From ecad3666fe64603a5aa3994a360f440758664b9f Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期三, 26 八月 2026 13:50:01 +0800
Subject: [PATCH] 增加管理后台登录频次校验和连续错误登录后限制登录 修改管理后台验证码生成和登录校验
---
ruoyi-auth/src/main/java/com/ruoyi/auth/service/SysLoginService.java | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/ruoyi-auth/src/main/java/com/ruoyi/auth/service/SysLoginService.java b/ruoyi-auth/src/main/java/com/ruoyi/auth/service/SysLoginService.java
index 94db0b3..5fd2cc8 100644
--- a/ruoyi-auth/src/main/java/com/ruoyi/auth/service/SysLoginService.java
+++ b/ruoyi-auth/src/main/java/com/ruoyi/auth/service/SysLoginService.java
@@ -47,8 +47,10 @@
* 登录
*/
public LoginUser login(String username, String password, HttpServletRequest request) {
- loginRateLimitService.checkLoginRate(username, request);
username = StringUtils.trim(username);
+ // 优先校验账号是否已锁定（锁定期内直接提示，避免被限流提示掩盖）
+ passwordService.checkLocked(username, request);
+ loginRateLimitService.checkLoginRate(username);
// 查询用户信息
R<LoginUser> userResult = remoteUserService.getUserInfo(username, SecurityConstants.INNER);
@@ -97,6 +99,8 @@
throw new ServiceException("对不起，您的账号：" + username + " 已停用");
}
passwordService.validate(user, password, request);
+ // 登录成功，清除账号维度的登录限流计数，避免正常用户短时间再次登录被误伤
+ loginRateLimitService.clearAccountRecord(username);
recordLogService.recordLogininfor(request, user.getUserId().intValue(), username, Constants.LOGIN_SUCCESS_STATUS, "登录成功");
return userInfo;
}
--
Gitblit v1.7.1