SpringBoot如何有效的预防计时攻击-创新互联

这期内容当中小编将会给大家带来有关Spring Boot如何有效的预防计时攻击，文章内容丰富且以专业的角度为大家分析和叙述，阅读完这篇文章希望大家可以有所收获。

很多人吐槽 Spring Security 比 Shiro 重量级，这个重量级不是凭空来的，重量有重量的好处，就是它提供了更为强大的防护功能。

protected final UserDetails retrieveUser(String username,
    UsernamePasswordAuthenticationToken authentication)
    throws AuthenticationException {
  prepareTimingAttackProtection();
  try {
    UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
    if (loadedUser == null) {
      throw new InternalAuthenticationServiceException(
          "UserDetailsService returned null, which is an interface contract violation");
    }
    return loadedUser;
  }
  catch (UsernameNotFoundException ex) {
    mitigateAgainstTimingAttack(authentication);
    throw ex;
  }
  catch (InternalAuthenticationServiceException ex) {
    throw ex;
  }
  catch (Exception ex) {
    throw new InternalAuthenticationServiceException(ex.getMessage(), ex);
  }
}