Code Monkey home page Code Monkey logo

spring-security-jwt's Introduction

spring-security-jwt's People

Contributors

dependabot[bot] avatar xstressr avatar yifanzheng avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar

Forkers

ling999 fluagen lysander086 flywind2 huoyijie wukongtime yky32 moder1122 ajunboys muyi0813 renduy lyonleelpl pilihuo0312 xstressr satoxulei rrf100 li-guohao nyx-2001 ximidefeng thomastao0215 huohuoisalan acctzcw vemtk hhfff han1eng sxfss roy-ly kaister3 lzl37 wangzaixing iqnren

spring-security-jwt's Issues

master分支无法启动的问题

您好，在你升级后swagger2.10.0版本后，原来的EnableSwagger2注解被禁用，取而代之的EnableSwagger2WebMvc，并需要添加spring-plugin-core的2.0.0.RELEASE版本，不知道我可不可以提交我的分支来完善这个版本，很感谢题主的项目给我一个spring security的很好学习案例

重放攻击

重放攻击（Replay Attacks）又称重播攻击、回放攻击，这种攻击会不断恶意或欺诈性地重复一个有效的请求。攻击者利用网络监听或者其他方式盗取请求内容，进行一定的处理后，再把它重新发给认证服务器，是黑客常用的攻击方式之一。

简单地说，重放攻击就是请求被未认证的系统（或黑客）截获，未认证的系统可以携带请求中的内容（认证信息），伪装成已认证的系统来访问我们的接口。

常用防重放攻击手段

在请求中引入一个随机变量，让每次接口请求生成的内容（认证信息）都不一样。比如，可以选择时间戳作为随机变量。服务端接收到请求后，验证当前时间戳跟传递过来的时间戳，是否在一定的时间窗口内（比如 60s）。如果超过 60s，则认为请求信息已经过期，拒绝请求。如果在时间窗口内，则认为请求信息没有过期，就再进行信息认证。如果认证成功，就允许请求；否则，就拒绝请求。

不过，这种方式无法完全防止重放攻击，若重放攻击刚好在时间窗口内，就无法防止。但是，攻与防是相对的，没有绝对的安全。我们能做的就是，尽量提高攻击成本，使用合适的方式即可。

关于登陆方法

您好,我刚学Spring Security.我看到您在AuthService的authLogin方法中进行了SecurityContextHolder.getContext().setAuthentication(authentication);,我想问在登陆方法这样做是为什么,我认为只是一个登陆方法的话不需要设置authentication.我查阅资料,SecurityContextHolder是通过ThreadLocal实现的,当response返回出去后,这个authentication立刻会被Spring Security自动清除.所以这个设置看起来没什么意义.如果是我理解错了,希望您能告诉我,谢谢.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.