥/密钥验签
  │
  ▼
验签成功 → 继续后续检查
验签失败 → 拒绝请求

@Configuration
public class GatewaySecurityConfig {

    @Bean
    public JwtAuthGlobalFilter jwtAuthGlobalFilter() {
        return new JwtAuthGlobalFilter();
    }

    @Bean
    public RateLimitGlobalFilter rateLimitGlobalFilter() {
        return new RateLimitGlobalFilter();
    }
}

@Component
public class JwtAuthGlobalFilter implements GlobalFilter, Ordered {

    @Autowired
    private JwtTokenValidator tokenValidator;

    @Autowired
    private BlacklistService blacklistService;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String path = exchange.getRequest().getURI().getPath();

        if (isPublicPath(path)) {
            return chain.filter(exchange);
        }

        String token = extractToken(exchange.getRequest());
        if (token == null) {
            return unauthorized(exchange, "Missing token");
        }

        try {
            JwtClaims claims = tokenValidator.validate(token);
            String jti = claims.getJti();

            if (blacklistService.isBlacklisted(jti)) {
                return unauthorized(exchange, "Token revoked");
            }

            String clientFingerprint = extractFingerprint(exchange.getRequest());
            if (!claims.getFingerprint().equals(clientFingerprint)) {
                return unauthorized(exchange, "Client mismatch");
            }

            exchange.getAttributes().put("userId", claims.getUserId());
            exchange.getAttributes().put("roles", claims.getRoles());

            return chain.filter(exchange);
        } catch (JwtValidationException e) {
            return unauthorized(exchange, e.getMessage());
        }
    }

    @Override
    public int getOrder() {
        return -100;
    }
}

# application.yml - 密钥配置（不要硬编码在代码中）
jwt:
  # 公钥可配置化，方便轮换
  public-key: ${JWT_PUBLIC_KEY:classpath:keys/public.pem}
  # 私钥仅在认证中心保存，网关只配公钥
  # 网关不需要私钥，只做验签
  algorithms: RS256, ES256  # 白名单算法
  reject-alg-none: true     # 强制拒绝 none 算法

@Configuration
public class RateLimitConfig {

    @Bean
    public KeyResolver ipKeyResolver() {
        return exchange -> Mono.just(exchange.getRequest().getRemoteAddress().getAddress().getHostAddress());
    }

    @Bean
    public KeyResolver userKeyResolver() {
        return exchange -> {
            String userId = (String) exchange.getAttributes().get("userId");
            return Mono.justOrEmpty(userId);
        };
    }
}

@Component
public class RateLimitGlobalFilter implements GlobalFilter, Ordered {

    @Autowired
    private RedisTemplate<String, String> redisTemplate;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String clientIp = exchange.getRequest().getRemoteAddress().getAddress().getHostAddress();
        String token = extractToken(exchange.getRequest());

        // IP 级别的频率限制（无令牌时）
        String ipKey = "ratelimit:ip:" + clientIp;
        Long ipCount = redisTemplate.opsForValue().increment(ipKey);
        redisTemplate.expire(ipKey, 60, TimeUnit.SECONDS);
        if (ipCount > 100) {
            return tooManyRequests(exchange);
        }

        // 用户级别的频率限制（有令牌时）
        if (token != null) {
            String userKey = "ratelimit:user:" + token;
            Long userCount = redisTemplate.opsForValue().increment(userKey);
            redisTemplate.expire(userKey, 60, TimeUnit.SECONDS);
            if (userCount > 1000) {
                return tooManyRequests(exchange);
            }
        }

        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return -90;
    }
}

1. 客户端请求登出：POST /api/auth/logout
2. 服务端提取当前 JWT 的 jti 和剩余有效期
3. 将 jti 存入 Redis 黑名单：SET jti:bl:{jti} 1 EX {remaining_ttl}
4. 客户端删除本地存储的 JWT
5. 后续请求携带该 JWT 时，网关/服务查 Redis 命中黑名单 → 拒绝

1. 管理员操作：POST /api/admin/users/{userId}/ban
2. 服务端查询该用户所有活跃会话的 jti 列表
3. 将所有 jti 批量加入 Redis 黑名单
4. 同时在用户表中标记 status=BANNED
5. 该用户后续登录时验证用户状态 → 拒绝
6. 已签发的 JWT 命中黑名单 → 拒绝

@Service
public class TokenRevocationService {

    @Autowired
    private StringRedisTemplate redisTemplate;

    @Autowired
    private JdbcTemplate jdbcTemplate;

    private static final String BL_PREFIX = "jti:bl:";
    private static final String USER_ACTIVE_PREFIX = "user:active-jti:";

    // 强制下线：单个令牌
    public void revokeToken(String jti, long expireAtMs) {
        long ttlSeconds = (expireAtMs - System.currentTimeMillis()) / 1000;
        if (ttlSeconds > 0) {
            redisTemplate.opsForValue()
                .set(BL_PREFIX + jti, "1", ttlSeconds, TimeUnit.SECONDS);
        }
    }

    // 记录活跃令牌（登录时调用）
    public void trackActiveToken(String userId, String jti, long expireAtMs) {
        long ttlSeconds = (expireAtMs - System.currentTimeMillis()) / 1000;
        if (ttlSeconds > 0) {
            String key = USER_ACTIVE_PREFIX + userId;
            redisTemplate.opsForSet().add(key, jti);
            redisTemplate.expire(key, ttlSeconds, TimeUnit.SECONDS);
        }
    }

    // 拉黑用户：所有令牌
    public void banUser(String userId) {
        Set<String> activeJtis = redisTemplate.opsForSet()
            .members(USER_ACTIVE_PREFIX + userId);

        if (activeJtis != null && !activeJtis.isEmpty()) {
            Map<String, String> batchOps = new HashMap<>();
            for (String jti : activeJtis) {
                batchOps.put(BL_PREFIX + jti, "1");
            }
            // 使用 Pipeline 批量写入
            redisTemplate.executePipelined((RedisCallback<Object>) connection -> {
                for (Map.Entry<String, String> entry : batchOps.entrySet()) {
                    connection.stringSet()
                        .set(entry.getKey().getBytes(), entry.getValue().getBytes());
                }
                return null;
            });
        }

        // 标记用户状态
        jdbcTemplate.update("UPDATE users SET status = 'BANNED' WHERE id = ?", userId);
    }

    // 检查令牌是否被吊销
    public boolean isRevoked(String jti) {
        return Boolean.TRUE.equals(redisTemplate.hasKey(BL_PREFIX + jti));
    }
}

@Component
public class RevocationCheckFilter extends OncePerRequestFilter {

    @Autowired
    private TokenRevocationService revocationService;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        String token = extractToken(request);
        if (token != null) {
            try {
                Claims claims = Jwts.parserBuilder()
                    .setSigningKey(publicKey)
                    .build()
                    .parseClaimsJws(token)
                    .getBody();
                String jti = claims.getId();
                if (revocationService.isRevoked(jti)) {
                    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                    response.getWriter().write("{\"error\":\"Token revoked\"}");
                    return;
                }
            } catch (ExpiredJwtException e) {
                // 已过期，直接拒绝
                response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                response.getWriter().write("{\"error\":\"Token expired\"}");
                return;
            }
        }
        filterChain.doFilter(request, response);
    }
}

@Component
public class BloomFilterRevocationChecker {

    private BloomFilter<String> bloomFilter;

    @PostConstruct
    public void init() {
        this.bloomFilter = BloomFilter.create(Funnels.stringFunnel(StandardCharsets.UTF_8), 1000000, 0.01);
        // 启动时从 Redis 加载已吊销的 jti 到布隆过滤器
        loadExistingRevocations();
    }

    public boolean isRevoked(String jti) {
        if (bloomFilter.mightContain(jti)) {
            // 布隆过滤器命中，再查 Redis 确认（降低误判）
            return Boolean.TRUE.equals(redisTemplate.hasKey("jti:bl:" + jti));
        }
        return false;
    }

    public void addRevocation(String jti) {
        bloomFilter.put(jti);
        redisTemplate.opsForValue().set("jti:bl:" + jti, "1", ttl, TimeUnit.SECONDS);
    }
}

@Configuration
public class RevocationDegradationConfig {

    @Bean
    public Cache<String, Boolean> revocationCache() {
        return Caffeine.newBuilder()
            .maximumSize(10000)
            .expireAfterWrite(1, TimeUnit.HOURS)
            .build();
    }
}

JWT Payload（粗粒度，不可变）：
  - userId: 123
  - roles: ["ROLE_ADMIN", "ROLE_USER"]
  - version: 5
  - exp: 1700000000

Redis（细粒度，可变）：
  - perm:user:123:version → 5（当前权限版本）
  - perm:user:123:permissions → ["user:edit", "user:delete", "order:create"]
  - perm:user:123:data_scope → "DEPT_1,DEPT_2"（数据权限）

请求到达 → 提取 JWT → 验签
  │
  ▼
解析 Payload → 获取 userId, roles, version
  │
  ▼
查 Redis 获取当前权限版本号：perm:user:{userId}:version
  │
  ├── JWT version == Redis version → 权限未变更 → 放行
  └── JWT version != Redis version → 权限已变更 → 触发刷新
        │
        ▼
    重新签发 JWT（使用最新权限版本和角色）
    │
    ▼
    读取 Redis 中的细粒度权限列表
    │
    ▼
    比对当前请求所需权限 → 通过则放行
    │
    ▼
    在响应 Header 中返回新的 JWT（前端自动替换）

@Service
public class PermissionVersionService {

    @Autowired
    private StringRedisTemplate redisTemplate;

    private static final String VERSION_PREFIX = "perm:user:";
    private static final String PERM_PREFIX = "perm:user:";

    // 获取用户当前版本号
    public int getCurrentVersion(String userId) {
        String version = redisTemplate.opsForValue()
            .get(VERSION_PREFIX + userId + ":version");
        return version == null ? 0 : Integer.parseInt(version);
    }

    // 权限变更时递增版本号
    public void incrementVersion(String userId) {
        redisTemplate.opsForValue()
            .increment(VERSION_PREFIX + userId + ":version");
    }

    // 更新用户权限列表
    public void updatePermissions(String userId, Set<String> permissions) {
        String key = PERM_PREFIX + userId + ":permissions";
        redisTemplate.delete(key);
        redisTemplate.opsForSet().add(key, permissions.toArray(new String[0]));
        incrementVersion(userId);
    }

    // 获取用户权限列表
    public Set<String> getPermissions(String userId) {
        return redisTemplate.opsForSet()
            .members(PERM_PREFIX + userId + ":permissions");
    }

    // 检查是否有权限
    public boolean hasPermission(String userId, String permission) {
        return redisTemplate.opsForSet()
            .isMember(PERM_PREFIX + userId + ":permissions", permission);
    }
}

@Component
public class PermissionFilter extends OncePerRequestFilter {

    @Autowired
    private PermissionVersionService permissionService;

    @Autowired
    private JwtTokenProvider jwtTokenProvider;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        String token = extractToken(request);
        if (token == null) {
            filterChain.doFilter(request, response);
            return;
        }

        Claims claims = jwtTokenProvider.parseToken(token);
        String userId = claims.getSubject();
        int jwtVersion = claims.get("version", Integer.class);

        int currentVersion = permissionService.getCurrentVersion(userId);

        if (jwtVersion < currentVersion) {
            String newToken = jwtTokenProvider.refreshToken(token, currentVersion);
            response.setHeader("X-New-Token", newToken);
            claims = jwtTokenProvider.parseToken(newToken);
        }

        String requiredPermission = extractRequiredPermission(request);
        if (requiredPermission != null) {
            if (!permissionService.hasPermission(userId, requiredPermission)) {
                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                response.getWriter().write("{\"error\":\"Permission denied\"}");
                return;
            }
        }

        filterChain.doFilter(request, response);
    }

    private String extractRequiredPermission(HttpServletRequest request) {
        String method = request.getMethod();
        String uri = request.getRequestURI();
        return method + ":" + uri;
    }
}

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface RequirePermission {
    String[] value();
    Logical logical() default Logical.AND;
}

@Aspect
@Component
public class PermissionAspect {

    @Autowired
    private PermissionVersionService permissionService;

    @Around("@annotation(requirePermission)")
    public Object checkPermission(ProceedingJoinPoint pjp,
                                    RequirePermission requirePermission) throws Throwable {
        String userId = SecurityContextHolder.getCurrentUserId();
        Set<String> userPermissions = permissionService.getPermissions(userId);

        boolean hasPermission = false;
        if (requirePermission.logical() == Logical.AND) {
            hasPermission = userPermissions.containsAll(
                Arrays.asList(requirePermission.value()));
        } else {
            hasPermission = Arrays.stream(requirePermission.value())
                .anyMatch(userPermissions::contains);
        }

        if (!hasPermission) {
            throw new ForbiddenException("权限不足");
        }
        return pjp.proceed();
    }
}

@RestController
@RequestMapping("/api/users")
public class UserController {

    @GetMapping
    @RequirePermission("user:list")
    public PageResult<User> listUsers() { ... }

    @PutMapping("/{id}")
    @RequirePermission("user:edit")
    public void updateUser(@PathVariable Long id) { ... }

    @DeleteMapping("/{id}")
    @RequirePermission("user:delete")
    public void deleteUser(@PathVariable Long id) { ... }
}

Controller
  │
  ▼
Service 层（业务逻辑）
  │
  ▼
AOP 切面 @SqlInjectionGuard ← 拦截点
  │
  ▼
  ├── 提取方法参数
  ├── SQL 解析与检测
  ├── 危险模式匹配
  ├── 参数清洗/拒绝
  │
  ▼
MyBatis Mapper（#{}/预编译） ← 基础防护
  │
  ▼
数据库

1. AOP 拦截 DAO 方法调用
2. 获取所有参数值（MyBatis 的参数 Map）
3. 遍历每个参数值：
   a. 使用正则匹配常见注入特征
   b. 使用 SQL 解析器解析参数值
   c. 检查是否包含危险关键字（SELECT, UNION, DROP, --, ; 等）
4. 如果检测到注入：
   - 记录安全日志
   - 拒绝请求（抛异常）或清洗参数
5. 如果通过检测，继续执行 DAO 方法

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface SqlInjectionGuard {
    boolean enabled() default true;
    String[] ignoreFields() default {};
}

@Aspect
@Component
@Slf4j
public class SqlInjectionAspect {

    private static final Pattern DANGEROUS_PATTERN = Pattern.compile(
        "(?i)(UNION\\s+SELECT|DROP\\s+TABLE|INSERT\\s+INTO|DELETE\\s+FROM|UPDATE\\s+\\w+\\s+SET|" +
        "(--|;|--|#)|('\\s*OR\\s+'1'\\s*=\\s*'1)|('\\s*OR\\s+1\\s*=\\s*1)|" +
        "(EXEC\\s+sp_|EXECUTE\\s+xp_|xp_cmdshell)|" +
        "(WAITFOR\\s+DELAY|BENCHMARK\\s*\\(|SLEEP\\s*\\()|" +
        "(EXTRACTVALUE|UPDATEXML|EXPOSED_KEYS)|" +
        "(CHAR\\s*\\(|CONCAT\\s*\\(|0x[0-9a-fA-F]+)"
    );

    private static final List<String> DANGEROUS_KEYWORDS = Arrays.asList(
        "select", "union", "drop", "delete", "insert", "update",
        "exec", "execute", "xp_", "sp_",
        "waifor", "delay", "benchmark", "sleep",
        "extractvalue", "updatexml"
    );

    @Around("@annotation(guard) || @within(guard)")
    public Object guardSql(ProceedingJoinPoint pjp,
                           SqlInjectionGuard guard) throws Throwable {
        Object[] args = pjp.getArgs();

        for (Object arg : args) {
            if (arg instanceof String) {
                checkStringValue((String) arg, guard);
            } else if (arg instanceof Map) {
                checkMapValues((Map<?, ?>) arg, guard);
            } else if (arg instanceof Collection) {
                checkCollectionValues((Collection<?>) arg, guard);
            }
        }

        return pjp.proceed();
    }

    private void checkStringValue(String value, SqlInjectionGuard guard) {
        if (value == null || value.isEmpty()) return;

        if (DANGEROUS_PATTERN.matcher(value).find()) {
            log.warn("SQL注入检测：检测到可疑输入: {}",
                value.substring(0, Math.min(value.length(), 100)));
            throw new SecurityException("检测到潜在的SQL注入攻击");
        }

        String lowerValue = value.toLowerCase();
        for (String keyword : DANGEROUS_KEYWORDS) {
            if (lowerValue.contains(keyword) && !isLegitimateUsage(value, keyword)) {
                log.warn("SQL注入检测：检测到危险关键字: {} in {}",
                    keyword, value.substring(0, Math.min(value.length(), 100)));
                throw new SecurityException("检测到潜在的SQL注入攻击");
            }
        }
    }

    private boolean isLegitimateUsage(String value, String keyword) {
        // 白名单：合法的关键字使用场景
        String lower = value.toLowerCase();
        if (keyword.equals("select") && lower.matches("^[\\w\\s,.*]+$")) {
            return true;
        }
        if (keyword.equals("update") && lower.matches("^\\w+\\s*=\\s*[\\w\\s]+$")) {
            return true;
        }
        return false;
    }

    private void checkMapValues(Map<?, ?> map, SqlInjectionGuard guard) {
        for (Map.Entry<?, ?> entry : map.entrySet()) {
            if (entry.getValue() instanceof String) {
                checkStringValue((String) entry.getValue(), guard);
            }
        }
    }

    private void checkCollectionValues(Collection<?> collection, SqlInjectionGuard guard) {
        for (Object item : collection) {
            if (item instanceof String) {
                checkStringValue((String) item, guard);
            }
        }
    }
}

@Mapper
public interface UserMapper {

    @SqlInjectionGuard
    @Select("SELECT * FROM users WHERE username = #{username}")
    User findByUsername(@Param("username") String username);

    @SqlInjectionGuard
    @Select("SELECT * FROM users WHERE id IN " +
            "<foreach collection='ids' item='id' open='(' separator=',' close=')'>" +
            "#{id}" +
            "</foreach>")
    List<User> findByIds(@Param("ids") List<Long> ids);

    @SqlInjectionGuard(ignoreFields = {"sortOrder"})
    @Select("SELECT * FROM users WHERE status = #{status} ORDER BY " +
            "${sortColumn} ${sortOrder}")
    List<User> findAll(@Param("status") String status,
                        @Param("sortColumn") String sortColumn,
                        @Param("sortOrder") String sortOrder);
}

@Aspect
@Component
public class DruidSqlInjectionAspect {

    @Around("execution(* com.example.mapper..*.*(..))")
    public Object guardSql(ProceedingJoinPoint pjp) throws Throwable {
        Object[] args = pjp.getArgs();

        for (Object arg : args) {
            if (arg instanceof String) {
                checkSqlInjection((String) arg);
            }
        }

        return pjp.proceed();
    }

    private void checkSqlInjection(String sql) {
        try {
            List<SQLStatement> statements = SQLUtils.parseStatements(sql, "mysql");
            if (statements.isEmpty()) {
                return;
            }

            for (SQLStatement stmt : statements) {
                if (stmt instanceof MySqlInsertStatement
                    || stmt instanceof MySqlUpdateStatement
                    || stmt instanceof MySqlDeleteStatement
                    || stmt instanceof MySqlSelectStatement) {
                    continue;
                }

                log.warn("检测到可疑SQL操作: {}", stmt.getClass().getSimpleName());
                throw new SecurityException("非法的SQL操作");
            }
        } catch (Exception e) {
            if (e instanceof SecurityException) {
                throw (SecurityException) e;
            }
            log.error("SQL解析失败", e);
            throw new SecurityException("SQL格式异常");
        }
    }
}

@Service
public class DynamicTableService {

    private static final Map<String, String> TABLE_MAPPING = Map.of(
        "user", "t_user",
        "order", "t_order",
        "product", "t_product"
    );

    public String getSafeTable(String tableName) {
        String safeName = TABLE_MAPPING.get(tableName);
        if (safeName == null) {
            throw new IllegalArgumentException("非法表名");
        }
        return safeName;
    }
}