如何在 Java 中使用 HttpSession 跟踪登录尝试？

How to track login attempts using HttpSession in Java?

提问by Marta

I have a no-framework web application. I need to implement a simple way to check unsuccessful logins, using sessions. If the user attempts to log in 3 times using incorrect username/password combination, they will be given a 20 minute timeout before they can try logging in again.

我有一个无框架的 Web 应用程序。我需要实现一种简单的方法来检查不成功的登录，使用会话。如果用户尝试使用错误的用户名/密码组合登录 3 次，他们将有 20 分钟的超时时间才能再次尝试登录。

Currently I only set a user session if the user successfully logs in to the system. However, it seems that I should get a session in case of unsuccessful login also, and count the login attempts somehow.

目前我只在用户成功登录系统时设置用户会话。但是，如果登录失败，我似乎也应该获取会话，并以某种方式计算登录尝试次数。

Login.jsp (simplified version):

Login.jsp（简化版）：

<form name="loginForm" method="post" action="CustomerData">
User name:<input type="text" name="userName"/>
Password:<input type="password" name="password"/>
<input type="button" value="submit">

CustomerData.java (simplified version):

CustomerData.java（简化版）：

// See if customer is a valid user
        String selectQuery = "Select firstName,lastName,email from customer where userName='"+userName+"' and password='"+password+"'";
        selectResult = statement.executeQuery(selectQuery);

if(selectResult.next())
{
    // We got a valid user, let's log them in
    ....
    HttpSession session = request.getSession(true);
    session.setAttribute("customer", customer);
}
else
{
    // this is where I need to get the session id (??),
    // count the unsuccessful login attempts somehow, 
    //and give them a 20 minutes timeout before they can try logging in again.

    request.setAttribute("message","Invalid username or password. Please try again!");

}

While doing research, I found that there are a lot of built-in security features for various Java frameworks. I also found that using sessions is not the best way to track login attempts, because the user can log-in with different browsers. However, I'm creating this functionality for a simple web project that will never go to any production environment. I would like to know how to implement this functionality using the Java HTTPSession Object.

在做研究的过程中，我发现各种 Java 框架都有很多内置的安全功能。我还发现使用会话并不是跟踪登录尝试的最佳方式，因为用户可以使用不同的浏览器登录。但是，我正在为一个永远不会进入任何生产环境的简单 Web 项目创建此功能。我想知道如何使用 Java HTTPSession 对象来实现这个功能。

Ok, here is my full solution, based on the feedback I received. I'm posting this in case it might help others with similar issues:

好的，这是我的完整解决方案，基于我收到的反馈。我发布这个以防它可能会帮助其他有类似问题的人：

// See if customer is a valid user
String selectQuery = "Select firstName,lastName,email from customer where userName='"+userName+"' and password='"+password+"'";
selectResult = statement.executeQuery(selectQuery);

        if(selectResult.next())
        {
            // We got a valid user, let's log them in
            Customer customer = new Customer();
            customer.setFirstName(selectResult.getString("firstName"));
            customer.setLastName(selectResult.getString("lastName"));
            customer.setEmail(selectResult.getString("email"));
            customer.setUserName(userName);
            customer.setPassword(password);

            // establish a user session
            session.setAttribute("customer", customer);
            session.setAttribute("firstName", customer.getFristName());
            url = "/index.jsp";
            selectResult.close();

        }
        else
        {
            int loginAttempt;
            if (session.getAttribute("loginCount") == null)
            {
                session.setAttribute("loginCount", 0);
                loginAttempt = 0;
            }
            else
            {
                 loginAttempt = (Integer) session.getAttribute("loginCount");
            }

            //this is 3 attempt counting from 0,1,2
            if (loginAttempt >= 2 )
            {        
                long lastAccessedTime = session.getLastAccessedTime();
                date = new Date();
                long currentTime = date.getTime();
                long timeDiff = currentTime - lastAccessedTime;
                // 20 minutes in milliseconds  
                if (timeDiff >= 1200000)
                {
                    //invalidate user session, so they can try again
                    session.invalidate();
                }
                else
                {
                     // Error message 
                     session.setAttribute("message","You have exceeded the 3 failed login attempt. Please try loggin in in 20 minutes, or call our customer service center at 1-800 555-1212.");
                }  

            }
            else
            {
                 loginAttempt++;
                 int allowLogin = 3-loginAttempt;
                 session.setAttribute("message","loginAttempt= "+loginAttempt+". Invalid username or password. You have "+allowLogin+" attempts remaining. Please try again! <br>Not a registered cusomer? Please <a href=\"register.jsp\">register</a>!");
            }
            session.setAttribute("loginCount",loginAttempt);
            url = "/login.jsp";

        }

        RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(url);
        dispatcher.forward(request, response);

采纳答案by Bhavik Ambani

You can try the below code

你可以试试下面的代码

int loginAttempt = (Integer)session.getAttribute("loginCount");

if (loginAttempt > 3 ){
     // Error message/page redirection 
}else{
     session.setAttribute("loginCount",loginAttempt++);
}