Spring Security 6 & JWT Authentication · 课时

实现多因素身份验证

通过 MFA 增加额外的安全层，要求用户提供多种验证方式。

实现多因素身份验证 是 CoddyKit 上的免费 Spring Security 6 & JWT Authentication 课时。这是第 1 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Spring Security 6 & JWT Authentication 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Spring Security 6 & JWT Authentication 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

What is Multi-Factor Auth?

Welcome to Multi-Factor Authentication (MFA)! MFA adds an extra layer of security beyond just a password.

It requires users to provide at least two different verification factors to prove their identity. Think of it as needing more than one key to unlock a door.

Why MFA Matters

In today's digital world, passwords alone are often not enough. Data breaches and phishing attacks can easily compromise single-factor authentication.

MFA significantly boosts security by making it much harder for unauthorized users to access accounts, even if they've stolen a password. It's a critical defense against credential theft.

Exploring MFA Factors

MFA relies on different categories of authentication factors:

Something you know: A password, PIN, or security question.
Something you have: A physical token, smartphone (for app-based codes), or smart card.
Something you are: Biometrics like a fingerprint, facial scan, or voice recognition.

A strong MFA setup combines factors from at least two different categories.

Spring Security & MFA

Spring Security provides a powerful framework for authentication and authorization. While it doesn't have a direct, built-in MFA module, it's highly extensible.

We can integrate MFA by customizing its authentication flow. This typically involves adding custom filters, authentication providers, and user details to handle the second factor.

Choosing a Second Factor: TOTP

A common and widely adopted second factor is the Time-based One-Time Password (TOTP). These are the 6-digit codes generated by apps like Google Authenticator or Authy.

TOTP codes are valid for a short period (usually 30-60 seconds) and are based on a shared secret key and the current time.

User Enrollment for TOTP

The MFA enrollment process is crucial. First, your application generates a unique secret key for each user.

This secret is then presented to the user, often as a QR code, which they scan with their authenticator app. The app stores the secret and uses it to generate time-based codes.

Storing MFA Secrets Securely

The generated TOTP secret key is highly sensitive. It must be stored securely in your application's database.

Best practice dictates encrypting these secrets at rest. Never store them in plain text! If a secret is compromised, an attacker could generate valid TOTP codes.

Custom Authentication Provider

To integrate TOTP verification into Spring Security, you'll often create a custom AuthenticationProvider.

This provider can be chained after your primary username/password authentication. Once the first factor is verified, the provider can check for the second factor (the TOTP code).

Enhancing Login with an MFA Filter

Another key component is a custom Spring Security filter, typically extending OncePerRequestFilter.

This filter intercepts requests after primary authentication but before full access is granted. If MFA is enabled for a user, the filter can redirect them to a dedicated MFA verification page to enter their TOTP code.

TOTP Verification Logic Demo

Here's a simplified example demonstrating the core idea behind TOTP code verification. In a real app, a dedicated library would handle the time-based calculation.

Try running it to see how a submitted code is conceptually checked against an expected one.

public class TotpVerificationDemo {
  // In a real application, 'userSecret' would be securely stored per user
  private static final String USER_SECRET = "ABCDEFG12345"; // Example secret

  public static void main(String[] args) {
    System.out.println("--- TOTP Verification Demo ---");
    System.out.println("Imagine a user has this secret configured in their authenticator app.");
    
    // Simulate a TOTP code entered by the user
    int userSubmittedCode = 123456; // This would come from the user's input

    System.out.println("\nUser submitted code: " + userSubmittedCode);

    // In a real scenario, a TOTP library would generate
    // the expected code based on the secret and current time.
    // For this demo, let's assume a 'valid' code for the current window.
    int expectedCodeFromLibrary = 123456; // This changes every ~30s in real TOTP

    boolean isValid = checkTotpCode(USER_SECRET, userSubmittedCode, expectedCodeFromLibrary);

    if (isValid) {
      System.out.println("Verification SUCCESS: TOTP code is valid!");
    } else {
      System.out.println("Verification FAILED: TOTP code is invalid.");
    }
  }

  // This method simulates the check a TOTP library would perform.
  // In reality, 'expectedCode' would be calculated dynamically.
  public static boolean checkTotpCode(String secret, int submittedCode, int expectedCode) {
    // A real TOTP library checks submittedCode against expectedCode
    // and potentially codes from adjacent time windows (for clock skew).
    // For this simplified demo, we just check for equality.
    return submittedCode == expectedCode;
  }
}

MFA Quick Check

Which of the following describes a 'possession' factor in Multi-Factor Authentication?

MFA Lesson Summary

Great job! You've learned the fundamentals of Multi-Factor Authentication and how to approach its implementation within a Spring Security application.

MFA adds critical security layers.
It relies on 'something you know, have, or are'.
TOTP is a popular and effective second factor.
Spring Security's extensibility allows for custom filters and providers to integrate MFA.
Secure storage of MFA secrets is paramount.

Next, we'll explore how to protect your application from abuse using rate limiting!

常见问题解答

「实现多因素身份验证」课时是免费的吗？

是的 — 「实现多因素身份验证」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Spring Security 6 & JWT Authentication 课程的其余内容，请升级到 CoddyKit PRO。 Spring Security 6 & JWT Authentication 课程共包含 4 节课。

「实现多因素身份验证」这节课中我会学到什么？

通过 MFA 增加额外的安全层，要求用户提供多种验证方式。你通过在浏览器中直接运行的动手代码来练习 Spring Security 6 & JWT Authentication，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Spring Security 6 & JWT Authentication 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Spring Security 6 & JWT Authentication 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 1 节课，共 4 节。

「实现多因素身份验证」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Spring Security 6 & JWT Authentication 课中编写并运行代码吗？

能。每节 Spring Security 6 & JWT Authentication 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Spring Security 6 & JWT Authentication