Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
io.github.guwan:lead-captcha
Advanced tools
Java web graphics verification code, support spring boot 3.0 and jdk17.
Java图形验证码,支持gif、中文、算术等类型,可用于Java Web、JavaSE等项目,主要添加了对spring boot3 和jdk17的支持。
算术类型:
中文类型:
内置字体:
dependencies {
implementation 'top.knos:lead-captcha:0.0.2'
}
<dependencies>
<dependency>
<groupId>com.github.guwan</groupId>
<artifactId>lead-captcha</artifactId>
<version>0.0.2</version>
</dependency>
</dependencies>
将需要验证码放入session中
@Controller
public class CaptchaController {
@RequestMapping("/captcha")
public void captcha(HttpServletRequest request, HttpServletResponse response) throws Exception {
SessionCaptchaUtil.out(request, response);
}
}
如果你是单机模式 可以这样使用,他默认是5分钟过期,你可以传入过期时间等更好的控制
@GetMapping("/captcha")
public void captcha(@RequestParam String captchaKey, HttpServletResponse response) throws Exception {
LocalCaptchaUtil.out(captchaKey, response);
}
验证码验证
LocalCaptchaUtil.verify(code, captchaKey);
输出base64格式验证码
/**
* 获取Base64处理的的图形校验码
*/
@GetMapping("/captcha/base64")
@ResponseBody
public Result<String> captchaBase64(@RequestParam String captchaKey) throws Exception {
return Result.ok(Base64LocalCaptchaUtil.out(captchaKey));
}
集群模式推荐参照LocalCaptchaUtil写一个。
前端html代码:
<img src="/captcha" width="130px" height="48px" />
不要忘了把
/captcha
路径排除登录拦截,比如shiro的拦截。
前端html代码:
```html
<img src="/captcha" width="130px" height="48px" />
@Controller
public class LoginController {
@PostMapping("/login")
public JsonResult login(String username,String password,String verCode){
if (!CaptchaUtil.ver(verCode, request)) {
CaptchaUtil.clear(request); // 清除session中的验证码
return JsonResult.error("验证码不正确");
}
}
}
@Controller
public class CaptchaController {
@RequestMapping("/captcha")
public void captcha(HttpServletRequest request, HttpServletResponse response) throws Exception {
// 设置位数
CaptchaUtil.out(5, request, response);
// 设置宽、高、位数
CaptchaUtil.out(130, 48, 5, request, response);
// 使用gif验证码
GifCaptcha gifCaptcha = new GifCaptcha(130,48,4);
CaptchaUtil.out(gifCaptcha, request, response);
}
}
CaptchaUtil封装了输出验证码、存session、判断验证码等功能,也可以不使用此工具类:
@Controller
public class CaptchaController {
@RequestMapping("/captcha")
public void captcha(HttpServletRequest request, HttpServletResponse response) throws Exception {
// 设置请求头为输出图片类型
response.setContentType("image/gif");
response.setHeader("Pragma", "No-cache");
response.setHeader("Cache-Control", "no-cache");
response.setDateHeader("Expires", 0);
// 三个参数分别为宽、高、位数
SpecCaptcha pngCaptcha = new SpecCaptcha(130, 48, 5);
// 设置字体
pngCaptcha.setFont(new Font("Verdana", Font.PLAIN, 32)); // 有默认字体,可以不用设置
// 设置类型,纯数字、纯字母、字母数字混合
pngCaptcha.setCharType(Captcha.TYPE_ONLY_NUMBER);
// 验证码存入session
request.getSession().setAttribute("captcha", pngCaptcha.text().toLowerCase());
// 输出图片流
pngCaptcha.out(response.getOutputStream());
}
@PostMapping("/login")
public JsonResult login(String username,String password,String verCode){
// 获取session中的验证码
String sessionCode = request.getSession().getAttribute("captcha");
// 判断验证码
if (verCode==null || !sessionCode.equals(verCode.trim().toLowerCase())) {
return JsonResult.error("验证码不正确");
}
}
}
public class Test {
public static void main(String[] args) {
// png类型
SpecCaptcha captcha = new SpecCaptcha(130, 48);
captcha.text(); // 获取验证码的字符
captcha.textChar(); // 获取验证码的字符数组
// gif类型
GifCaptcha captcha = new GifCaptcha(130, 48);
// 中文类型
ChineseCaptcha captcha = new ChineseCaptcha(130, 48);
// 中文gif类型
ChineseGifCaptcha captcha = new ChineseGifCaptcha(130, 48);
// 算术类型
ArithmeticCaptcha captcha = new ArithmeticCaptcha(130, 48);
captcha.setLen(3); // 几位数运算,默认是两位
captcha.getArithmeticString(); // 获取运算的公式:3+2=?
captcha.text(); // 获取运算的结果:5
captcha.out(outputStream); // 输出验证码
}
}
注意:
算术验证码的len表示是几位数运算,而其他验证码的len表示验证码的位数,算术验证码的text()表示的是公式的结果, 对于算术验证码,你应该把公式的结果存储session,而不是公式。
类型 | 描述 |
---|---|
TYPE_DEFAULT | 数字和字母混合 |
TYPE_ONLY_NUMBER | 纯数字 |
TYPE_ONLY_CHAR | 纯字母 |
TYPE_ONLY_UPPER | 纯大写字母 |
TYPE_ONLY_LOWER | 纯小写字母 |
TYPE_NUM_AND_UPPER | 数字和大写字母 |
使用方法:
SpecCaptcha captcha = new SpecCaptcha(130, 48, 5);
captcha.setCharType(Captcha.TYPE_ONLY_NUMBER);
只有
SpecCaptcha
和GifCaptcha
设置才有效果。
内置字体:
字体 | 效果 |
---|---|
Captcha.FONT_1 | |
Captcha.FONT_2 | |
Captcha.FONT_3 | |
Captcha.FONT_4 | |
Captcha.FONT_5 | |
Captcha.FONT_6 | |
Captcha.FONT_7 | |
Captcha.FONT_8 | |
Captcha.FONT_9 | |
Captcha.FONT_10 |
使用方法:
SpecCaptcha captcha = new SpecCaptcha(130, 48, 5);
// 设置内置字体
captcha.setFont(Captcha.FONT_1);
// 设置系统字体
captcha.setFont(new Font("楷体", Font.PLAIN, 28));
SpecCaptcha pngCaptcha = new SpecCaptcha(130, 48, 5);
pngCaptcha.toBase64();
// 如果不想要base64的头部data:image/png;base64,
pngCaptcha.toBase64(""); // 加一个空的参数即可
FileOutputStream outputStream = new FileOutputStream(new File("C:/captcha.png"))
SpecCaptcha pngCaptcha = new SpecCaptcha(130, 48, 5);
pngCaptcha.out(outputStream);
前后端分离项目建议不要存储在session中,存储在redis中,redis存储需要一个key,key一同返回给前端用于验证输入:
@Controller
public class CaptchaController {
@Autowired
private RedisUtil redisUtil;
@ResponseBody
@RequestMapping("/captcha")
public JsonResult captcha(HttpServletRequest request, HttpServletResponse response) throws Exception {
SpecCaptcha pngCaptcha = new SpecCaptcha(130, 48, 5);
String verCode = pngCaptcha.text().toLowerCase();
String key = UUID.randomUUID().toString();
// 存入redis并设置过期时间为30分钟
redisUtil.setEx(key, verCode, 30, TimeUnit.MINUTES);
// 将key和base64返回给前端
return JsonResult.ok().put("key", key).put("image", pngCaptcha.toBase64());
}
@ResponseBody
@PostMapping("/login")
public JsonResult login(String username,String password,String verCode,String verKey){
// 获取redis中的验证码
String redisCode = redisUtil.get(verKey);
// 判断验证码
if (verCode==null || !redisCode.equals(verCode.trim().toLowerCase())) {
return JsonResult.error("验证码不正确");
}
}
}
前端使用ajax获取验证码:
<img id="verImg" width="130px" height="48px"/>
<script>
var verKey;
// 获取验证码
$.get('/captcha', function(res) {
verKey = res.key;
$('#verImg').attr('src', res.image);
},'json');
// 登录
$.post('/login', {
verKey: verKey,
verCode: '8u6h',
username: 'admin',
password: 'admin'
}, function(res) {
console.log(res);
}, 'json');
</script>
RedisUtil到这里获取https://gitee.com/whvse/RedisUtil
继承Captcha
实现out
方法,中文验证码可继承ChineseCaptchaAbstract
,算术验证码可继承ArithmeticCaptchaAbstract
。
增加10种漂亮的内置字体,不依赖系统字体
增加算术验证码,运算位数可自由配置
增加输出base64编码的功能
增加贝塞尔曲线作为干扰线
增加纯大写字母、纯小写字母、数字和大写字母配置
增加中文验证码、中文gif验证码
增加抗锯齿效果,优化文字颜色
增加CaptchaUtil便于Web项目使用
从https://gitee.com/ele-admin/EasyCaptcha fork来到原始版本代码
FAQs
Java web graphics verification code, support spring boot 3.0 and jdk17.
We found that io.github.guwan:lead-captcha demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.