支持弱口令校验及密码过期

imndx · imndx · commit 73238dda73e1 · 2026-05-27T10:07:37.000+08:00
diff --git a/config/application.properties b/config/application.properties
@@ -111,6 +111,28 @@ media.server.media_type=1
 ## false: 发送验证码和登录时，如果客户端传了slideVerifyToken就验证，没传就不验证
 slide.verify.force=false
 
+## 弱口令校验配置（修改密码、重置密码时生效）
+## 是否开启弱口令校验：true=开启，false=关闭
+password.weak_check.enable=false
+## 密码最小长度（不满足则视为弱口令）
+password.weak_check.min_length=8
+## 是否要求密码包含大写字母
+password.weak_check.require_uppercase=false
+## 是否要求密码包含小写字母
+password.weak_check.require_lowercase=false
+## 是否要求密码包含数字
+password.weak_check.require_digit=false
+## 是否要求密码包含特殊字符（非字母数字字符）
+password.weak_check.require_special_char=false
+## 禁止使用的常见弱口令列表，英文逗号分隔，密码与列表中任意一项完全匹配则拒绝
+password.weak_check.forbidden_list=123456,password,123456789,12345678,111111,qwerty,abc123,123123,000000,iloveyou,admin
+
+## 密码过期策略配置（仅对密码登录生效）
+## 是否开启密码过期校验：true=开启，false=关闭
+password.expiry.enable=false
+## 密码有效期（天），超过此天数后登录将被拒绝，要求用户重置密码。0 表示永不过期
+password.expiry.days=90
+
 # 使用这个目录作为临时目录，必须配置有效目录。
 local.media.temp_storage=/Users/imhao/wildfire_upload_tmp/
 
diff --git a/src/main/java/cn/wildfirechat/app/RestResult.java b/src/main/java/cn/wildfirechat/app/RestResult.java
@@ -24,7 +24,9 @@ public enum  RestCode {
         ERROR_FAILURE_TOO_MUCH_TIMES(20, "密码错误次数太多，请等5分钟再试试"),
         ERROR_USER_FORBIDDEN(21, "用户被封禁"),
         ERROR_SLIDE_VERIFY_NOT_PASS(22, "滑动验证未通过"),
-        ERROR_CONFERENCE_QUOTA_EXCEEDED(23, "会议额度已用完");
+        ERROR_CONFERENCE_QUOTA_EXCEEDED(23, "会议额度已用完"),
+        ERROR_WEAK_PASSWORD(24, "密码强度不够，请设置更复杂的密码"),
+        ERROR_PASSWORD_EXPIRED(25, "密码已过期，请重置密码");
         public int code;
         public String msg;
 
diff --git a/src/main/java/cn/wildfirechat/app/ServiceImpl.java b/src/main/java/cn/wildfirechat/app/ServiceImpl.java
@@ -89,6 +89,15 @@ public class ServiceImpl implements Service {
     @Autowired
     private cn.wildfirechat.app.slide.SlideVerifyService slideVerifyService;
 
+    @Autowired
+    private cn.wildfirechat.app.tools.WeakPasswordChecker weakPasswordChecker;
+
+    @Value("${password.expiry.enable:false}")
+    private boolean passwordExpiryEnable;
+
+    @Value("${password.expiry.days:90}")
+    private int passwordExpiryDays;
+
     @Value("${slide.verify.force:false}")
     private boolean forceSlideVerify;
 
@@ -615,6 +624,15 @@ public RestResult loginWithPassword(HttpServletResponse response, String mobile,
                 up.setTryCount(0);
                 up.setLastTryTime(0);
                 userPasswordRepository.save(up);
+
+                // 检查密码是否已过期
+                if (passwordExpiryEnable && passwordExpiryDays > 0) {
+                    long updateTime = up.getPasswordUpdateTime();
+                    // updateTime 为 0 表示历史数据未记录更新时间，视为已过期
+                    if (updateTime == 0 || System.currentTimeMillis() - updateTime > (long) passwordExpiryDays * 24 * 60 * 60 * 1000) {
+                        return RestResult.error(ERROR_PASSWORD_EXPIRED);
+                    }
+                }
             } else {
                 return RestResult.error(RestResult.RestCode.ERROR_CODE_INCORRECT);
             }
@@ -648,6 +666,9 @@ public RestResult changePassword(String oldPwd, String newPwd, String slideVerif
 
         Subject subject = SecurityUtils.getSubject();
         String userId = (String) subject.getSession().getAttribute("userId");
+        if (weakPasswordChecker.isWeakPassword(newPwd)) {
+            return RestResult.error(ERROR_WEAK_PASSWORD);
+        }
         Optional<UserPassword> optional = userPasswordRepository.findById(userId);
         if (optional.isPresent()) {
             try {
@@ -697,6 +718,9 @@ public RestResult resetPassword(String mobile, String resetCode, String newPwd)
                 return RestResult.error(ERROR_CODE_EXPIRED);
             }
             if(resetCode.equals(up.getResetCode()) || (!StringUtils.isEmpty(superCode) && resetCode.equals(superCode))) {
+                if (weakPasswordChecker.isWeakPassword(newPwd)) {
+                    return RestResult.error(ERROR_WEAK_PASSWORD);
+                }
                 try {
                     changePassword(up, newPwd);
                     up.setResetCode(null);
@@ -723,6 +747,7 @@ private UserPassword changePassword(UserPassword up, String password) throws Exc
         String hashedPwd = Base64.getEncoder().encodeToString(hashed);
         up.setPassword(hashedPwd);
         up.setSalt(salt);
+        up.setPasswordUpdateTime(System.currentTimeMillis());
         userPasswordRepository.save(up);
         return up;
     }
diff --git a/src/main/java/cn/wildfirechat/app/jpa/UserPassword.java b/src/main/java/cn/wildfirechat/app/jpa/UserPassword.java
@@ -24,6 +24,9 @@ public class UserPassword {
 
 	private long lastTryTime;
 
+	/** 密码最后一次更新时间（毫秒时间戳），0 表示从未设置过密码或历史数据无记录 */
+	private long passwordUpdateTime;
+
 	public UserPassword() {
 	}
 
@@ -105,4 +108,12 @@ public long getLastTryTime() {
 	public void setLastTryTime(long lastTryTime) {
 		this.lastTryTime = lastTryTime;
 	}
+
+	public long getPasswordUpdateTime() {
+		return passwordUpdateTime;
+	}
+
+	public void setPasswordUpdateTime(long passwordUpdateTime) {
+		this.passwordUpdateTime = passwordUpdateTime;
+	}
 }
diff --git a/src/main/java/cn/wildfirechat/app/tools/WeakPasswordChecker.java b/src/main/java/cn/wildfirechat/app/tools/WeakPasswordChecker.java
@@ -0,0 +1,102 @@
+package cn.wildfirechat.app.tools;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * 弱口令检验组件
+ * <p>
+ * 通过配置文件控制检验规则：
+ * <ul>
+ *   <li>password.weak_check.enable          — 是否开启弱口令校验（默认 true）</li>
+ *   <li>password.weak_check.min_length      — 最小密码长度（默认 8）</li>
+ *   <li>password.weak_check.require_uppercase — 是否要求大写字母（默认 false）</li>
+ *   <li>password.weak_check.require_lowercase — 是否要求小写字母（默认 false）</li>
+ *   <li>password.weak_check.require_digit   — 是否要求数字（默认 false）</li>
+ *   <li>password.weak_check.require_special_char — 是否要求特殊字符（默认 false）</li>
+ *   <li>password.weak_check.forbidden_list  — 禁止使用的常见弱口令，逗号分隔</li>
+ * </ul>
+ */
+@Component
+public class WeakPasswordChecker {
+
+    @Value("${password.weak_check.enable:true}")
+    private boolean enable;
+
+    @Value("${password.weak_check.min_length:8}")
+    private int minLength;
+
+    @Value("${password.weak_check.require_uppercase:false}")
+    private boolean requireUppercase;
+
+    @Value("${password.weak_check.require_lowercase:false}")
+    private boolean requireLowercase;
+
+    @Value("${password.weak_check.require_digit:false}")
+    private boolean requireDigit;
+
+    @Value("${password.weak_check.require_special_char:false}")
+    private boolean requireSpecialChar;
+
+    /**
+     * 逗号分隔的禁止密码列表，例如：
+     * password.weak_check.forbidden_list=123456,password,111111,qwerty,abc123
+     */
+    @Value("${password.weak_check.forbidden_list:123456,password,123456789,12345678,111111,qwerty,abc123,123123,000000,iloveyou,admin,letmein,welcome,monkey,dragon}")
+    private String forbiddenListStr;
+
+    private Set<String> forbiddenSet;
+
+    @javax.annotation.PostConstruct
+    private void init() {
+        forbiddenSet = new HashSet<>();
+        if (forbiddenListStr != null && !forbiddenListStr.isEmpty()) {
+            Arrays.stream(forbiddenListStr.split(","))
+                    .map(String::trim)
+                    .filter(s -> !s.isEmpty())
+                    .forEach(forbiddenSet::add);
+        }
+    }
+
+    /**
+     * 检查密码是否为弱口令。
+     *
+     * @param password 待检查的明文密码
+     * @return {@code true} 表示是弱口令（不符合要求），{@code false} 表示密码合格
+     */
+    public boolean isWeakPassword(String password) {
+        if (!enable) {
+            return false;
+        }
+
+        if (password == null || password.length() < minLength) {
+            return true;
+        }
+
+        if (requireUppercase && password.chars().noneMatch(Character::isUpperCase)) {
+            return true;
+        }
+
+        if (requireLowercase && password.chars().noneMatch(Character::isLowerCase)) {
+            return true;
+        }
+
+        if (requireDigit && password.chars().noneMatch(Character::isDigit)) {
+            return true;
+        }
+
+        if (requireSpecialChar && password.chars().allMatch(c -> Character.isLetterOrDigit(c) || Character.isWhitespace(c))) {
+            return true;
+        }
+
+        if (forbiddenSet != null && forbiddenSet.contains(password)) {
+            return true;
+        }
+
+        return false;
+    }
+}

Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,9 @@ public class UserPassword {`
`24`	`24`
`25`	`25`	`private long lastTryTime;`
`26`	`26`
	`27`	`+ /** 密码最后一次更新时间（毫秒时间戳），0 表示从未设置过密码或历史数据无记录 */`
	`28`	`+ private long passwordUpdateTime;`
	`29`	`+`
`27`	`30`	`public UserPassword() {`
`28`	`31`	`}`
`29`	`32`
`@@ -105,4 +108,12 @@ public long getLastTryTime() {`
`105`	`108`	`public void setLastTryTime(long lastTryTime) {`
`106`	`109`	`this.lastTryTime = lastTryTime;`
`107`	`110`	`}`
	`111`	`+`
	`112`	`+ public long getPasswordUpdateTime() {`
	`113`	`+ return passwordUpdateTime;`
	`114`	`+ }`
	`115`	`+`
	`116`	`+ public void setPasswordUpdateTime(long passwordUpdateTime) {`
	`117`	`+ this.passwordUpdateTime = passwordUpdateTime;`
	`118`	`+ }`
`108`	`119`	`}`