+ * 系统授权日志表 Mapper 接口 + *
+ * + * @author AuthoritySystem + * @since 2025-07-19 14:26:58 + */ +@Mapper +public interface AuthLogMapper extends BaseMapperSpring Security推荐使用BCrypt、PBKDF2、Argon2或Scrypt等自适应单向函数替代MD5。
* - * @see org.springframework.security.crypto.password.PasswordEncoder + * @see PasswordEncoder * 一般仅用于遗留系统兼容,新系统应使用更安全的密码编码器 */ -// public class MD5PasswordEncoder implements PasswordEncoder { -// -// @Override -// public String encode(CharSequence rawPassword) { -// if (rawPassword == null) { -// throw new IllegalArgumentException("原始密码不能为null"); -// } -// -// byte[] md5Digest = DigestUtils.md5Digest(rawPassword.toString().getBytes()); -// return HexFormat.of().formatHex(md5Digest); -// } -// -// @Override -// public boolean matches(CharSequence rawPassword, String encodedPassword) { -// if (rawPassword == null) { -// throw new IllegalArgumentException("原始密码不能为null"); -// } -// -// if (!StringUtils.hasText(encodedPassword)) { -// return false; -// } -// -// return encodedPassword.equalsIgnoreCase(encode(rawPassword)); -// } -// -// @Override -// public boolean upgradeEncoding(String encodedPassword) { -// // MD5已不安全,始终返回true建议升级到更安全的算法 -// return true; -// } -// } \ No newline at end of file +public class MD5PasswordEncoder implements PasswordEncoder { + + @Override + public String encode(CharSequence rawPassword) { + if (rawPassword == null) { + throw new IllegalArgumentException("原始密码不能为null"); + } + + byte[] md5Digest = DigestUtils.md5Digest(rawPassword.toString().getBytes()); + return HexFormat.of().formatHex(md5Digest); + } + + @Override + public boolean matches(CharSequence rawPassword, String encodedPassword) { + if (rawPassword == null) { + throw new IllegalArgumentException("原始密码不能为null"); + } + + if (!StringUtils.hasText(encodedPassword)) { + return false; + } + + return encodedPassword.equalsIgnoreCase(encode(rawPassword)); + } + + @Override + public boolean upgradeEncoding(String encodedPassword) { + // MD5已不安全,始终返回true建议升级到更安全的算法 + return true; + } +} \ No newline at end of file diff --git a/auth-module/module-security/src/main/java/com/auth/module/security/config/properties/SecurityConfigProperties.java b/auth-module/module-security/src/main/java/com/auth/module/security/config/properties/SecurityConfigProperties.java new file mode 100644 index 0000000..54f14e9 --- /dev/null +++ b/auth-module/module-security/src/main/java/com/auth/module/security/config/properties/SecurityConfigProperties.java @@ -0,0 +1,27 @@ +package com.auth.module.security.config.properties; + +import io.swagger.v3.oas.annotations.media.Schema; +import lombok.Getter; +import lombok.Setter; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.context.annotation.Configuration; + +import java.util.List; + +@Getter +@Setter +@Configuration +@ConfigurationProperties(prefix = "security-path") +@Schema(name = "SecurityPathsProperties对象", description = "路径忽略和认证") +public class SecurityConfigProperties { + + @Schema(name = "noAuthPaths", description = "不用认证的路径") + public List