spring+ jcaptcha(spring框架下的彩色验证码)

１、从jcaptcha官方网站下载jcaptcha的发行包，并将其发行包中的jar文件考贝到本地项目WEB-INF目录下的lib目录中。

官方网址 http://jcaptcha.sourceforge.net/

２、在web.xml文件中配置

 <servlet>
      <servlet-name>jcaptcha</servlet-name>
      <servlet-class>cn.hxex.order.core.jcaptcha.ImageCaptchaServlet</servlet-class>
      <load-on-startup>3</load-on-startup>
  </servlet>

  <servlet-mapping>
      <servlet-name>jcaptcha</servlet-name>
      <url-pattern>/captcha.jpg</url-pattern>
  </servlet-mapping>

３、jcaptcha在spring中的配置

    <bean id="channelProcessingFilter"
          class="org.acegisecurity.securechannel.ChannelProcessingFilter">
        <property name="channelDecisionManager">
            <ref local="channelDecisionManager"/> 
        </property>
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /j_security_check=REQUIRES_CAPTCHA_ONCE_ABOVE_THRESOLD_REQUESTS
            </value>
        </property>
    </bean>

    <bean id="channelDecisionManager"
          class="org.acegisecurity.securechannel.ChannelDecisionManagerImpl">
        <property name="channelProcessors"> 
            <list>
                <ref local="testOnceAfterMaxRequestsCaptchaChannelProcessor"/>
                <ref local="alwaysTestAfterTimeInMillisCaptchaChannelProcessor"/>
                <ref local="alwaysTestAfterMaxRequestsCaptchaChannelProcessor"/>
                <ref local="alwaysTestBelowAverageTimeInMillisBetweenRequestsChannelProcessor"/>
            </list>
        </property>
    </bean>

    <!-- REQUIRES_CAPTCHA_ONCE_ABOVE_THRESOLD_REQUESTS -->
    <bean id="testOnceAfterMaxRequestsCaptchaChannelProcessor"
          class="org.acegisecurity.captcha.TestOnceAfterMaxRequestsCaptchaChannelProcessor">
        <property name="thresold">
            <value>0</value>
        </property>
        <property name="entryPoint">
            <ref bean="captchaEntryPoint"/>
        </property>
    </bean>

    <!-- REQUIRES_CAPTCHA_ABOVE_THRESOLD_REQUESTS -->
    <bean id="alwaysTestAfterMaxRequestsCaptchaChannelProcessor"
          class="org.acegisecurity.captcha.AlwaysTestAfterMaxRequestsCaptchaChannelProcessor">
        <property name="thresold">
            <value>5</value>
        </property>
        <property name="entryPoint">
            <ref bean="captchaEntryPoint"/>
        </property>
    </bean>

    <!-- REQUIRES_CAPTCHA_AFTER_THRESOLD_IN_MILLIS -->
    <bean id="alwaysTestAfterTimeInMillisCaptchaChannelProcessor"
          class="org.acegisecurity.captcha.AlwaysTestAfterTimeInMillisCaptchaChannelProcessor">
        <property name="thresold">
            <value>5000</value>
        </property>
        <property name="entryPoint">
            <ref bean="captchaEntryPoint"/>
        </property>
    </bean>

    <!-- REQUIRES_CAPTCHA_BELOW_AVERAGE_TIME_IN_MILLIS_REQUESTS -->
     
    <bean
            id="alwaysTestBelowAverageTimeInMillisBetweenRequestsChannelProcessor"
            class="org.acegisecurity.captcha.AlwaysTestBelowAverageTimeInMillisBetweenRequestsChannelProcessor">
        <property name="thresold">
            <value>20000</value>
        </property>
        <property name="entryPoint">
            <ref bean="captchaEntryPoint"/>
        </property>
    </bean>

    <bean id="captchaEntryPoint"
          class="org.acegisecurity.captcha.CaptchaEntryPoint">
        <!--验证码验证失败后转向的页面!-->
        <property name="captchaFormUrl">
            <value>/admin/login.jsp?login_error=code_error</value>
        </property>
        <property name="includeOriginalRequest">
            <value>false</value>
        </property>
        <property name="includeOriginalParameters">
            <value>false</value>
        </property>
    </bean>

    <bean id="captchaValidationProcessingFilter"
          class="org.acegisecurity.captcha.CaptchaValidationProcessingFilter">
        <property name="captchaService">
            <ref bean="captchaService"/>
        </property>
        <property name="captchaValidationParameter" value="j_captcha_response"/>
    </bean>
    
    <!-- imageCaptchaService is injected into captchaImageCreateController as well as to captchaService beans -->
　　　<!--自己定义的实体类（注意路径！！）-->
    <bean id="captchaService" class="cn.hxex.order.core.jcaptcha.JCaptchaServiceProxyImpl">
        <property name="jcaptchaService" ref="imageCaptchaService"/>
    </bean>
    
    <bean id="imageCaptchaService" class="com.octo.captcha.service.image.DefaultManageableImageCaptchaService">
        <constructor-arg type="com.octo.captcha.service.captchastore.CaptchaStore" index="0">
            <ref bean="fastHashMapCaptchaStore"/>
        </constructor-arg>
        <!-- (1) which captcha Engine you use -->
        <constructor-arg type="com.octo.captcha.engine.CaptchaEngine" index="1">
            <ref bean="captchaEngineEx"/>
        </constructor-arg>
        <constructor-arg index="2">
            <value>180</value>
        </constructor-arg>
        <constructor-arg index="3">
            <value>100000</value>
        </constructor-arg>
        <constructor-arg index="4">
            <value>75000</value>
        </constructor-arg>
    </bean>

    <bean id="fastHashMapCaptchaStore" class="com.octo.captcha.service.captchastore.FastHashMapCaptchaStore"/>

    <!-- (2) you can define more than one captcha engine here -->
    <bean id="captchaEngineEx"
          class="cn.hxex.order.core.jcaptcha.engine.CaptchaEngineEx">      
    </bean>

         <bean id="filterChainProxy"
		class="org.acegisecurity.util.FilterChainProxy">
		<property name="filterInvocationDefinitionSource"> 
			<value>
				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
				PATTERN_TYPE_APACHE_ANT
				/**=httpSessionContextIntegrationFilter,captchaValidationProcessingFilter,channelProcessingFilter,authenticationProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
			</value>
		</property>
	</bean>

         <bean id="httpSessionContextIntegrationFilter"
		class="org.acegisecurity.context.HttpSessionContextIntegrationFilter">
		<!-- 将下面的property注释掉，验证码将无效！！！ -->
		<property name="context">
			<value>
				org.acegisecurity.captcha.CaptchaSecurityContextImpl
			</value>
		</property>
	</bean>
·············省略了一些spring安全框架的bean，自己加去吧

４、编写jcaptcha的实体类

实体类包的路径一定要和spring配置文件里的路径一样

（１）CaptchaEngine 类

package cn.hxex.order.core.jcaptcha.engine;

import java.awt.Color;

import com.octo.captcha.component.image.backgroundgenerator.BackgroundGenerator;
import com.octo.captcha.component.image.backgroundgenerator
  .FunkyBackgroundGenerator;
import com.octo.captcha.component.image.fontgenerator.FontGenerator;
import com.octo.captcha.component.image.fontgenerator
  .TwistedAndShearedRandomFontGenerator;
import com.octo.captcha.component.image.textpaster.RandomTextPaster;
import com.octo.captcha.component.image.textpaster.TextPaster;
import com.octo.captcha.component.image.wordtoimage.ComposedWordToImage;
import com.octo.captcha.component.image.wordtoimage.WordToImage;
import com.octo.captcha.component.word.wordgenerator.RandomWordGenerator;
import com.octo.captcha.component.word.wordgenerator.WordGenerator;
import com.octo.captcha.engine.image.ListImageCaptchaEngine;
import com.octo.captcha.image.gimpy.GimpyFactory;

/**
 * SpringSide Custom的认证图片
 * 
 * @author cac
 */
public class CaptchaEngine extends ListImageCaptchaEngine {
  /**
   * @see ListImageCaptchaEngine
   */
  protected void buildInitialFactories() {
    WordGenerator wordGenerator 
      = new RandomWordGenerator("023456789");
    // nteger minAcceptedWordLength, Integer maxAcceptedWordLength,Color[]
    // textColors
    TextPaster textPaster = new RandomTextPaster(4,5, Color.WHITE);
    // Integer width, Integer height
    BackgroundGenerator backgroundGenerator 
      = new FunkyBackgroundGenerator(100,40);
    // Integer minFontSize, Integer maxFontSize
    FontGenerator fontGenerator = new TwistedAndShearedRandomFontGenerator(20, 22);
    WordToImage wordToImage = new ComposedWordToImage(fontGenerator,
        backgroundGenerator, textPaster);
    addFactory(new GimpyFactory(wordGenerator, wordToImage));
  }
}

（２）CaptchaEngineEx 类

package cn.hxex.order.core.jcaptcha.engine;

import java.awt.Color;

import com.octo.captcha.component.image.backgroundgenerator.BackgroundGenerator;
import com.octo.captcha.component.image.backgroundgenerator
  .GradientBackgroundGenerator;
import com.octo.captcha.component.image.color.SingleColorGenerator;
import com.octo.captcha.component.image.fontgenerator.FontGenerator;
import com.octo.captcha.component.image.fontgenerator.RandomFontGenerator;
import com.octo.captcha.component.image.textpaster.DecoratedRandomTextPaster;
import com.octo.captcha.component.image.textpaster.TextPaster;
import com.octo.captcha.component.image.textpaster.textdecorator
  .BaffleTextDecorator;
import com.octo.captcha.component.image.textpaster.textdecorator
  .LineTextDecorator;
import com.octo.captcha.component.image.textpaster.textdecorator.TextDecorator;
import com.octo.captcha.component.image.wordtoimage.ComposedWordToImage;
import com.octo.captcha.component.image.wordtoimage.WordToImage;
import com.octo.captcha.component.word.wordgenerator.RandomWordGenerator;
import com.octo.captcha.component.word.wordgenerator.WordGenerator;
import com.octo.captcha.engine.image.ListImageCaptchaEngine;
import com.octo.captcha.image.gimpy.GimpyFactory;


/**
 * Captcha增强版本
 * 
 * @author [email protected]
 * @modifyTime 21:01:52
 * @description 
 * <pre>
 *  安装 Captcha Instruction <br>
 *  1.add captchaValidationProcessingFilter 
 *    to applicationContext-acegi-security.xml<br>
 *  2.modify applicationContext-captcha-security.xml
 *    <ul>
 *    <li> make sure that captchaValidationProcessingFilter Call captchaService
      <li> config CaptchaEngine for captchaService (refer imageCaptchaService) 
      <li> write your own CaptchaEngine
      <li> config the following, so that We use CaptchaEngineEx to generate the 
          captcha image. 
      </ul>
          <constructor-arg
 *              type="com.octo.captcha.engine.CaptchaEngine" index="1"> 
 *              <ref bean="captchaEngineEx"/gt; </constructor-arg> 
 * </pre>
 */
public class CaptchaEngineEx extends ListImageCaptchaEngine {
  /**
   * ...
   */
  protected void buildInitialFactories() {
    
     //Set Captcha Word Length Limitation which should not over 6     
    Integer minAcceptedWordLength = new Integer(4);
    Integer maxAcceptedWordLength = new Integer(5);
    //Set up Captcha Image Size: Height and Width    
    Integer imageHeight = new Integer(40);
    Integer imageWidth = new Integer(100);
    
    //Set Captcha Font Size    
    Integer minFontSize = new Integer(20);
    Integer maxFontSize = new Integer(22);
    //We just generate digit for captcha source char Although you can use
    //abcdefg......xyz
    WordGenerator wordGenerator 
      = new RandomWordGenerator("023456789");
 
     //cyt and unruledboy proved that backgroup not a factor of Security. A
     //captcha attacker won't affaid colorful backgroud, so we just use white
     //color, like google and hotmail.  
    BackgroundGenerator backgroundGenerator = new GradientBackgroundGenerator(
        imageWidth, imageHeight, Color.white, Color.white);
  
     //font is not helpful for security but it really increase difficultness for
     //attacker     
    FontGenerator fontGenerator = new RandomFontGenerator(minFontSize,
        maxFontSize);    
     // Note that our captcha color is Blue     
    SingleColorGenerator scg = new SingleColorGenerator(Color.blue);
  
     //decorator is very useful pretend captcha attack. we use two line text
     //decorators.
     
    LineTextDecorator lineDecorator = new LineTextDecorator(1, Color.blue);
    // LineTextDecorator line_decorator2 = new LineTextDecorator(1, Color.blue);
    TextDecorator[] textdecorators = new TextDecorator[1];

    textdecorators[0] = lineDecorator;
    // textdecorators[1] = line_decorator2;

    TextPaster textPaster = new DecoratedRandomTextPaster(
        minAcceptedWordLength, maxAcceptedWordLength, scg,
        new TextDecorator[] { new BaffleTextDecorator(new Integer(1),
            Color.white) });

    //ok, generate the WordToImage Object for logon service to use.
    WordToImage wordToImage = new ComposedWordToImage(
        fontGenerator, backgroundGenerator, textPaster);
    addFactory(new GimpyFactory(wordGenerator, wordToImage));
  }

}

（３）ImageCaptchaServlet 类

package cn.hxex.order.core.jcaptcha;

import com.octo.captcha.service.CaptchaServiceException;
import com.octo.captcha.service.image.ImageCaptchaService;
import com.sun.image.codec.jpeg.JPEGCodec;
import com.sun.image.codec.jpeg.JPEGImageEncoder;
import org.apache.commons.lang.StringUtils;
import org.springframework.context.ApplicationContext;
import org.springframework.web.context.support.WebApplicationContextUtils;

import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.awt.image.BufferedImage;
import java.io.ByteArrayOutputStream;
import java.io.IOException;

/**
 * Servlet generates CAPTCHA jpeg images based on the JCAPTCHA package. It's
 * configured via spring, and requires a ImageCaptchaService bean with the
 * id=imageCaptchaService
 * 基于JCAPTCHA生成CAPTCHA jpeg图片的Servlet。它通过Spring进行配置，并且set一个
 * 类型为ImageCaptchaService，id为imageCaptchaService的bean
 * @author Jason Thrasher
 */
@SuppressWarnings("serial")
public class ImageCaptchaServlet extends HttpServlet {
  /**
   * Captcha Service Name
   */
  private String captchaServiceName = "imageCaptchaService";
  /**
   * @see HttpServlet#init(ServletConfig)
   */
  public void init(ServletConfig servletConfig) throws ServletException {
    if (StringUtils.isNotBlank(servletConfig
        .getInitParameter("captchaServiceName"))) {
      captchaServiceName = servletConfig.getInitParameter("captchaServiceName");
    }

    super.init(servletConfig);
  }
  /**
   * @see HttpServlet#doGet()
   */
  protected void doGet(HttpServletRequest httpServletRequest,
      HttpServletResponse httpServletResponse) throws ServletException,
      IOException {

    byte[] captchaChallengeAsJpeg = null;
    // the output stream to render the captcha image as jpeg into
    ByteArrayOutputStream jpegOutputStream = new ByteArrayOutputStream();
    try {
      // get the image captcha service defined via the SpringFramework
      ApplicationContext ctx = WebApplicationContextUtils
          .getRequiredWebApplicationContext(getServletContext());
      Object bean = ctx.getBean(captchaServiceName);
      ImageCaptchaService imageCaptchaService = (ImageCaptchaService) bean;

      // get the session id that will identify the generated captcha.
      // the same id must be used to validate the response, the session id
      // is a good candidate!
      String captchaId = httpServletRequest.getSession().getId();
      // call the ImageCaptchaService getChallenge method
      BufferedImage challenge = imageCaptchaService.getImageChallengeForID(
          captchaId, httpServletRequest.getLocale());

      // a jpeg encoder
      JPEGImageEncoder jpegEncoder = JPEGCodec
          .createJPEGEncoder(jpegOutputStream);
      jpegEncoder.encode(challenge);
    } catch (IllegalArgumentException e) {
      httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND);
      return;
    } catch (CaptchaServiceException e) {
      httpServletResponse
          .sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
      return;
    }

    captchaChallengeAsJpeg = jpegOutputStream.toByteArray();
    // flush it in the response
    httpServletResponse.setHeader("Cache-Control", "no-store");
    httpServletResponse.setHeader("Pragma", "no-cache");
    httpServletResponse.setDateHeader("Expires", 0);
    httpServletResponse.setContentType("image/jpeg");
    ServletOutputStream responseOutputStream = httpServletResponse
        .getOutputStream();
    responseOutputStream.write(captchaChallengeAsJpeg);
    responseOutputStream.flush();
    responseOutputStream.close();
  }
}

（４）JCaptchaServiceProxyImpl 类

package cn.hxex.order.core.jcaptcha;

import com.octo.captcha.service.CaptchaService;
import com.octo.captcha.service.CaptchaServiceException;
import org.acegisecurity.captcha.CaptchaServiceProxy;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

/**
 * 实现 CaptchaServiceProxy 用于acegi来校验，由spring注入jcaptchaService
 * 
 * @author [email protected]
 */
public class JCaptchaServiceProxyImpl implements CaptchaServiceProxy {
  /**
   * Log for the class
   */
  protected static Log log = LogFactory.getLog(JCaptchaServiceProxyImpl.class);
  /**
   * instance of CaptchaService.
   */
  private CaptchaService jcaptchaService;
  
  /**
   * @see {@link CaptchaServiceProxy#validateReponseForId(String, Object)}
   */
  public boolean validateReponseForId(String id, Object response) {
    log.debug("validating captcha response");

    try {
      boolean isHuman = jcaptchaService.validateResponseForID(id, response)
          .booleanValue();
      if (isHuman) {
        log.debug("captcha passed");
      } else {
        log.warn("captcha failed");
      }
      return isHuman;

    } catch (CaptchaServiceException cse) {
      // fixes known bug in JCaptcha
      log.warn("captcha validation failed due to exception", cse);
      return false;
    }
  }

  public void setJcaptchaService(CaptchaService jcaptchaService) {
    this.jcaptchaService = jcaptchaService;
  }
}