ログインロック

book-rent/src/main/java/com/example/demo/config/CompatiblePasswordEncoder.java

@@ -1,37 +1,37 @@
 package com.example.demo.config;
-
+ 
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
-
+ 
 // データベースに保存されている平文パスワードと、BCryptでハッシュ化されたパスワードの両方を照合できるようにするクラス
 public class CompatiblePasswordEncoder implements PasswordEncoder {
-
+ 
 	// パスワードを安全にハッシュ化するためのクラスを生成
 	private final BCryptPasswordEncoder bcrypt = new BCryptPasswordEncoder();
-
+ 
 	// パスワードのハッシュ化
 	@Override
 	public String encode(CharSequence rawPassword) {
 		return bcrypt.encode(rawPassword);
 	}
-
+ 
 	@Override
 	public boolean matches(
 			CharSequence rawPassword,
 			String encodedPassword) {
-
+ 
 		// 保存済みパスワードが存在するか確認
 		if (encodedPassword == null) {
 			return false;
 		}
-
+ 
 		// 既存の平文パスワードに対応
 		if (!encodedPassword.startsWith("$2a$")
 				&& !encodedPassword.startsWith("$2b$")
 				&& !encodedPassword.startsWith("$2y$")) {
 			return rawPassword.toString().equals(encodedPassword);
 		}
-
+ 
 		// BCrypt形式のパスワードに対応
 		return bcrypt.matches(rawPassword, encodedPassword);
 	}

book-rent/src/main/java/com/example/demo/config/CustomAuthenticationFailureHandler.java

@@ -1,5 +1,5 @@
 package com.example.demo.config;
-
+ 
 import java.io.IOException;
 
 import jakarta.servlet.ServletException;
@@ -11,49 +11,49 @@ import org.springframework.security.web.authentication.SimpleUrlAuthenticationFa
 import org.springframework.stereotype.Component;
 
 import com.example.demo.service.LoginAttemptService;
-
+ 
 // ログイン失敗時の処理
 @Component
 public class CustomAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
-
+ 
 	private LoginAttemptService loginAttemptService;
-
+ 
 	public CustomAuthenticationFailureHandler(LoginAttemptService loginAttemptService) {
 		this.loginAttemptService = loginAttemptService;
 	}
-
+ 
 	@Override
 	public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
 			AuthenticationException exception) throws IOException, ServletException {
-
+ 
 		// 画面から入力されたメールアドレスを取得
 		String mailAddress = request.getParameter("mailAddress");
-
+ 
 		if (mailAddress != null && !mailAddress.isBlank()) {
 			String mail = mailAddress.trim();
-
+ 
 			if (loginAttemptService.isBlocked(mail)) {
 				getRedirectStrategy().sendRedirect(
 						request, response, "/login?error=locked");
 				return;
 			}
-
+ 
 			// 失敗回数を１増やす
 			loginAttemptService.loginFailed(mail);
-
+ 
 			// すでにロック中なら失敗回数を増やさない
 			if (loginAttemptService.isBlocked(mail)) {
 				getRedirectStrategy().sendRedirect(
 						request, response, "/login?error=locked");
 				return;
 			}
-
+ 
 			// あと何回失敗されるとロックされるか取得
 			int remaining = loginAttemptService.getRemainingAttempts(mail);
-
+ 
 			getRedirectStrategy().sendRedirect(
 					request, response, "/login?error=failed&remaining=" + remaining);
 		}
-
+ 
 	}
-}
+}

book-rent/src/main/java/com/example/demo/config/CustomAuthenticationSuccessHandler.java

@@ -1,5 +1,5 @@
 package com.example.demo.config;
-
+ 
 import java.io.IOException;
 
 import jakarta.servlet.ServletException;
@@ -12,37 +12,37 @@ import org.springframework.stereotype.Component;
 
 import com.example.demo.common.Const;
 import com.example.demo.service.LoginAttemptService;
-
+ 
 @Component
 public class CustomAuthenticationSuccessHandler
 		extends SimpleUrlAuthenticationSuccessHandler {
-
+ 
 	private final LoginAttemptService loginAttemptService;
-
+ 
 	public CustomAuthenticationSuccessHandler(
 			LoginAttemptService loginAttemptService) {
 		this.loginAttemptService = loginAttemptService;
 		setDefaultTargetUrl("/menu");
 		setAlwaysUseDefaultTargetUrl(true);
 	}
-
+ 
 	@Override
 	public void onAuthenticationSuccess(
 			HttpServletRequest request,
 			HttpServletResponse response,
 			Authentication authentication)
 			throws IOException, ServletException {
-
+ 
 		if (authentication.getPrincipal() instanceof CustomUserDetails userDetails) {
 			String mail = userDetails.getUsername();
-
+ 
 			loginAttemptService.loginSucceeded(mail);
-
+ 
 			request.getSession(true).setAttribute(
 					Const.SESSION_LOGIN_USER,
 					userDetails.getLoginUser());
 		}
-
+ 
 		super.onAuthenticationSuccess(request, response, authentication);
 	}
 }

book-rent/src/main/java/com/example/demo/config/CustomUserDetails.java

@@ -1,5 +1,5 @@
 package com.example.demo.config;
-
+ 
 import java.util.Collection;
 import java.util.Collections;
 
@@ -9,36 +9,36 @@ import org.springframework.security.core.userdetails.UserDetails;
 
 import com.example.demo.common.LoginUser;
 import com.example.demo.service.LoginAttemptService;
-
+ 
 // システムの社員情報をSpring Securityが扱えるクラスに変更
 public class CustomUserDetails implements UserDetails {
-
+ 
 	private final LoginUser loginUser;
 	private final String password; // DBから取得した暗号化パスワードを保持
 	private final LoginAttemptService loginAttemptService;
-
+ 
 	public CustomUserDetails(LoginUser loginUser, String password, LoginAttemptService loginAttemptService) {
 		this.loginUser = loginUser;
 		this.password = password;
 		this.loginAttemptService = loginAttemptService;
 	}
-
+ 
 	@Override
 	public String getPassword() {
 		return this.password;
 	}
-
+ 
 	@Override
 	public String getUsername() {
 		return loginUser.getMailAddress();
 	}
-
+ 
 	// アカウントのロック状態の確認
 	@Override
 	public boolean isAccountNonLocked() {
 		return !loginAttemptService.isBlocked(getUsername());
 	}
-
+ 
 	
 	// 管理者判定メソッド
 	@Override
@@ -46,29 +46,29 @@ public class CustomUserDetails implements UserDetails {
 		String role = loginUser.isAdmin()
 				? "ROLE_ADMIN"
 				: "ROLE_USER";
-
+ 
 		return Collections.singletonList( // 要素が一つだけの変更できないリストを作るメソッド
 				new SimpleGrantedAuthority(role));
 	}
-
+ 
 	@Override
 	public boolean isAccountNonExpired() {
 		return true;
 	}
-
+ 
 	@Override
 	public boolean isCredentialsNonExpired() {
 		return true;
 	}
-
+ 
 	@Override
 	public boolean isEnabled() {
 		return true;
 	}
-
+ 
 	// ログイン成功後にコントローラー等でLoginUserを取り出すためのゲッター
 	public LoginUser getLoginUser() {
 		return loginUser;
 	}
-
+ 
-}
+}

book-rent/src/main/java/com/example/demo/config/SecurityConfig.java

@@ -1,5 +1,5 @@
 package com.example.demo.config;
-
+ 
 import org.springframework.boot.security.autoconfigure.web.servlet.PathRequest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -7,25 +7,25 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
-
+ 
 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {
-
+ 
 	private final CustomAuthenticationFailureHandler failureHandler;
 	private final CustomAuthenticationSuccessHandler successHandler;
-
+ 
 	public SecurityConfig(
 			CustomAuthenticationFailureHandler failureHandler,
 			CustomAuthenticationSuccessHandler successHandler) {
 		this.failureHandler = failureHandler;
 		this.successHandler = successHandler;
 	}
-
+ 
 	@Bean
 	public SecurityFilterChain securityFilterChain(
 			HttpSecurity http) throws Exception {
-
+ 
 		http
 				.authorizeHttpRequests(authorize -> authorize
 						.requestMatchers(
@@ -47,10 +47,10 @@ public class SecurityConfig {
 						.logoutUrl("/logout")
 						.logoutSuccessUrl("/login?logout")
 						.permitAll());
-
+ 
 		return http.build();
 	}
-
+ 
 	@Bean
 	public PasswordEncoder passwordEncoder() {
 		return new CompatiblePasswordEncoder();

book-rent/src/main/java/com/example/demo/controller/LoginController.java

@@ -1,6 +1,5 @@
-
 package com.example.demo.controller;
-
+ 
 import jakarta.servlet.http.HttpSession;
 
 import org.springframework.stereotype.Controller;
@@ -9,15 +8,15 @@ import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 
 import com.example.demo.common.Const;
-
+ 
 @Controller
 public class LoginController {
-
+ 
     @GetMapping("/")
     public String root() {
         return "redirect:/login";
     }
-
+ 
     @GetMapping("/login")
     public String loginForm(
             HttpSession session,
@@ -25,21 +24,21 @@ public class LoginController {
             @RequestParam(name = "logout", required = false) String logout,
             @RequestParam(name = "remaining", required = false) Integer remaining,
             Model model) {
-
+ 
         // すでにログインしている場合はメニュー画面へ
         if (session.getAttribute(Const.SESSION_LOGIN_USER) != null) {
             return "redirect:/menu";
         }
-
+ 
         // ログイン失敗時のメッセージ
         if ("locked".equals(error)) {
             model.addAttribute(
                 "errorMessage",
                 "ログインに5回連続で失敗したため、10分間アカウントをロックしました。"
             );
-
+ 
         } else if ("failed".equals(error) && remaining != null) {
-
+ 
             if (remaining == 1) {
                 model.addAttribute(
                     "errorMessage",
@@ -53,17 +52,17 @@ public class LoginController {
                     + "回間違えると、10分間ログインできなくなります。"
                 );
             }
-
+ 
         } else if (error != null) {
             model.addAttribute(
                 "errorMessage",
                 "メールアドレスまたはパスワードが間違っています。"
             );
-
+ 
         } else if (logout != null) {
             model.addAttribute("message", "ログアウトしました。");
         }
-
+ 
         return "login";
     }
-}
+}

book-rent/src/main/java/com/example/demo/service/CustomUserDetailsService.java

@@ -1,5 +1,5 @@
 package com.example.demo.service;
-
+ 
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
@@ -10,28 +10,28 @@ import com.example.demo.common.LoginUser;
 import com.example.demo.config.CustomUserDetails;
 import com.example.demo.entity.Employee;
 import com.example.demo.repository.EmployeeRepository;
-
+ 
 //Spring Securityから依頼を受けて、ログインする社員情報をDBから取得
 @Service
 public class CustomUserDetailsService implements UserDetailsService {
-
+ 
 	private final EmployeeRepository employeeRepository;
 	private final LoginAttemptService loginAttemptService;
-
+ 
 	public CustomUserDetailsService(
 			EmployeeRepository employeeRepository,
 			LoginAttemptService loginAttemptService) {
 		this.employeeRepository = employeeRepository;
 		this.loginAttemptService = loginAttemptService;
 	}
-
+ 
 	@Override
 	public UserDetails loadUserByUsername(String maillAddress) throws UsernameNotFoundException {
-
+ 
 		Employee employee = employeeRepository.findByMailAddressAndFlgRetirement(maillAddress.trim(), Const.RETIRE_NO)
 				.orElseThrow(() -> new UsernameNotFoundException("認証に失敗しました。"));
 				// ↑社員情報が見つからない場合は例外処理
-
+ 
 		// 取得したEmployeeをLoginUserに変換する
 		LoginUser loginUser = new LoginUser(
 				employee.getIdEmployee(),
@@ -39,9 +39,9 @@ public class CustomUserDetailsService implements UserDetailsService {
 				employee.getKnEmployee(),
 				employee.getMailAddress(),
 				employee.getFlgAdmin());
-
+ 
 		// Spring Security用の形式に変換
 		return new CustomUserDetails(loginUser, employee.getPassword(), loginAttemptService);
 	}
-
+ 
-}
+}

book-rent/src/main/java/com/example/demo/service/LoginAttemptService.java

@@ -1,101 +1,101 @@
 package com.example.demo.service;
-
+ 
 import java.time.LocalDateTime;
 import java.util.Locale;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 
 import org.springframework.stereotype.Service;
-
+ 
 // 失敗回数とロック時間を管理
 @Service
 public class LoginAttemptService {
-
+ 
 	// 最大失敗回数
 	private static final int MAX_ATTEMPTS = 5;
 	// ロック時間
 	private static final int LOCK_MINUTES = 10;
-
+ 
 	// 失敗回数を保存
 	private final ConcurrentMap<String, AttemptState> attempts = new ConcurrentHashMap<>();
-
+ 
 	public static class AttemptState {
 		// 何回失敗したか
 		private final int failedAttempts;
 		// いつロックを解除するか
 		private final LocalDateTime lockedUntil;
-
+ 
 		private AttemptState(int failedAttempts, LocalDateTime lockedUntil) {
 			this.failedAttempts = failedAttempts;
 			this.lockedUntil = lockedUntil;
 		}
 	}
-
+ 
 	private String normalize(String mailAddress) {
 		return mailAddress.trim().toLowerCase(Locale.ROOT);
 	}
-
+ 
 	// ログイン失敗時
 	public void loginFailed(String mailAddress) {
 		String mail = normalize(mailAddress);
 		LocalDateTime now = LocalDateTime.now();
 		AttemptState current = attempts.get(mail);
-
+ 
 		// ロック中なら何もしない
 		if (current != null && current.lockedUntil != null
-				&& now.isBefore(current.lockedUntil)) {
+&& now.isBefore(current.lockedUntil)) {
 			return;
 		}
-
+ 
 		// 失敗回数を数える
 		int count = (current == null || current.lockedUntil != null)
 				? 1
 				: current.failedAttempts + 1;
-
+ 
 		// 5回失敗したら10分間ロック
 		LocalDateTime lockTime = count >= MAX_ATTEMPTS
 				? now.plusMinutes(LOCK_MINUTES)
 				: null;
-
+ 
 		// 失敗回数とロック時間を保存
 		attempts.put(mail, new AttemptState(count, lockTime));
 	}
-
+ 
 	// 現在ロック中かどうか判定
 	public boolean isBlocked(String mailAddress) {
 		String mail = normalize(mailAddress);
 		AttemptState current = attempts.get(mail);
-
+ 
 		if (current == null) {
 			return false;
 		}
 		if (current.lockedUntil == null) {
 			return false;
 		}
-
+ 
 		// 10分経過したらロックを解除
 		if (!LocalDateTime.now().isBefore(current.lockedUntil)) {
 			attempts.remove(mail);
 			return false;
 		}
-
+ 
 		return true;
-
+ 
 	}
-
+ 
 	// ログイン成功時に、過去の失敗回数をきれいにリセットする
 	public void loginSucceeded(String mailAddress) {
 		attempts.remove(normalize(mailAddress));
 	}
-
+ 
 	public int getFailedAttempts(String mailAddress) {
 		AttemptState state = attempts.get(normalize(mailAddress));
 		return state == null ? 0 : state.failedAttempts;
 	}
-
+ 
 	public int getRemainingAttempts(String mailAddress) {
 		int failed = getFailedAttempts(mailAddress);
 		return Math.max(0, MAX_ATTEMPTS - failed);
 	}
-
+ 
-}
+}