记一次处理短信盗刷问题的解决方案

前言

最近公司的注册接口经常在半夜被恶意访问，从而引发短信盗刷事件，原本在手机号等参数校验通过后，注册接口会对图形验证码进行正确性校验，校验通过后再进行短信发送。通过短信发送记录发现我们的图形验证码很容易就被识别了，没有起到安全过滤的作用，同时对短信发送次数没有进行上限设置，所以这此短信盗刷问题我们做了以下解决方案。

一、图形验证码增加识别难度

1.1自定义图形验证码

我们需要实现一个生成图形验证码的工具类VerifyCodeImageUtil.java

import java.awt.Color;
import java.awt.Font;
import java.awt.Graphics;
import java.awt.Graphics2D;
import java.awt.RenderingHints;
import java.awt.geom.AffineTransform;
import java.awt.image.BufferedImage;
import java.io.IOException;
import java.util.Arrays;
import java.util.Random;

public class VerifyCodeImageUtil {
   
   

    //去除I、l、1、0、o、O这这些容易混淆的字符
    public static final String VERIFY_CODES = "23456789ABCDEFGHJKMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz";

    private static int WEIGHT=230;

    private static int HIGH=100;

    private static Random random = new Random();


    /**
     * 使用系统默认字符源生成验证码
     * @param verifySize    验证码长度
     * @return
     */
    public static String generateVerifyCode(int verifySize){
        return generateVerifyCode(verifySize, VERIFY_CODES);
    }
    /**
     * 使用指定源生成验证码
     * @param verifySize    验证码长度
     * @param sources   验证码字符源
     * @return
     */
    public static String generateVerifyCode(int verifySize, String sources){
        if(sources == null || sources.length() == 0){
            sources = VERIFY_CODES;
        }
        int codesLen = sources.length();
        Random rand = new Random(System.currentTimeMillis());
        StringBuilder verifyCode = new StringBuilder(verifySize);
        for(int i = 0; i < verifySize; i++){
            verifyCode.append(sources.charAt(rand.nextInt(codesLen-1)));
        }
        return verifyCode.toString();
    }

    public static BufferedImage createVerifyImageNew(String verifyCode){
        BufferedImage image=getImage(WEIGHT, HIGH, verifyCode);
        return image;
        }


    /**
     * 设置验证码图片
     * @param w
     * @param h
     * @param code
     * @return
     */
    public static BufferedImage getImage(int w,int h,String code){
        int verifySize = code.length();
        BufferedImage image = new BufferedImage(w, h, BufferedImage.TYPE_INT_RGB);
        Random rand = new Random();
        Graphics2D g2 = image.createGraphics();
        g2.setRenderingHint(RenderingHints.KEY_ANTIALIASING,RenderingHints.VALUE_ANTIALIAS_ON);
        Color[] colors = new Color[5];
        Color[] colorSpaces = new Color[] { Color.WHITE, Color.CYAN,
                Color.GRAY, Color.LIGHT_GRAY, Color.MAGENTA, Color.ORANGE,
                Color.PINK, Color.YELLOW };
        float[] fractions = new float[colors.length];
        for(int i = 0; i < colors.length; i++){
            colors[i] = colorSpaces[rand.nextInt(colorSpaces.length)];
            fractions[i] = rand.nextFloat();
        }
        Arrays.sort(fractions);

        g2.setColor(Color.GRAY);// 设置边框色
        g2.fillRect(0, 0, w, h);

        Color c = getRandColor(200, 250);
        g2.setColor(c);// 设置背景色
        g2.fillRect(0, 2, w, h-4);

        //绘制干扰线
        Random random = new Random();
        g2.setColor(getRandColor(10, 200));
        for (int i = 0; i < 100; i++) {
  
  //干扰线的条数
            int x = random.nextInt(w - 10);
            int y = random.nextInt(h - 20);
            int xl = random.nextInt(10) + 1;
            int yl = random.nextInt(20) + 1;
            g2.drawLine(x, y, x + xl + 100, y + yl + 120);
        }

        // 添加噪点
        float yawpRate = 0.20f;// 噪声率
        int area = (int) (yawpRate * w * h);
        for (int i = 0; i < area; i++) {
            int x = random.nextInt(w);
            int y = random.nextInt(h);
            int rgb = getRandomIntColor();
            image.setRGB(x, y, rgb);
        }

        shear(g2, w, h, c);

        g2.setColor(getRandColor(100