laravel修改用户模块的密码验证实现

作者:if年少有为 时间:2023-06-14 12:37:18 

做项目的时候,用户认证几乎是必不可少的,如果我们的项目由于一些原因不得不使用 users 之外的用户表进行认证,那么就需要多做一点工作来完成这个功能。

现在假设我们只需要修改登录用户的表,表名和表结构都与框架默认的表users不同,文档没有教我们如何去做,但是别慌,稍微看下框架实现用户认证的源码就能轻松实现。

首先,自定义一张表用来登录,表结构和模拟数据如下:

表 admins


idlogin_namelogin_pass
1admin10$2MUhp7b6ghVOngb/.b/x6uuEW/yL3FqPKJztawrM0U577Clf07xda


从配置文件入手

用户认证相关的配置都保存在config/auth.php文件中,先来看看配置文件的内容:


       <?php
       
       return [
       
           /*
           |--------------------------------------------------------------------------
           | Authentication Defaults
           |--------------------------------------------------------------------------
           |
           | This option controls the default authentication "guard" and password
           | reset options for your application. You may change these defaults
           | as required, but they're a perfect start for most applications.
           |
           */
       
           'defaults' => [
               'guard' => 'web',
               'passwords' => 'users',
           ],
       
           /*
       |--------------------------------------------------------------------------
       | Authentication Guards
       |--------------------------------------------------------------------------
       |
       | Next, you may define every authentication guard for your application.
       | Of course, a great default configuration has been defined for you
       | here which uses session storage and the Eloquent user provider.
       |
       | All authentication drivers have a user provider. This defines how the
       | users are actually retrieved out of your database or other storage
       | mechanisms used by this application to persist your user's data.
       |
       | Supported: "session", "token"
       |
       */
   
       'guards' => [
           'web' => [
               'driver' => 'session',
               'provider' => 'users',
           ],
   
           'api' => [
               'driver' => 'passport',
               'provider' => 'users',
           ],
       ],
   
       /*
       |--------------------------------------------------------------------------
       | User Providers
       |--------------------------------------------------------------------------
       |
       | All authentication drivers have a user provider. This defines how the
       | users are actually retrieved out of your database or other storage
       | mechanisms used by this application to persist your user's data.
       |
       | If you have multiple user tables or models you may configure multiple
       | sources which represent each model / table. These sources may then
       | be assigned to any extra authentication guards you have defined.
       |
       | Supported: "database", "eloquent"
       |
       */
   
       'providers' => [
           'users' => [
               'driver' => 'eloquent',
               'model' => App\User::class,
           ],
   
           // 'users' => [
           //     'driver' => 'database',
           //     'table' => 'users',
           // ],
       ],
   
       /*
       |--------------------------------------------------------------------------
       | Resetting Passwords
       |--------------------------------------------------------------------------
       |
       | You may specify multiple password reset configurations if you have more
       | than one user table or model in the application and you want to have
       | separate password reset settings based on the specific user types.
       |
       | The expire time is the number of minutes that the reset token should be
       | considered valid. This security feature keeps tokens short-lived so
       | they have less time to be guessed. You may change this as needed.
       |
       */
   
       'passwords' => [
           'users' => [
               'provider' => 'users',
               'table' => 'password_resets',
               'expire' => 60,
           ],
       ],
   
   ];

默认使用的守卫是web,而web守卫使用的认证驱动是session,用户提供器是users。假设我们的需求只是将用户的提供器由users改为admins,那么我们需要做两步操作:

修改默认的用户提供器,将provider=>'users'改为provider=>'admins'


         'guards' => [
               'web' => [
                   'driver' => 'session',
                   'provider' => 'users',
               ],
           ],

配置admins提供器,假设依旧使用eloquent作为驱动,并创建好了admins表的模型


   'providers' => [
           'admins' => [
               'driver' => 'eloquent',
               'model' => App\Admin::class
           ]
       ],

使用Auth门面的attempt方法进行登录

SessionGuard 中的attempt方法:


   //Illuminate\Auth\SessionGuard
    public function attempt(array $credentials = [], $remember = false)
       {
           $this->fireAttemptEvent($credentials, $remember);
   
           $this->lastAttempted = $user = $this->provider->retrieveByCredentials($credentials);
   
           // If an implementation of UserInterface was returned, we'll ask the provider
           // to validate the user against the given credentials, and if they are in
           // fact valid we'll log the users into the application and return true.
           if ($this->hasValidCredentials($user, $credentials)) {
               $this->login($user, $remember);
   
               return true;
           }
   
           // If the authentication attempt fails we will fire an event so that the user
           // may be notified of any suspicious attempts to access their account from
           // an unrecognized user. A developer may listen to this event as needed.
           $this->fireFailedEvent($user, $credentials);
   
           return false;
       }

该方法中调用 UserProvider 接口的retrieveByCredentials方法检索用户,根据我们的配置,UserProvider接口的具体实现应该是EloquentUserProvider,因此,我们定位到EloquentUserProvider的retrieveByCredentials方法:


   //Illuminate\Auth\EloquentUserProvider
   public function retrieveByCredentials(array $credentials)
       {
           if (empty($credentials) ||
              (count($credentials) === 1 &&
               array_key_exists('password', $credentials))) {
               return;
           }
   
           // First we will add each credential element to the query as a where clause.
           // Then we can execute the query and, if we found a user, return it in a
           // Eloquent User "model" that will be utilized by the Guard instances.
           $query = $this->createModel()->newQuery();
   
           foreach ($credentials as $key => $value) {
               if (Str::contains($key, 'password')) {
                   continue;
               }
   
               if (is_array($value) || $value instanceof Arrayable) {
                   $query->whereIn($key, $value);
               } else {
                   $query->where($key, $value);
               }
           }
   
           return $query->first();
       }

该方法会使用传入的参数(不包含password)到我们配置的数据表中搜索数据,查询到符合条件的数据之后返回对应的用户信息,然后attempt方法会进行密码校验,校验密码的方法为:


   //Illuminate\Auth\SessionGuard
   /**
        * Determine if the user matches the credentials.
        *
        * @param  mixed  $user
        * @param  array  $credentials
        * @return bool
        */
       protected function hasValidCredentials($user, $credentials)
       {
           return ! is_null($user) && $this->provider->validateCredentials($user, $credentials);
       }

进一步查看EloquentUserProvider中的validateCredentials方法


   //Illuminate\Auth\EloquentUserProvider
   public function validateCredentials(UserContract $user, array $credentials)
   {
       $plain = $credentials['password'];
   
       return $this->hasher->check($plain, $user->getAuthPassword());
   }

通过validateCredentials可以看出,提交的认证数据中密码字段名必须是password,这个无法自定义。同时可以看到,入参$user必须实现Illuminate\Contracts\Auth\Authenticatable接口(UserContract是别名)。

修改 Admin 模型

Admin模型必须实现Illuminate\Contracts\Auth\Authenticatable接口,可以借鉴一下User模型,让Admin直接继承Illuminate\Foundation\Auth\User 就可以,然后重写getAuthPassword方法,正确获取密码字段:


   // App\Admin
   public function getAuthPassword()
   {
       return $this->login_pass;
   }

不出意外的话,这个时候就能使用admins表进行登录了。

Larval 5.4的默认Auth登陆传入邮件和用户密码到attempt 方法来认证,通过email 的值获取,如果用户被找到,经哈希运算后存储在数据中的password将会和传递过来的经哈希运算处理的passwrod值进行比较。如果两个经哈希运算的密码相匹配那么将会为这个用户开启一个认证Session。

参考上面的分析,我们就需要对EloquentUserProvider中的validateCredentials方法进行重写,步骤如下

1. 修改 App\Models\User.php 添加如下代码


   public function getAuthPassword()
       {
           return ['password' => $this->attributes['password'], 'salt' => $this->attributes['salt']];
       }

2. 建立一个自己的UserProvider.php 的实现


   <?php
   namespace App\Foundation\Auth;
   
   use Illuminate\Auth\EloquentUserProvider;
   use Illuminate\Contracts\Auth\Authenticatable;
   use Illuminate\Support\Str;
   
   /**
    * 重写用户密码校验逻辑
    * Class GfzxEloquentUserProvider
    * @package App\Foundation\Auth
    */
   class GfzxEloquentUserProvider extends EloquentUserProvider
   {
       /**
        * Validate a user against the given credentials.
        *
        * @param  \Illuminate\Contracts\Auth\Authenticatable $user
        * @param  array $credentials
        * @return bool
        */
       public function validateCredentials(Authenticatable $user, array $credentials)
       {
           $plain = $credentials['password'];
           $authPassword = $user->getAuthPassword();
           return md5($plain . $authPassword['salt']) == $authPassword['password'];
       }
   }

3. 将User Providers换成我们自己的GfzxEloquentUserProvider
修改 app/Providers/AuthServiceProvider.php


   <?php
   
   namespace App\Providers;
   
   use App\Foundation\Auth\GfzxEloquentUserProvider;
   use Auth;
   use Illuminate\Support\Facades\Gate;
   use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
   
   class AuthServiceProvider extends ServiceProvider
   {
       .
       .
       .
   
       /**
        * Register any authentication / authorization services.
        *
        * @return void
        */
       public function boot()
       {
           $this->registerPolicies();
   
           Auth::provider('gfzx-eloquent', function ($app, $config) {
               return new GfzxEloquentUserProvider($this->app['hash'], $config['model']);
           });
       }
   }

4. 修改 config/auth.php


      'providers' => [
           'users' => [
               'driver' => 'gfzx-eloquent',
               'model' => App\Models\User::class,
           ],
       ],

这是就可以用过salt+passwrod的方式密码认证了

来源:https://www.cnblogs.com/ifme/p/11797159.html

标签:laravel,用户模块,密码验证
0
投稿

猜你喜欢

  • 今天 平安夜 Python 送你一顶圣诞帽 @微信官方

    2021-12-10 14:24:14
  • 深入探讨JavaScript、JQuery屏蔽网页鼠标右键菜单及禁止选择复制

    2024-06-23 09:05:25
  • Python实现位图分割的效果

    2021-09-05 11:13:15
  • 在Web关闭页面时发送Ajax请求的实现方法

    2024-04-18 10:14:37
  • python执行等待程序直到第二天零点的方法

    2023-08-27 11:49:21
  • Python 文件管理实例详解

    2022-08-22 16:29:54
  • JavaScript对JSON数据进行排序和搜索

    2024-06-09 22:02:57
  • 详解Python下ftp上传文件linux服务器

    2023-12-31 19:02:37
  • python生成随机验证码(中文验证码)示例

    2022-07-28 05:41:58
  • Python编程对列表中字典元素进行排序的方法详解

    2023-11-23 04:48:26
  • python GUI库图形界面开发之PyQt5结合Qt Designer创建信号与槽的详细方法与实例

    2021-09-24 03:11:51
  • 纯JS实现五子棋游戏兼容各浏览器(附源码)

    2024-04-25 13:14:53
  • python利用proxybroker构建爬虫免费IP代理池的实现

    2021-10-25 21:18:25
  • Python批量生成字幕图片的方法详解

    2023-11-03 05:03:15
  • OpenCV特征提取与检测之Shi-Tomasi角点检测器

    2023-12-17 09:41:35
  • 带你彻底搞懂python操作mysql数据库(cursor游标讲解)

    2024-01-25 21:53:58
  • 去掉CSS赘余代码,CSS可以更简洁

    2008-11-05 13:07:00
  • PHP设计模式之观察者模式浅析

    2023-05-27 12:20:11
  • 使用python对视频文件分辨率进行分组的实例代码

    2022-06-06 21:16:44
  • Python实现繁体中文与简体中文相互转换的方法示例

    2021-08-08 08:13:12
  • asp之家 网络编程 m.aspxhome.com