企业级 Java 登录注册系统构建指南：核心代码与配置

设计要点

• 密码必须使用 BCrypt 或 SHA-256 + 盐值加密存储，严禁明文。
• 增加 login_attempts 和 locked_until 字段，防止暴力破解。
• 记录 last_login_time 便于安全审计。

3. 核心实体类

User 实体类需实现 Serializable 接口以便会话存储，同时利用 Lombok 简化代码。

import java.io.Serializable;
import java.util.Date;
import lombok.Data;
import lombok.NoArgsConstructor;

/**
 * 用户实体类
 */
@Data
@NoArgsConstructor
public class User implements Serializable {
    private static final long serialVersionUID = 1L;

    private Long id;
    private String username;
    private String email;
    private String password;
    private String salt;
    private Integer status;
    private Date createTime;
    private Date updateTime;
    private Date lastLoginTime;
    private Integer loginAttempts;
    private Date lockedUntil;

    /**
     * 判断账户是否被锁定
     * @return true：已锁定，false：未锁定
     */
    public boolean isAccountLocked() {
        return lockedUntil != null && lockedUntil.after(new Date());
    }

    /**
     * 判断账户是否启用
     * @return true：启用，false：禁用
     */
    public boolean isEnabled() {
        return status == 1;
    }

    @Override
    public String toString() {
        return "User{id=" + id + ", username='" + username + "'}";
    }
}

4. 安全工具类

密码安全是重中之重。这里提供基础的加盐哈希实现，生产环境建议直接使用 Spring Security 的 BCryptEncoder。

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;

/**
 * 安全工具类
 * 提供密码加密、盐值生成、密码验证等安全相关操作
 */
public class SecurityUtil {

    /**
     * 生成随机盐值（16 字节）
     * @return Base64 编码的盐值字符串
     */
    public static String generateSalt() {
        SecureRandom random = new SecureRandom();
        byte[] salt = new byte[16];
        random.nextBytes(salt);
        return Base64.getEncoder().encodeToString(salt);
    }

    /**
     * 使用 SHA-256 算法加密密码
     * @param password 原始密码
     * @param salt 盐值
     * @return 加密后的密码（Base64 编码）
     */
    public static String hashPassword(String password, String salt) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-256");
            md.update(salt.getBytes());
            byte[] hashedPassword = md.digest(password.getBytes());
            return Base64.getEncoder().encodeToString(hashedPassword);
        } catch (Exception e) {
            throw new RuntimeException("密码加密失败", e);
        }
    }

    /**
     * 验证密码是否匹配
     * @param inputPassword 输入的原始密码
     * @param storedPassword 存储的加密后密码
     * @param salt 盐值
     * @return true：匹配，false：不匹配
     */
    public static boolean verifyPassword(String inputPassword, String storedPassword, String salt) {
        String hashedInput = hashPassword(inputPassword, salt);
        return hashedInput.equals(storedPassword);
    }

    /**
     * 生成随机 Token（32 字节）
     * 用于会话管理、身份验证等场景
     * @return Base64 编码的 Token 字符串
     */
    public static String generateToken() {
        SecureRandom random = new SecureRandom();
        byte[] token = new byte[32];
        random.nextBytes(token);
        return Base64.getEncoder().encodeToString(token);
    }
}

安全提示

• 永远不要明文存储密码。
• 每个密码必须使用独立的盐值。
• 实施密码强度策略。

5. 数据访问层 (DAO)

DAO 层负责与数据库交互，这里使用原生 JDBC 演示核心逻辑，实际项目中常配合 MyBatis 或 JPA。

UserDAO 接口

import java.util.Date;

/**
 * 用户数据访问接口
 */
public interface UserDAO {
    User findByUsername(String username);
    User findByEmail(String email);
    boolean save(User user);
    boolean updateLastLoginTime(Long userId);
    boolean updateLoginAttempts(Long userId, int attempts);
    boolean lockAccount(Long userId, Date lockUntil);
}

UserDAOImpl 实现

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Timestamp;
import java.util.Date;

public class UserDAOImpl implements UserDAO {
    private final Connection connection;

    public UserDAOImpl(Connection connection) {
        this.connection = connection;
    }

    @Override
    public User findByUsername(String username) {
        String sql = "SELECT * FROM users WHERE username = ?";
        try (PreparedStatement stmt = connection.prepareStatement(sql)) {
            stmt.setString(1, username);
            ResultSet rs = stmt.executeQuery();
            if (rs.next()) {
                return mapResultSetToUser(rs);
            }
        } catch (SQLException e) {
            throw new RuntimeException("根据用户名查询用户失败：" + username, e);
        }
        return null;
    }

    @Override
    public User findByEmail(String email) {
        String sql = "SELECT * FROM users WHERE email = ?";
        try (PreparedStatement stmt = connection.prepareStatement(sql)) {
            stmt.setString(1, email);
            ResultSet rs = stmt.executeQuery();
            if (rs.next()) {
                return mapResultSetToUser(rs);
            }
        } catch (SQLException e) {
            throw new RuntimeException("根据邮箱查询用户失败：" + email, e);
        }
        return null;
    }

    @Override
    public boolean save(User user) {
        String sql = "INSERT INTO users (username, email, password, salt) VALUES (?, ?, ?, ?)";
        try (PreparedStatement stmt = connection.prepareStatement(sql)) {
            stmt.setString(1, user.getUsername());
            stmt.setString(2, user.getEmail());
            stmt.setString(3, user.getPassword());
            stmt.setString(4, user.getSalt());
            return stmt.executeUpdate() > 0;
        } catch (SQLException e) {
            throw new RuntimeException("保存用户失败：" + user.getUsername(), e);
        }
    }

    @Override
    public boolean updateLastLoginTime(Long userId) {
        String sql = "UPDATE users SET last_login_time = CURRENT_TIMESTAMP WHERE id = ?";
        try (PreparedStatement stmt = connection.prepareStatement(sql)) {
            stmt.setLong(1, userId);
            return stmt.executeUpdate() > 0;
        } catch (SQLException e) {
            throw new RuntimeException("更新用户最后登录时间失败：" + userId, e);
        }
    }

    @Override
    public boolean updateLoginAttempts(Long userId, int attempts) {
        String sql = "UPDATE users SET login_attempts = ?, update_time = CURRENT_TIMESTAMP WHERE id = ?";
        try (PreparedStatement stmt = connection.prepareStatement(sql)) {
            stmt.setInt(1, attempts);
            stmt.setLong(2, userId);
            return stmt.executeUpdate() > 0;
        } catch (SQLException e) {
            throw new RuntimeException("更新用户登录失败次数失败：" + userId, e);
        }
    }

    @Override
    public boolean lockAccount(Long userId, Date lockUntil) {
        String sql = "UPDATE users SET locked_until = ?, update_time = CURRENT_TIMESTAMP WHERE id = ?";
        try (PreparedStatement stmt = connection.prepareStatement(sql)) {
            stmt.setTimestamp(1, new Timestamp(lockUntil.getTime()));
            stmt.setLong(2, userId);
            return stmt.executeUpdate() > 0;
        } catch (SQLException e) {
            throw new RuntimeException("锁定用户账户失败：" + userId, e);
        }
    }

    private User mapResultSetToUser(ResultSet rs) throws SQLException {
        User user = new User();
        user.setId(rs.getLong("id"));
        user.setUsername(rs.getString("username"));
        user.setEmail(rs.getString("email"));
        user.setPassword(rs.getString("password"));
        user.setSalt(rs.getString("salt"));
        user.setStatus(rs.getInt("status"));
        user.setCreateTime(rs.getTimestamp("create_time"));
        user.setUpdateTime(rs.getTimestamp("update_time"));
        user.setLastLoginTime(rs.getTimestamp("last_login_time"));
        user.setLoginAttempts(rs.getInt("login_attempts"));
        user.setLockedUntil(rs.getTimestamp("locked_until"));
        return user;
    }
}

6. 业务逻辑层 (Service)

Service 层汇聚了注册、登录的核心逻辑，包括参数校验、状态检查和异常处理。

import java.util.Date;

public class UserService {
    private final UserDAO userDAO;
    private static final int MAX_LOGIN_ATTEMPTS = 5;
    private static final long LOCK_DURATION = 30 * 60 * 1000; // 30 分钟

    public UserService(UserDAO userDAO) {
        this.userDAO = userDAO;
    }

    /**
     * 用户注册
     */
    public boolean register(String username, String email, String password) {
        if (!isValidUsername(username) || !isValidEmail(email) || !isValidPassword(password)) {
            throw new IllegalArgumentException("参数格式不正确：用户名 3-50 位，邮箱格式正确，密码至少 6 位");
        }
        if (userDAO.findByUsername(username) != null) {
            throw new RuntimeException("用户名已存在");
        }
        if (userDAO.findByEmail(email) != null) {
            throw new RuntimeException("邮箱已存在");
        }

        String salt = SecurityUtil.generateSalt();
        String hashedPassword = SecurityUtil.hashPassword(password, salt);

        User user = new User();
        user.setUsername(username);
        user.setEmail(email);
        user.setPassword(hashedPassword);
        user.setSalt(salt);
        return userDAO.save(user);
    }

    /**
     * 用户登录
     */
    public User login(String username, String password) {
        User user = userDAO.findByUsername(username);
        if (user == null) {
            throw new RuntimeException("用户不存在");
        }
        if (!user.isEnabled()) {
            throw new RuntimeException("账户已被禁用");
        }
        if (user.isAccountLocked()) {
            throw new RuntimeException("账户已被锁定，请稍后再试");
        }

        if (!SecurityUtil.verifyPassword(password, user.getPassword(), user.getSalt())) {
            handleLoginFailure(user);
        }

        handleLoginSuccess(user);
        return user;
    }

    private void handleLoginFailure(User user) {
        int attempts = user.getLoginAttempts() + 1;
        userDAO.updateLoginAttempts(user.getId(), attempts);
        if (attempts >= MAX_LOGIN_ATTEMPTS) {
            Date lockUntil = new Date(System.currentTimeMillis() + LOCK_DURATION);
            userDAO.lockAccount(user.getId(), lockUntil);
            throw new RuntimeException("登录失败次数过多，账户已被锁定 30 分钟");
        }
        throw new RuntimeException("密码错误，还可尝试 " + (MAX_LOGIN_ATTEMPTS - attempts) + " 次");
    }

    private void handleLoginSuccess(User user) {
        userDAO.updateLoginAttempts(user.getId(), 0);
        userDAO.updateLastLoginTime(user.getId());
    }

    private boolean isValidUsername(String username) {
        return username != null && username.length() >= 3 && username.length() <= 50;
    }

    private boolean isValidEmail(String email) {
        if (email == null) return false;
        return email.matches("^[A-Za-z0-9+_.-]+@(.+)$");
    }

    private boolean isValidPassword(String password) {
        return password != null && password.length() >= 6;
    }
}

7. 控制器层 (Controller)

Web 层负责接收前端请求并调用 Service 层，同时处理 Session 和 Cookie。

import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.util.HashMap;
import java.util.Map;

@RestController
@RequestMapping("/api/user")
public class UserController {
    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @PostMapping("/register")
    public ResponseEntity<Map<String, Object>> register(@RequestBody RegisterRequest request, HttpServletRequest httpRequest) {
        Map<String, Object> response = new HashMap<>();
        try {
            if (request.getUsername() == null || request.getPassword() == null || request.getEmail() == null) {
                response.put("success", false);
                response.put("message", "必填参数不能为空");
                return ResponseEntity.badRequest().body(response);
            }
            boolean success = userService.register(request.getUsername(), request.getEmail(), request.getPassword());
            response.put("success", success);
            response.put("message", success ? "注册成功" : "注册失败");
            return ResponseEntity.ok(response);
        } catch (Exception e) {
            response.put("success", false);
            response.put("message", e.getMessage());
            return ResponseEntity.badRequest().body(response);
        }
    }

    @PostMapping("/login")
    public ResponseEntity<Map<String, Object>> login(@RequestBody LoginRequest request, HttpServletRequest httpRequest, HttpServletResponse httpResponse) {
        Map<String, Object> response = new HashMap<>();
        try {
            User user = userService.login(request.getUsername(), request.getPassword());
            String token = SecurityUtil.generateToken();

            Cookie cookie = new Cookie("auth_token", token);
            cookie.setHttpOnly(true);
            cookie.setSecure(true); // 生产环境建议使用 HTTPS
            cookie.setMaxAge(24 * 60 * 60);
            cookie.setPath("/");
            httpResponse.addCookie(cookie);

            HttpSession session = httpRequest.getSession();
            session.setAttribute("user_id", user.getId());
            session.setAttribute("username", user.getUsername());

            response.put("success", true);
            response.put("message", "登录成功");
            response.put("user", Map.of("id", user.getId(), "username", user.getUsername(), "email", user.getEmail()));
            return ResponseEntity.ok(response);
        } catch (Exception e) {
            response.put("success", false);
            response.put("message", e.getMessage());
            return ResponseEntity.badRequest().body(response);
        }
    }

    @PostMapping("/logout")
    public ResponseEntity<Map<String, Object>> logout(HttpServletRequest request, HttpServletResponse response) {
        HttpSession session = request.getSession(false);
        if (session != null) {
            session.invalidate();
        }
        Cookie cookie = new Cookie("auth_token", null);
        cookie.setMaxAge(0);
        cookie.setPath("/");
        response.addCookie(cookie);

        Map<String, Object> result = new HashMap<>();
        result.put("success", true);
        result.put("message", "退出成功");
        return ResponseEntity.ok(result);
    }

    // 内部 DTO 类
    static class RegisterRequest {
        private String username;
        private String email;
        private String password;
        public String getUsername() { return username; }
        public void setUsername(String username) { this.username = username; }
        public String getEmail() { return email; }
        public void setEmail(String email) { this.email = email; }
        public String getPassword() { return password; }
        public void setPassword(String password) { this.password = password; }
    }

    static class LoginRequest {
        private String username;
        private String password;
        public String getUsername() { return username; }
        public void setUsername(String username) { this.username = username; }
        public String getPassword() { return password; }
        public void setPassword(String password) { this.password = password; }
    }
}

8. 配置文件

Spring Boot 主配置文件 application.yml，涵盖数据源、连接池及基础安全设置。

spring:
  application:
    name: bushuo-users
  profiles:
    active: dev
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/bushuo?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
    username: root
    password: 123456
  hikari:
    minimum-idle: 5
    maximum-pool-size: 20
    auto-commit: true
    idle-timeout: 30000
    pool-name: UserAuthHikariCP
    max-lifetime: 1800000
    connection-timeout: 30000
  jpa:
    hibernate:
      ddl-auto: update
      show-sql: true
    properties:
      hibernate:
        dialect: org.hibernate.dialect.MySQL8Dialect
        format_sql: true
  redis:
    host: localhost
    port: 6379
    database: 0
    timeout: 2000ms
  jedis:
    pool:
      max-active: 20
      max-idle: 10
      min-idle: 5
      max-wait: 2000ms
  session:
    store-type: redis
    timeout: 1800s
    redis:
      namespace: "user:session"
  mvc:
    pathmatch:
      matching-strategy: ant_path_matcher
  web:
    resources:
      static-locations: classpath:/static/
      cache-period: 3600
server:
  port: 8080
  servlet:
    context-path: /
  session:
    timeout: 30m
    cookie:
      http-only: true
      secure: false
      max-age: 1800
error:
  whitelabel:
    enabled: false
  include-message: always
  include-binding-errors: always
logging:
  level:
    com.example.demo: DEBUG
    org.springframework.security: DEBUG
    org.springframework.web: INFO
    org.hibernate.SQL: DEBUG
  pattern:
    console: "%d{yyyy-MM-dd HH:mm:ss} - %msg%n"
    file: "%d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n"
  file:
    name: logs/user-auth.log
    max-size: 10MB
    max-history: 30

以上架构涵盖了从数据库到 Web 接口的完整链路。在实际落地时，建议结合 Spring Security 框架进一步加固认证授权机制，并根据业务需求引入 Redis 缓存优化性能。