服务端安全加固：多维限流（按 IP/按门店）+ 敏感接口独立速率上限抵御 DDoS/刷接口； 登录暴力破解新增按来源 IP 锁定；反代后正确识别真实客户端 IP； 门店 custom_fields 轻量配置（录入默认值）透传保存。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y2Wdwo7SmgBJU37cBrkhPK
This commit is contained in:
wangjia
@@ -40,16 +40,23 @@ type DeviceInfo struct {
|
||||
}
|
||||
|
||||
// loginLimiter 内存登录失败限流器（单实例，重启即清零）。
|
||||
// 两个维度共用同一张表：账号维度 key="<shopCode>|<username>"，IP 维度 key="ip|<addr>"，
|
||||
// 分别用不同阈值锁定。带 janitor 清理空闲 entry，避免攻击者用随机 key 灌爆内存。
|
||||
type loginLimiter struct {
|
||||
mu sync.Mutex
|
||||
entries map[string]*limiterEntry
|
||||
mu sync.Mutex
|
||||
entries map[string]*limiterEntry
|
||||
janitorOnce sync.Once
|
||||
}
|
||||
|
||||
type limiterEntry struct {
|
||||
failures int
|
||||
lockedTill time.Time
|
||||
lastSeen time.Time
|
||||
}
|
||||
|
||||
// loginLimiterIdleTTL：已解锁且超过该时长未活动的 entry 会被 janitor 清理。
|
||||
const loginLimiterIdleTTL = 30 * time.Minute
|
||||
|
||||
var loginLim = &loginLimiter{entries: map[string]*limiterEntry{}}
|
||||
|
||||
// locked 返回该 key 是否处于锁定中。
|
||||
@@ -57,11 +64,16 @@ func (l *loginLimiter) locked(key string) bool {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
e := l.entries[key]
|
||||
return e != nil && time.Now().Before(e.lockedTill)
|
||||
if e == nil {
|
||||
return false
|
||||
}
|
||||
e.lastSeen = time.Now()
|
||||
return time.Now().Before(e.lockedTill)
|
||||
}
|
||||
|
||||
// recordFailure 记一次失败，达到阈值则锁定。
|
||||
func (l *loginLimiter) recordFailure(key string) {
|
||||
// recordFailure 记一次失败，达到 max 阈值则锁定（max<=0 表示该维度不锁）。
|
||||
func (l *loginLimiter) recordFailure(key string, max int) {
|
||||
l.startJanitor()
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
e := l.entries[key]
|
||||
@@ -69,8 +81,8 @@ func (l *loginLimiter) recordFailure(key string) {
|
||||
e = &limiterEntry{}
|
||||
l.entries[key] = e
|
||||
}
|
||||
e.lastSeen = time.Now()
|
||||
e.failures++
|
||||
max := config.C.Session.MaxFailures
|
||||
if max > 0 && e.failures >= max {
|
||||
e.lockedTill = time.Now().Add(time.Duration(config.C.Session.LockMinutes) * time.Minute)
|
||||
e.failures = 0
|
||||
@@ -84,6 +96,26 @@ func (l *loginLimiter) reset(key string) {
|
||||
delete(l.entries, key)
|
||||
}
|
||||
|
||||
// startJanitor 惰性启动后台清理（仅一次）：每 5 分钟淘汰「未锁定且超过 TTL 未活动」的 entry。
|
||||
func (l *loginLimiter) startJanitor() {
|
||||
l.janitorOnce.Do(func() {
|
||||
go func() {
|
||||
t := time.NewTicker(5 * time.Minute)
|
||||
defer t.Stop()
|
||||
for range t.C {
|
||||
now := time.Now()
|
||||
l.mu.Lock()
|
||||
for k, e := range l.entries {
|
||||
if now.After(e.lockedTill) && now.Sub(e.lastSeen) > loginLimiterIdleTTL {
|
||||
delete(l.entries, k)
|
||||
}
|
||||
}
|
||||
l.mu.Unlock()
|
||||
}
|
||||
}()
|
||||
})
|
||||
}
|
||||
|
||||
type AuthService struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
@@ -101,15 +133,27 @@ type TokenPair struct {
|
||||
|
||||
// Login 账号密码登录
|
||||
func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo) (*TokenPair, *model.User, error) {
|
||||
// 两个限流维度：账号维度防针对单账号的密码爆破；IP 维度（阈值更高）防单 IP 撞多个账号、
|
||||
// 以及用随机账号灌爆内存。IP 为空（本地/测试）时退化为仅账号维度。
|
||||
limiterKey := shopCode + "|" + username
|
||||
if loginLim.locked(limiterKey) {
|
||||
ipKey := ""
|
||||
if dev.IP != "" {
|
||||
ipKey = "ip|" + dev.IP
|
||||
}
|
||||
recordFail := func() {
|
||||
loginLim.recordFailure(limiterKey, config.C.Session.MaxFailures)
|
||||
if ipKey != "" {
|
||||
loginLim.recordFailure(ipKey, config.C.Session.IPMaxFailures)
|
||||
}
|
||||
}
|
||||
if loginLim.locked(limiterKey) || (ipKey != "" && loginLim.locked(ipKey)) {
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "locked")
|
||||
return nil, nil, ErrTooManyAttempts
|
||||
}
|
||||
|
||||
var shop model.Shop
|
||||
if err := s.db.Where("code = ?", shopCode).First(&shop).Error; err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
recordFail()
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "invalid_shop")
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
@@ -117,7 +161,7 @@ func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo)
|
||||
var user model.User
|
||||
if err := s.db.Where("shop_id = ? AND username = ? AND deleted_at IS NULL", shop.ID, username).
|
||||
First(&user).Error; err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
recordFail()
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "invalid_user")
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
@@ -128,7 +172,7 @@ func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo)
|
||||
}
|
||||
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
recordFail()
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "bad_password")
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
@@ -193,6 +237,9 @@ func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo)
|
||||
}
|
||||
|
||||
loginLim.reset(limiterKey)
|
||||
if ipKey != "" {
|
||||
loginLim.reset(ipKey)
|
||||
}
|
||||
user.LastLoginAt = &now
|
||||
|
||||
pair, err := s.issueTokens(user.ID, shop.ID, user.Role, sid, jti)
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
"github.com/wangjia/jiu/backend/internal/model"
|
||||
"github.com/wangjia/jiu/backend/testutil"
|
||||
)
|
||||
@@ -146,6 +148,50 @@ func TestAuthService_RefreshTokens_Invalid(t *testing.T) {
|
||||
assert.Nil(t, newPair)
|
||||
}
|
||||
|
||||
// TestLogin_AccountLockoutAfterMaxFailures 同一账号连续失败达阈值后锁定（回归）。
|
||||
func TestLogin_AccountLockoutAfterMaxFailures(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "LOCK_ACC")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
config.C.Session.MaxFailures = 3
|
||||
svc := NewAuthService(db)
|
||||
defer loginLim.reset("LOCK_ACC|admin")
|
||||
|
||||
for i := 0; i < 3; i++ {
|
||||
_, _, err := svc.Login("LOCK_ACC", "admin", "wrong", DeviceInfo{Platform: "windows", IP: "10.0.0.1"})
|
||||
require.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
// 第 4 次即便密码正确也被锁定拒绝。
|
||||
_, _, err := svc.Login("LOCK_ACC", "admin", "password123", DeviceInfo{Platform: "windows", IP: "10.0.0.1"})
|
||||
assert.ErrorIs(t, err, ErrTooManyAttempts)
|
||||
}
|
||||
|
||||
// TestLogin_IPLockoutAcrossAccounts 单 IP 跨多个（不存在的）账号累计失败达 IP 阈值后锁该 IP。
|
||||
// 每次用不同用户名，账号维度永不触发锁定，只有 IP 维度会锁——验证 per-IP 防撞库 + 防内存灌爆。
|
||||
func TestLogin_IPLockoutAcrossAccounts(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
testutil.CreateTestShop(db, "LOCK_IP")
|
||||
config.C.Session.MaxFailures = 5
|
||||
config.C.Session.IPMaxFailures = 4
|
||||
const attackIP = "203.0.113.9"
|
||||
svc := NewAuthService(db)
|
||||
defer loginLim.reset("ip|" + attackIP)
|
||||
|
||||
// 4 次不同用户名（invalid_user），账号 key 各不相同永不锁；IP key 累计到 4 → 锁 IP。
|
||||
for i := 0; i < 4; i++ {
|
||||
uname := "ghost" + strconv.Itoa(i)
|
||||
_, _, err := svc.Login("LOCK_IP", uname, "whatever", DeviceInfo{Platform: "windows", IP: attackIP})
|
||||
require.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
// 同 IP 再来一发（仍是新用户名，账号维度无锁）→ 被 IP 锁拦下。
|
||||
_, _, err := svc.Login("LOCK_IP", "ghostX", "whatever", DeviceInfo{Platform: "windows", IP: attackIP})
|
||||
assert.ErrorIs(t, err, ErrTooManyAttempts)
|
||||
|
||||
// 另一 IP 不受影响。
|
||||
_, _, err = svc.Login("LOCK_IP", "ghostY", "whatever", DeviceInfo{Platform: "windows", IP: "198.51.100.7"})
|
||||
assert.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
|
||||
func TestHashPassword(t *testing.T) {
|
||||
hash, err := HashPassword("mypassword")
|
||||
require.NoError(t, err)
|
||||
|
||||
Reference in New Issue
Block a user