add:增加短信的防攻击手段

controllers/user.go

@@ -6,6 +6,7 @@ import (
 	"eta/eta_mini_api/models/request"
 	"eta/eta_mini_api/models/response"
 	"eta/eta_mini_api/services"
+	"eta/eta_mini_api/services/go_redis"
 	"eta/eta_mini_api/utils"
 	"fmt"
 	"strings"
@@ -154,6 +155,12 @@ func (this *UserController) GetVerifyCode() {
 			br.Msg = "您的手机号输入有误, 请检查"
 			return
 		}
+		phoneKey := utils.CACHE_ACCESS_PHONE_LOGIN_CODE + req.AreaCode + req.Phone
+		res, _ := go_redis.RedisInt(phoneKey)
+		if res > 5 {
+			br.Msg = "验证码发送太频繁，请稍后重试"
+			return
+		}
 		var ok bool
 		if req.AreaCode == "86" {
 			ok = services.SendSmsCode(req.Phone, code)
@@ -177,6 +184,12 @@ func (this *UserController) GetVerifyCode() {
 				return
 			}
 			br.Msg = "发送成功"
+			isExist := go_redis.IsExist(phoneKey)
+			if isExist {
+				go_redis.Incr(phoneKey)
+			} else {
+				go_redis.SetNX(phoneKey, 1, time.Minute*15)
+			}
 		}
 	case 2:
 		if req.Email == "" {
@@ -186,6 +199,14 @@ func (this *UserController) GetVerifyCode() {
 			br.Msg = "您的邮箱格式输入有误, 请检查"
 			return
 		}
+
+		emailKey := utils.CACHE_ACCESS_EMAIL_LOGIN_CODE + req.Email
+		res, _ := go_redis.RedisInt(emailKey)
+		if res > 5 {
+			br.Msg = "验证码发送太频繁，请稍后重试"
+			return
+		}
+
 		date := time.Now()
 		content := "尊敬的用户：</br>本次请求的验证码为：" + code + "（为了保障您账号的安全性，请在15分钟内完成验证。）</br>东吴期货研究团队 </br>" + fmt.Sprintf("%d年%02d月%02d日", date.Year(), date.Month(), date.Day())
 		title := "东吴期货登录验证"
@@ -209,6 +230,12 @@ func (this *UserController) GetVerifyCode() {
 				return
 			}
 			br.Msg = "发送成功"
+			isExist := go_redis.IsExist(emailKey)
+			if isExist {
+				go_redis.Incr(emailKey)
+			} else {
+				go_redis.SetNX(emailKey, 1, time.Minute*15)
+			}
 		} else {
 			br.Msg = "发送失败"
 		}

services/go_redis/redis.go

@@ -85,3 +85,8 @@ func BRPop2Func(key string, callback func([]byte)) {
 	callback(resultByte)
 	return
 }
+
+func Incr(key string) (err error) {
+	err = utils.Redis.Incr(context.TODO(), key).Err()
+	return
+}

utils/constants.go

@@ -61,6 +61,8 @@ const (
 	CACHE_ACCESS_TOKEN_LOGIN          = "pc_eta_min_crm:login:"          //管理后台登录
 	CACHE_ACCESS_TOKEN_LOGIN_NO_TRUST = "pc_eta_min_crm:login:no_trust:" //管理后台登录（不可信登录态）
 	CACHE_ACCESS_WX_BIND              = "eta_mini_api:phone:email:"      //管理后台登录（不可信登录态）
+	CACHE_ACCESS_EMAIL_LOGIN_CODE     = "eta_mini_api:login:email:"      //邮箱验证码防攻击key
+	CACHE_ACCESS_PHONE_LOGIN_CODE     = "eta_mini_api:login:phone:"      //手机验证码防攻击key
 )
 
 // 缓存key