STRIDE 威胁模型#

@Configuration
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 启用 HTTPS
            .requiresChannel(channels -> channels
                .anyRequest().requiresSecure())
            // Session 管理
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .sessionFixation().migrateSession()  // 防止 Session  fixation
                .maximumSessions(1)  // 防止同一账号多处登录
                .maxSessionsPreventsLogin(false))  // 新登录使旧 Session 失效
            // Cookie 安全配置
            .cookie(cookie -> cookie
                .httpOnly(true)  // 防止 JavaScript 访问
                .secure(true)  // 仅 HTTPS 传输
                .sameSite("Strict"));  // CSRF 防护
        
        return http.build();
    }
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class ParameterValidator {
    
    private static final String SECRET_KEY = "your-secret-key";
    
    /**
     * 对敏感参数进行 HMAC 签名，防止参数篡改
     */
    public static String sign(String... params) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec keySpec = new SecretKeySpec(
            SECRET_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        mac.init(keySpec);
        
        String data = String.join("|", params);
        byte[] hmacBytes = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(hmacBytes);
    }
    
    /**
     * 验证参数签名，防止篡改
     */
    public static boolean verify(String expectedSign, String... params) throws Exception {
        String actualSign = sign(params);
        return constantTimeEquals(expectedSign, actualSign);
    }
    
    /**
     * 使用常量时间比较，防止时序攻击
     */
    private static boolean constantTimeEquals(String a, String b) {
        if (a.length() != b.length()) {
            return false;
        }
        int result = 0;
        for (int i = 0; i < a.length(); i++) {
            result |= a.charAt(i) ^ b.charAt(i);
        }
        return result == 0;
    }
}

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.time.Instant;

public class AuditLogger {
    
    private static final Logger auditLog = LoggerFactory.getLogger("AUDIT");
    
    /**
     * 记录业务操作审计日志
     * 包含：操作人、操作类型、操作对象、操作结果、客户端信息、时间戳
     */
    public static void log(String userId, String action, String resource, 
                          String result, String clientIp) {
        AuditEntry entry = new AuditEntry();
        entry.userId = userId;
        entry.action = action;
        entry.resource = resource;
        entry.result = result;
        entry.clientIp = clientIp;
        entry.timestamp = Instant.now().toString();
        entry.sessionId = SessionContext.getCurrentSessionId();
        
        // 序列化为 JSON，便于后续分析
        auditLog.info("AUDIT|{}|{}|{}|{}|{}|{}|{}", 
            entry.timestamp, entry.userId, entry.action, 
            entry.resource, entry.result, entry.clientIp, entry.sessionId);
    }
    
    static class AuditEntry {
        String timestamp;
        String userId;
        String action;
        String resource;
        String result;
        String clientIp;
        String sessionId;
    }
}

import com.fasterxml.jackson.annotation.JsonInclude;

public class ApiResponse<T> {
    
    private int code;
    private String message;
    private T data;
    private String requestId;  // 用于问题追踪，但不泄露系统细节
    
    public static <T> ApiResponse<T> success(T data) {
        ApiResponse<T> response = new ApiResponse<>();
        response.code = 200;
        response.message = "success";
        response.data = data;
        response.requestId = generateRequestId();
        return response;
    }
    
    /**
     * 错误响应：对外展示统一格式，不泄露具体错误细节
     * 详细错误信息只记录到日志
     */
    public static ApiResponse<Void> error(int code, String message, 
                                           Exception e, Logger logger) {
        ApiResponse<Void> response = new ApiResponse<>();
        response.code = code;
        response.message = message;  // 对用户友好的错误信息
        response.requestId = generateRequestId();
        
        // 详细错误信息写入日志，不返回给客户端
        logger.error("Request {} failed: {}", response.requestId, 
            ExceptionUtils.getStackTrace(e));
        
        return response;
    }
    
    /**
     * 用户可见的错误信息应该是泛化的
     * 而非：ORA-00942: table or view does not exist
     */
    public static String sanitizeErrorMessage(String rawMessage) {
        // 移除 SQL 错误
        if (rawMessage.contains("ORA-") || 
            rawMessage.contains("SQL") ||
            rawMessage.contains("Exception")) {
            return "系统繁忙，请稍后重试";
        }
        return rawMessage;
    }
}

import io.github.bucket4j.Bandwidth;
import io.github.bucket4j.Bucket;
import io.github.bucket4j.Refill;
import java.time.Duration;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;

public class RateLimiter {
    
    // 每个用户一个 Bucket
    private final Map<String, Bucket> userBuckets = new ConcurrentHashMap<>();
    
    // 每个 IP 一个 Bucket（防止 IP 耗尽攻击）
    private final Map<String, Bucket> ipBuckets = new ConcurrentHashMap<>();
    
    /**
     * 创建用户级限流桶：每分钟 100 个请求
     */
    private Bucket createUserBucket(String userId) {
        Bandwidth limit = Bandwidth.classic(100, 
            Refill.greedy(100, Duration.ofMinutes(1)));
        return Bucket.builder().addLimit(limit).build();
    }
    
    /**
     * 创建 IP 级限流桶：每分钟 500 个请求
     */
    private Bucket createIpBucket(String clientIp) {
        Bandwidth limit = Bandwidth.classic(500,
            Refill.greedy(500, Duration.ofMinutes(1)));
        return Bucket.builder().addLimit(limit).build();
    }
    
    public boolean tryConsume(String userId, String clientIp) {
        Bucket userBucket = userBuckets.computeIfAbsent(userId, this::createUserBucket);
        Bucket ipBucket = ipBuckets.computeIfAbsent(clientIp, this::createIpBucket);
        
        // 两个桶都必须有剩余配额
        return userBucket.tryConsume(1) && ipBucket.tryConsume(1);
    }
    
    /**
     * 从网关层获取客户端 IP（考虑代理场景）
     */
    public String extractClientIp(HttpServletRequest request) {
        String xForwardedFor = request.getHeader("X-Forwarded-For");
        if (xForwardedFor != null && !xForwardedFor.isEmpty()) {
            return xForwardedFor.split(",")[0].trim();
        }
        return request.getRemoteAddr();
    }
}

import java.lang.annotation.*;

@Target({ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface RequirePermission {
    String value();  // 权限标识，如 "user:delete", "admin:view"
}

/**
 * 权限检查拦截器
 */
@Component
public class PermissionInterceptor implements HandlerInterceptor {
    
    @Autowired
    private PermissionService permissionService;
    
    @Override
    public boolean preHandle(HttpServletRequest request, 
                             HttpServletResponse response, Object handler) {
        
        if (handler instanceof HandlerMethod handlerMethod) {
            RequirePermission annotation = handlerMethod
                .getMethodAnnotation(RequirePermission.class);
            
            if (annotation != null) {
                String currentUserId = SecurityContext.getCurrentUserId();
                String requiredPermission = annotation.value();
                
                // 每次都检查权限，不依赖缓存
                if (!permissionService.hasPermission(currentUserId, requiredPermission)) {
                    throw new AccessDeniedException(
                        "User " + currentUserId + " lacks permission: " + requiredPermission);
                }
            }
        }
        return true;
    }
}

// 使用示例
@RestController
public class UserController {
    
    @RequirePermission("user:read")
    public ApiResponse<User> getUser(@PathVariable String userId) {
        // 只有拥有 user:read 权限的用户才能访问
        return ApiResponse.success(userService.getById(userId));
    }
    
    @RequirePermission("user:delete")
    public ApiResponse<Void> deleteUser(@PathVariable String userId) {
        // 只有拥有 user:delete 权限的管理员才能访问
        userService.delete(userId);
        return ApiResponse.success(null);
    }
}