Java安全编程：密码加密、访问控制等常见场景实例

原创た入场券 2024-11-26 22:42 116阅读 0赞

在Java中，安全编程主要包括密码加密、访问控制等场景。以下是一些实例：

1. 密码加密：
```java
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;

public class PasswordEncryption {
    private static final String ALGORITHM = "AES";

public static void main(String[] args) throws Exception {
        // Generate a random key
        byte[] key = new byte[16]; // 16 bytes is typical for AES
        SecureRandom secureRandom = new SecureRandom();
        secureRandom.nextBytes(key);

// Create a cipher object and initialize it
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, key));

// Encrypt a password
        String passwordToEncrypt = "MySecurePassword123";
        byte[] encryptedPassword = cipher.doFinal(passwordToEncrypt.getBytes()));

System.out.println("Encrypted Password: " + bytesToHex(encryptedPassword)));

// Decryption - Assuming the same key used for encryption
        cipher.init(Cipher.DECRYPT_MODE, key));
        byte[] decryptedPassword = cipher.doFinal(encryptedPassword));

System.out.println("\nDecrypted Password: " + new String(decryptedPassword)));
    }

// Helper method to convert bytes to hexadecimal string
    private static String bytesToHex(byte[] bytes) {
        StringBuilder hexString = new StringBuilder();
        for (byte b : bytes) {
            hexString.append(String.format("%02x", b))));
        }
        return hexString.toString();
    }
}
```
这个例子演示了如何使用AES算法对密码进行加密，然后对加密后的密码进行解密。

2. 访问控制：
```java
import java.security.Principal;
import java.util.HashSet;
import java.util.Set;

// 假设我们有一个用户接口
public interface UserRepository {
    User getUserById(int id);
    void saveUser(User user);
}

public class SecurityContext {
    private final UserRepository userRepository;
    private final Set<Principal> allowedPrincipals = new HashSet<>();

public SecurityContext(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

// 添加允许访问的用户
    public void allowAccess(Principal principal) {
        if (allowedPrincipals.contains(principal)) {
            System.out.println("User with principal " + principal + " is already allowed.");
            return;
        }
        allowedPrincipals.add(principal);
        System.out.println("User with principal " + principal + " has been added to the allowed principals list.");
    }

// 确保用户有足够的权限访问资源
    public boolean hasAccess(Principal principal) {
        if (!allowedPrincipals.contains(principal))) {
            System.out.println("User with principal " + principal + " is not in the allowed principals list.");
            return false;
        }
        return true;
    }

// 获取用户信息（使用示例）
    public User getUserById(int id) {
        return userRepository.getUserById(id);
    }

// 将用户保存到数据库（使用示例）
    public void saveUser(User user) {
        userRepository.saveUser(user);
    }
}
```
这个例子中的`SecurityContext`类提供了访问控制功能。你可以在添加允许访问的用户时检查用户是否已经存在于列表中，以确保不会出现权限冲突的情况。