// ❌ 登录前后 Session ID 不变
http.sessionManagement().sessionFixation().none();

// ✅ 登录后更换 Session ID
http.sessionManagement()
    .sessionFixation().migrateSession();  // 创建新 Session，复制属性
// 或
http.sessionManagement()
    .sessionFixation().newSession();      // 创建全新 Session

@Bean
public CookieSerializer cookieSerializer() {
    DefaultCookieSerializer serializer = new DefaultCookieSerializer();
    serializer.setSameSite("Strict");
    serializer.setUseSecureCookie(true);
    serializer.setUseHttpOnlyCookie(true);
    return serializer;
}

// ❌ 只判断 getAttribute 是否为 null，无状态校验
Object user = session.getAttribute("user");
if (user == null) { response.sendRedirect("/login"); return false; }
return true;  // 不管 user 是否已被禁用、IP 是否变化

@Component
public class SessionAuthInterceptor implements HandlerInterceptor {
    @Autowired private RedisTemplate<String, SessionUser> redis;
    @Autowired private UserService userService;
    
    public boolean preHandle(HttpServletRequest request, ...) {
        String sessionId = request.getHeader("X-Session-Id");
        if (sessionId == null) {
            HttpSession s = request.getSession(false);
            if (s == null) { respond401(response, "未登录"); return false; }
            sessionId = s.getId();
        }
        
        SessionUser user = redis.opsForValue().get("session:user:" + sessionId);
        if (user == null) { respond401(response, "Session 过期"); return false; }
        
        // 检查用户是否仍有效（可能被管理员禁用）
        if (!userService.isUserActive(user.getUserId())) {
            redis.delete("session:user:" + sessionId);
            respond401(response, "账号已禁用"); return false;
        }
        
        // 检查 IP 变化（管理后台推荐严格模式）
        String currentIp = getClientIp(request);
        if (!currentIp.equals(user.getLoginIp())) {
            log.warn("IP变化: userId={}", user.getUserId());
        }
        
        // 续期
        redis.expire("session:user:" + sessionId, Duration.ofMinutes(30));
        request.setAttribute("currentUser", user);
        return true;
    }
}

@Data
public class SessionUser implements Serializable {
    private Long userId;
    private String username;
    private Set<String> roles;
    private Set<String> permissions;
    private String loginIp;
    private String userAgent;
    private LocalDateTime loginTime;
}

@Override
public boolean preHandle(HttpServletRequest request, ...) {
    String token = extractBearerToken(request);
    if (token == null) { respond401(response, "缺少Token"); return false; }
    
    // 黑名单检查（已注销的 Token）
    if (Boolean.TRUE.equals(redis.hasKey("token:blacklist:" + getTokenId(token)))) {
        respond401(response, "Token 已失效"); return false;
    }
    
    // JWT 校验
    try {
        TokenUser user = jwtService.validateAndParse(token);
        request.setAttribute("currentUser", user);
        return true;
    } catch (JwtException e) {
        respond401(response, "Token 无效"); return false;
    }
}

// ❌ 缓存无失效机制 — 权限变更后旧权限仍生效
public Set<String> getUserPermissions(Long userId) {
    Set<String> cached = redis.opsForValue().get("perm:" + userId);
    if (cached != null) return cached;  // ← 永远返回缓存
    // ...
}

// ✅ 变更时主动失效 + 短 TTL
public void updateUserPermissions(Long userId, Set<String> newPerms) {
    permissionMapper.updatePermissions(userId, newPerms);
    redis.delete("perm:" + userId);  // 立即失效
    redis.convertAndSend("perm:invalidate", userId.toString());  // 通知其他节点
}

public Set<String> getUserPermissions(Long userId) {
    return Optional.ofNullable(redis.opsForValue().get("perm:" + userId))
        .orElseGet(() -> {
            Set<String> perms = permissionMapper.findByUserId(userId);
            redis.opsForValue().set("perm:" + userId, perms, Duration.ofMinutes(5));
            return perms;
        });
}

@Component
public class SessionManager {
    @Autowired private RedisTemplate<String, String> redis;
    
    public void registerSession(Long userId, String newSessionId) {
        String oldSessionId = redis.opsForValue().get("user:session:" + userId);
        if (oldSessionId != null && !oldSessionId.equals(newSessionId)) {
            redis.opsForValue().set("session:blacklist:" + oldSessionId, "kicked", 
                Duration.ofMinutes(30));
            log.info("用户 {} 新设备登录，旧 Session 被踢出", userId);
        }
        redis.opsForValue().set("user:session:" + userId, newSessionId, 
            Duration.ofHours(2));
    }
}

@Component
public class LoginRateLimiter {
    private static final int MAX_ATTEMPTS = 5;
    private static final Duration WINDOW = Duration.ofMinutes(5);
    private static final Duration BLOCK = Duration.ofMinutes(15);
    
    public boolean isBlocked(String username, String ip) {
        return Boolean.TRUE.equals(redis.hasKey("login:block:" + ip))
            || Boolean.TRUE.equals(redis.hasKey("login:block:user:" + username));
    }
    
    public void recordFailedAttempt(String username, String ip) {
        String key = "login:attempt:" + ip + ":" + username;
        Long attempts = redis.opsForValue().increment(key);
        if (attempts == 1) redis.expire(key, WINDOW);
        if (attempts >= MAX_ATTEMPTS) {
            redis.opsForValue().set("login:block:" + ip, 1, BLOCK);
            redis.opsForValue().set("login:block:user:" + username, 1, BLOCK);
        }
    }
}

// 管理后台：Session
@Bean
public SecurityFilterChain webChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/admin/**")
        .authorizeHttpRequests(a -> a.anyRequest().hasRole("ADMIN"))
        .formLogin(Customizer.withDefaults())
        .sessionManagement(s -> s.sessionCreationPolicy(IF_REQUIRED));
    return http.build();
}

// API：JWT
@Bean @Order(1)
public SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
    http.securityMatcher("/api/**")
        .authorizeHttpRequests(a -> a.requestMatchers("/api/public/**").permitAll()
            .anyRequest().authenticated())
        .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
        .sessionManagement(s -> s.sessionCreationPolicy(STATELESS));
    return http.build();
}

@Configuration
@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 1800)
public class SessionConfig {

    @Bean
    public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
        // 不要用 JdkSerializationRedisSerializer — 有反序列化风险
        // 推荐 Jackson 或 GenericJackson2JsonRedisSerializer
        return new GenericJackson2JsonRedisSerializer();
    }

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setCookieName("SESSIONID");
        serializer.setCookiePath("/");
        serializer.setDomainNamePattern("^.+?\\.(example\\.com)$");
        serializer.setUseSecureCookie(true);
        serializer.setUseHttpOnlyCookie(true);
        serializer.setSameSite("Lax");
        return serializer;
    }

    @Bean
    public RedisIndexedSessionRepository sessionRepository(
            RedisOperations<String, Object> redis) {
        RedisIndexedSessionRepository repo = 
            new RedisIndexedSessionRepository(redis);
        repo.setDefaultMaxInactiveInterval(Duration.ofMinutes(30));
        
        // 关键：配置 Redis key 前缀，方便管理
        repo.setRedisKeyNamespace("myapp:session:");
        
        return repo;
    }
}

@Configuration
@EnableWebSocketMessageBroker
public class WebSocketSecurityConfig implements WebSocketMessageBrokerConfigurer {

    @Override
    public void configureClientInboundChannel(ChannelRegistration registration) {
        registration.interceptors(new ChannelInterceptor() {
            @Override
            public Message<?> preSend(Message<?> message, MessageChannel channel) {
                StompHeaderAccessor accessor = 
                    MessageHeaderAccessor.getAccessor(message, StompHeaderAccessor.class);
                
                if (StompCommand.CONNECT.equals(accessor.getCommand())) {
                    // 从 STOMP CONNECT 帧中提取 Token
                    String token = accessor.getFirstNativeHeader("Authorization");
                    if (token == null || !token.startsWith("Bearer ")) {
                        throw new AccessDeniedException("未认证");
                    }
                    
                    // 验证 Token 并设置用户
                    User user = tokenService.validateAndGetUser(token.substring(7));
                    accessor.setUser(user);
                }
                
                // 对于 SUBSCRIBE/SEND 等命令，检查权限
                if (StompCommand.SUBSCRIBE.equals(accessor.getCommand())) {
                    String destination = accessor.getDestination();
                    User user = (User) accessor.getUser();
                    
                    // 检查用户是否有权限订阅此主题
                    if (destination.startsWith("/topic/admin/") 
                        && !user.hasRole("ADMIN")) {
                        throw new AccessDeniedException("无权限订阅此主题");
                    }
                }
                
                return message;
            }
        });
    }
}

// ❌ Filter 用 getRequestURI() 做白名单 → 可被分号绕过
String uri = request.getRequestURI();
if (uri.endsWith(".js") || uri.endsWith(".css")) {
    chain.doFilter(request, response);
    return;
}
// GET /admin/deleteUser;.js → getRequestURI() 匹配 .js → 放行
// Tomcat 解析分号 → 路由到 /admin/deleteUser → 鉴权绕过

// ✅ 修复
String path = request.getServletPath();
// 或 Spring 路由属性
String pattern = (String) request.getAttribute(
    HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE);

// ❌ 无归属校验
@GetMapping("/api/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId) {
    return orderService.findById(orderId);
}

// ✅ 校验归属
@GetMapping("/api/orders/{orderId}")
public Order getOrder(@PathVariable Long orderId, @AuthenticationPrincipal UserDetails user) {
    Order order = orderService.findById(orderId);
    if (!order.getUserId().equals(user.getId())) {
        throw new AccessDeniedException("无权访问");
    }
    return order;
}

// ❌ 问题代码
@Override
public boolean preHandle(HttpServletRequest request, ...) {
    String uri = request.getRequestURI();
    if (uri.contains("/login") || uri.endsWith(".js")) { return true; }
    
    String token = request.getHeader("Authorization");
    if (token == null) { response.setStatus(401); return false; }
    
    User user = parseToken(token);
    if (user == null) { response.setStatus(401); return false; }
    
    return true;  // ← 任何登录用户都能访问管理接口！
}

// ✅ 使用 getServletPath() + 精确白名单 + 认证+授权
public boolean preHandle(HttpServletRequest request, ...) {
    String path = request.getServletPath();
    if (WHITELIST.contains(path)) { return true; }
    
    // 认证
    User user = tokenService.validateAndGetUser(request.getHeader("Authorization"));
    if (user == null) { response.setStatus(401); return false; }
    
    // 授权 — 必须有！
    if (path.startsWith("/api/admin/") && !user.hasRole("ADMIN")) {
        response.setStatus(403); return false;
    }
    
    request.setAttribute("currentUser", user);
    return true;
}

// 该系统的 AuthInterceptor 代码
if (request.getRequestURI().endsWith(".js") 
    || request.getRequestURI().endsWith(".css")) {
    return true;  // 静态资源直接放行
}
// ... 后续的认证逻辑永远走不到

// ❌ 危险：同时接受多种算法
@Bean
public JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder
        .withJwkSetUri("https://auth.example.com/.well-known/jwks.json")
        .jwsAlgorithms(algs -> {
            algs.add(JWSAlgorithm.RS256);
            algs.add(JWSAlgorithm.HS256);   // ← 危险！
        })
        .build();
}

// ✅ 正确：只接受单一算法
@Bean
public JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder
        .withJwkSetUri("https://auth.example.com/.well-known/jwks.json")
        .jwsAlgorithm(JWSAlgorithm.RS256)
        .build();
}

// ❌ parseClaimsJwt 不验证签名！
Claims claims = Jwts.parser().parseClaimsJwt(token).getBody();

// ✅ parseClaimsJws 强制验证签名
Claims claims = Jwts.parser()
    .setSigningKey(secretKey)
    .parseClaimsJws(token)  // ← 带 's'
    .getBody();

// ❌ catch 范围过大，掩盖 UnsupportedJwtException
public boolean validateToken(String token) {
    try {
        Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
        return true;
    } catch (Exception e) {  // ← 太宽泛
        return false;
    }
}

// ❌ 弱密钥 / 硬编码
String secret = "mySecretKey";  // 太短
String secret = "abc123def456ghi789jkl012mno345pq";  // 硬编码

// ✅ 正确做法
Key key = Keys.secretKeyFor(SignatureAlgorithm.HS256);  // 自动生成 256 位
// 或从 Vault/KMS 安全存储读取

String token = Jwts.builder()
    .setSubject(userId)
    .setIssuer("https://auth.example.com")
    .setAudience("api.example.com")
    .setIssuedAt(new Date())
    .setExpiration(new Date(System.currentTimeMillis() + 900_000))  // 15分钟
    .signWith(privateKey, SignatureAlgorithm.RS256)
    .compact();

Jws<Claims> jws = Jwts.parserBuilder()
    .setSigningKey(publicKey)
    .requireIssuer("https://auth.example.com")
    .requireAudience("api.example.com")
    .build()
    .parseClaimsJws(token);

@Component
public class JwtTokenValidator {
    private final SecretKey secretKey;
    private final RedisTemplate<String, String> redis;

    public Claims validateAndParse(String token) {
        String tokenId = extractTokenId(token);
        if (Boolean.TRUE.equals(redis.hasKey("token:revoked:" + tokenId))) {
            throw new SecurityException("Token revoked");
        }

        return Jwts.parserBuilder()
            .setSigningKey(secretKey)
            .requireIssuer("auth.example.com")
            .requireAudience("api.example.com")
            .setAllowedClockSkewSeconds(30)
            .build()
            .parseClaimsJws(token)  // ← parseClaimsJws!
            .getBody();
    }
}

// ✅ JWE 加密 Token — 内容不可见
public String generateEncryptedToken(User user) throws Exception {
    // 1. 构建 JWT Claims
    JWTClaimsSet claims = new JWTClaimsSet.Builder()
        .subject(user.getId().toString())
        .claim("role", user.getRole())
        .issueTime(new Date())
        .expirationTime(new Date(System.currentTimeMillis() + 900_000))
        .build();

    // 2. 创建 JWE 头部
    JWEHeader header = new JWEHeader(
        JWEAlgorithm.RSA_OAEP_256,   // 密钥加密算法
        EncryptionMethod.A256GCM     // 内容加密算法
    );

    // 3. 加密
    EncryptedJWT jwt = new EncryptedJWT(header, claims);
    RSAEncrypter encrypter = new RSAEncrypter(publicKey);
    jwt.encrypt(encrypter);

    return jwt.serialize();
}

// 解密
public Claims decryptAndValidate(String encryptedToken) throws Exception {
    EncryptedJWT jwt = EncryptedJWT.parse(encryptedToken);
    RSADecrypter decrypter = new RSADecrypter(privateKey);
    jwt.decrypt(decrypter);
    
    // 然后再做常规 JWT 校验
    return jwt.getJWTClaimsSet();
}

@Service
public class TokenRotationService {

    @Autowired
    private RedisTemplate<String, String> redis;

    // Access Token: 15 分钟
    private static final Duration ACCESS_EXPIRY = Duration.ofMinutes(15);
    // Refresh Token: 7 天
    private static final Duration REFRESH_EXPIRY = Duration.ofDays(7);
    // Refresh Token 家族前缀，用于检测重用
    private static final String TOKEN_FAMILY = "token:family:";

    public TokenPair issueTokens(String userId) {
        String familyId = UUID.randomUUID().toString();
        String refreshId = UUID.randomUUID().toString();

        // 存储 refresh token 家族
        redis.opsForValue().set(TOKEN_FAMILY + familyId, refreshId, REFRESH_EXPIRY);

        String accessToken = generateAccessToken(userId, familyId);
        String refreshToken = generateRefreshToken(userId, familyId, refreshId);

        return new TokenPair(accessToken, refreshToken);
    }

    public TokenPair rotateTokens(String oldRefreshToken) {
        Claims claims = validateRefreshToken(oldRefreshToken);
        String familyId = claims.get("familyId", String.class);
        String oldRefreshId = claims.get("refreshId", String.class);

        // 检查 refresh token 是否已被使用（检测重用 → 说明被盗）
        String storedRefreshId = redis.opsForValue().get(TOKEN_FAMILY + familyId);
        if (storedRefreshId == null || !storedRefreshId.equals(oldRefreshId)) {
            // Refresh Token 重用！可能是被盗。
            // 立即吊销整个家族
            redis.delete(TOKEN_FAMILY + familyId);
            redis.opsForValue().set("token:family:revoked:" + familyId, "1", Duration.ofDays(7));
            
            // 强制用户重新登录，并发出告警
            log.warn("Refresh Token 重用检测：familyId={}", familyId);
            throw new SecurityException("Token 已被使用，请重新登录");
        }

        // 正常轮换：换发新的 refresh token
        String newRefreshId = UUID.randomUUID().toString();
        redis.opsForValue().set(TOKEN_FAMILY + familyId, newRefreshId, REFRESH_EXPIRY);

        String newAccessToken = generateAccessToken(claims.getSubject(), familyId);
        String newRefreshToken = generateRefreshToken(claims.getSubject(), familyId, newRefreshId);

        return new TokenPair(newAccessToken, newRefreshToken);
    }

    public void revokeFamily(String familyId) {
        redis.delete(TOKEN_FAMILY + familyId);
    }
}

// 签发 Token 时绑定客户端指纹
public String issueBoundToken(User user, HttpServletRequest request) {
    String fingerprint = generateFingerprint(request);
    
    return Jwts.builder()
        .setSubject(user.getId().toString())
        .claim("fp_hash", sha256(fingerprint))  // 指纹哈希存入 Token
        .setExpiration(new Date(System.currentTimeMillis() + 900_000))
        .signWith(privateKey, SignatureAlgorithm.RS256)
        .compact();
}

// 验证时比对指纹
public Claims validateBoundToken(String token, HttpServletRequest request) {
    Claims claims = validateAndParse(token);
    String currentFp = sha256(generateFingerprint(request));
    String storedFp = claims.get("fp_hash", String.class);
    
    if (!currentFp.equals(storedFp)) {
        throw new SecurityException("Token 客户端指纹不匹配");
    }
    return claims;
}

// 生成客户端指纹（IP + UA 组合）
private String generateFingerprint(HttpServletRequest request) {
    String ip = request.getHeader("X-Forwarded-For");
    if (ip == null) ip = request.getRemoteAddr();
    String ua = request.getHeader("User-Agent");
    return ip + "|" + ua;
}

// Shiro 1.2.4 源码 — 全网公开的硬编码密钥
private static final byte[] DEFAULT_CIPHER_KEY_BYTES = 
    Base64.decode("kPH+bIxk5D2deZiIxcaaaA==");

// Java Config — 使用随机强密钥
@Bean
public RememberMeManager rememberMeManager() {
    CookieRememberMeManager manager = new CookieRememberMeManager();
    KeyGenerator keyGen = KeyGenerator.getInstance("AES");
    keyGen.init(256);
    manager.setCipherKey(keyGen.generateKey().getEncoded());
    return manager;
}

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        ShiroFilterFactoryBean factory = new ShiroFilterFactoryBean();
        factory.setSecurityManager(securityManager);
        factory.setLoginUrl("/login");
        factory.setUnauthorizedUrl("/403");

        // 过滤器链 — 顺序敏感，精细在前
        Map<String, String> filterChain = new LinkedHashMap<>();
        filterChain.put("/login", "anon");
        filterChain.put("/api/public/**", "anon");
        filterChain.put("/api/admin/**", "authc,roles[admin]");
        filterChain.put("/api/user/**", "authc");
        filterChain.put("/**", "authc");
        factory.setFilterChainDefinitionMap(filterChain);
        return factory;
    }

    @Bean
    public DefaultWebSecurityManager securityManager(MyRealm realm) {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(realm);
        // 关键：禁用或加固 rememberMe
        manager.setRememberMeManager(null);
        return manager;
    }

    @Bean
    public MyRealm myRealm() {
        MyRealm realm = new MyRealm();
        realm.setCredentialsMatcher(hashedCredentialsMatcher());
        return realm;
    }

    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher() {
        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        matcher.setHashAlgorithmName("SHA-256");
        matcher.setHashIterations(1024);
        matcher.setStoredCredentialsHexEncoded(true);
        return matcher;
    }
}

public class MyRealm extends AuthorizingRealm {

    @Autowired
    private UserService userService;
    @Autowired
    private PermissionService permissionService;

    // 认证：验证用户名密码
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) throws AuthenticationException {
        
        String username = (String) token.getPrincipal();
        User user = userService.findByUsername(username);
        if (user == null) {
            throw new UnknownAccountException("用户不存在");
        }
        if (!user.isEnabled()) {
            throw new LockedAccountException("账号已禁用");
        }
        
        // 返回认证信息，Shiro 自动校验密码
        return new SimpleAuthenticationInfo(
            user,                    // principal
            user.getPassword(),      // hashed password
            ByteSource.Util.bytes(user.getSalt()),
            getName()                // realm name
        );
    }

    // 授权：加载用户权限和角色
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principals) {
        
        User user = (User) principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        
        // 角色
        Set<String> roles = userService.getRoles(user.getId());
        info.setRoles(roles);
        
        // 权限字符串
        Set<String> permissions = permissionService.getPermissions(user.getId());
        info.setStringPermissions(permissions);
        
        return info;
    }
}

@RestController
@RequestMapping("/api/admin")
public class AdminController {

    @RequiresRoles("admin")
    @GetMapping("/users")
    public List<User> getUsers() { }

    @RequiresPermissions("circle:admin:delete")
    @DeleteMapping("/circle/{id}")
    public void deleteCircle(@PathVariable Long id) { }
}

// 正确：使用预编译语句（PreparedStatement）
String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement pstmt = conn.prepareStatement(sql);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();