From c8259dac5077da28ff1f9b6b7b3b4057fbeeece8 Mon Sep 17 00:00:00 2001 From: dong3058 Date: Sat, 2 Aug 2025 23:03:11 +0900 Subject: [PATCH 1/3] fix:errormsg --- .../global/security/filter/JwtAuthenticationFilter.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/myteam/server/global/security/filter/JwtAuthenticationFilter.java b/src/main/java/org/myteam/server/global/security/filter/JwtAuthenticationFilter.java index 9672fc09..dc1ae37c 100644 --- a/src/main/java/org/myteam/server/global/security/filter/JwtAuthenticationFilter.java +++ b/src/main/java/org/myteam/server/global/security/filter/JwtAuthenticationFilter.java @@ -176,14 +176,14 @@ protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServle if (redisService.isAdminLoginAllowed("LOGIN_ADMIN", username)) { int count = redisService.getRequestCount("LOGIN_ADMIN", username); sendErrorResponse(response, HttpStatus.UNAUTHORIZED, - "아이디 또는 비밀번호를 확인해주세요(%s/10)".formatted(String.valueOf(10 - count))); + "아이디 또는 비밀번호를 확인해주세요. (%s/10)".formatted(String.valueOf(count))); return; } int count = redisService.getRequestCount("LOGIN_ADMIN", username); if (count >= 10) { eventPublisher.publishEvent(new AdminBanEvent(username, ClientUtils.getRemoteIP(request))); } - sendErrorResponse(response, HttpStatus.UNAUTHORIZED, "해당 아이디 로그인 시도가 10번 불일치하여" + + sendErrorResponse(response, HttpStatus.UNAUTHORIZED, "해당 아이디 로그인 시도가 10번 불일치하여\n" + "계정이 잠금되었습니다."); return; } From 4bdf7649705484b4b3c5c6162dd4ca54b8b660de Mon Sep 17 00:00:00 2001 From: dong3058 Date: Sat, 2 Aug 2025 23:04:35 +0900 Subject: [PATCH 2/3] fix --- .../util/redis/service/RedisService.java | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java b/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java index 3c63487c..fafef01f 100644 --- a/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java +++ b/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java @@ -16,7 +16,7 @@ public class RedisService { // TODO: RedisReportService 로 변경. private final RedisTemplate redisTemplate; - + private static final String ADMIN_ALARM_KEY="ADMIN_ALARM"; private static final int ADMIN_LOGIN_MAX_REQUESTS=10; private static final int MAX_REQUESTS = 3; // 제한 횟수 (기본값: 5분 동안 3회) private static final long EXPIRED_TIME = 5L; // 만료 시간 (5분) @@ -63,8 +63,8 @@ public boolean isAdminLoginAllowed(String category,String identifier){ String redisKey = getRateLimitKey(category, identifier); String requestCountStr = redisTemplate.opsForValue().get(redisKey); int requestCount = requestCountStr == null ? 0 : Integer.parseInt(requestCountStr); - - if (requestCount >= ADMIN_LOGIN_MAX_REQUESTS) { + requestCount+=1; + if (0>=(ADMIN_LOGIN_MAX_REQUESTS-requestCount)) { log.warn("🚫 [RateLimit] 관리자 요청 차단 - Key: {}, 요청 횟수: {}", redisKey, requestCount); return false; } @@ -76,9 +76,8 @@ public boolean isAdminLoginAllowed(String category,String identifier){ } - public boolean AdminReadCheck(String category, String adminIdentifier, StaticDataType staticDataType, Long contentId){ - - String redisKey=getRateLimitKey(category,adminIdentifier+staticDataType.name()+String.valueOf(contentId)); + public boolean AdminReadCheck(String adminIdentifier, StaticDataType staticDataType, Long contentId){ + String redisKey=ADMIN_ALARM_KEY+adminIdentifier+staticDataType.name()+String.valueOf(contentId); String requestCountStr=redisTemplate.opsForValue().get(redisKey); int requestCount = requestCountStr == null ? 0 : Integer.parseInt(requestCountStr); if(requestCount==0){ @@ -86,18 +85,15 @@ public boolean AdminReadCheck(String category, String adminIdentifier, StaticDat } return true; } - - public void adminReadCheckUpdate(String category, String adminIdentifier, StaticDataType staticDataType, Long contentId){ - String redisKey=getRateLimitKey(category,adminIdentifier+staticDataType.name()+String.valueOf(contentId)); + public void adminReadCheckUpdate(String adminIdentifier, StaticDataType staticDataType, Long contentId){ + String redisKey=ADMIN_ALARM_KEY+adminIdentifier+staticDataType.name()+String.valueOf(contentId); String requestCountStr=redisTemplate.opsForValue().get(redisKey); int requestCount = requestCountStr == null ? 0 : Integer.parseInt(requestCountStr); if(requestCount==0) { redisTemplate.opsForValue().increment(redisKey); - redisTemplate.expire(redisKey, Duration.ofMinutes(ADMIN_ALARM_READ_EXPIRE_TIME)); + redisTemplate.expire(redisKey, Duration.ofDays(30L)); } } - - /** * 요청 제한을 적용할 Redis Key 생성 * From f4bc5b3f9b5bb454df05e21cc4a66475354d88b7 Mon Sep 17 00:00:00 2001 From: dong3058 Date: Sat, 2 Aug 2025 23:14:30 +0900 Subject: [PATCH 3/3] fix: before redisservice --- .../util/redis/service/RedisService.java | 23 +++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java b/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java index fafef01f..ba26d116 100644 --- a/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java +++ b/src/main/java/org/myteam/server/global/util/redis/service/RedisService.java @@ -75,8 +75,27 @@ public boolean isAdminLoginAllowed(String category,String identifier){ return true; } + public boolean AdminReadCheck(String category, String adminIdentifier, StaticDataType staticDataType, Long contentId){ - public boolean AdminReadCheck(String adminIdentifier, StaticDataType staticDataType, Long contentId){ + String redisKey=getRateLimitKey(category,adminIdentifier+staticDataType.name()+String.valueOf(contentId)); + String requestCountStr=redisTemplate.opsForValue().get(redisKey); + int requestCount = requestCountStr == null ? 0 : Integer.parseInt(requestCountStr); + if(requestCount==0){ + return false; + } + return true; + } + + public void adminReadCheckUpdate(String category, String adminIdentifier, StaticDataType staticDataType, Long contentId){ + String redisKey=getRateLimitKey(category,adminIdentifier+staticDataType.name()+String.valueOf(contentId)); + String requestCountStr=redisTemplate.opsForValue().get(redisKey); + int requestCount = requestCountStr == null ? 0 : Integer.parseInt(requestCountStr); + if(requestCount==0) { + redisTemplate.opsForValue().increment(redisKey); + redisTemplate.expire(redisKey, Duration.ofMinutes(ADMIN_ALARM_READ_EXPIRE_TIME)); + } + } + /*public boolean AdminReadCheck(String adminIdentifier, StaticDataType staticDataType, Long contentId){ String redisKey=ADMIN_ALARM_KEY+adminIdentifier+staticDataType.name()+String.valueOf(contentId); String requestCountStr=redisTemplate.opsForValue().get(redisKey); int requestCount = requestCountStr == null ? 0 : Integer.parseInt(requestCountStr); @@ -93,7 +112,7 @@ public void adminReadCheckUpdate(String adminIdentifier, StaticDataType staticDa redisTemplate.opsForValue().increment(redisKey); redisTemplate.expire(redisKey, Duration.ofDays(30L)); } - } + }*/ /** * 요청 제한을 적용할 Redis Key 생성 *