当前位置：首页 > news >正文

TFA（双因素认证，Two-Factor Authentication）验证

news 2026/3/27 3:12:53

1.服务器为每个用户生成唯一的32位密钥，通过二维码安全传递给认证器应用

/// <summary>
/// 生成TFA二维码
/// </summary>
/// <param name="userId"></param>
/// <returns></returns>
/// <exception cref="CustomException"></exception>
public async Task<string> GeneratingVerifyQRCode(long userId)
{var user = await _db.Queryable<User>().Where(u => u.Id == userId).FirstOrDefaultAsync();if (user == null)throw new CustomException(ErrorCode.LoginAccountIsNotExist);string accountTitle = $"TestBase:{user.Account}";string code = user.Account + "|" + user.TFASeed;string key = EncryptCodeHelper.MD5Encrypt(code);var qrCode = TFAHelper.GeneratingVerifyQRCode(accountTitle, key, 300, 300);return qrCode;
}

EncryptCodeHelper.MD5Encrypt

public static string MD5Encrypt(string data)
{MD5 mD5 = MD5.Create();byte[] s = mD5.ComputeHash(Encoding.UTF8.GetBytes(data));return BitConverter.ToString(s).Replace("-", "");
}

TFAHelper.GeneratingVerifyQRCode

 /// <summary>/// 生成TFA二维码/// </summary>/// <param name="accountTitle"></param>/// <param name="accountSecretKey"></param>/// <param name="qrCodeWidth">二维码宽</param>/// <param name="qrCodeHeight">二维码高</param>/// <returns></returns>public static string GeneratingVerifyQRCode(string accountTitle, string accountSecretKey, int qrCodeWidth, int qrCodeHeight){TwoFactorAuthenticator twoFactor = new TwoFactorAuthenticator();var setupInfo = twoFactor.GenerateSetupCode(accountTitle, accountSecretKey, qrCodeWidth, qrCodeHeight);#region 二维码生成string content = $"otpauth://totp/{accountTitle}?secret={setupInfo.ManualEntryKey}";var options = new QrCodeEncodingOptions(){DisableECI = true,CharacterSet = "UTF-8",Width = qrCodeWidth,Height = qrCodeHeight,Margin = 0,//指定生成条形码时使用的边距 二维码不需要?
     };var qr = new ZXing.ZKWeb.BarcodeWriter();qr.Options = options;qr.Format = BarcodeFormat.QR_CODE;Bitmap bitmap = new Bitmap(qr.Write(content));Graphics g = Graphics.FromImage(bitmap);g.DrawImage(bitmap, 142, 410);//142与410设置的意义，改为0、0有什么区别
MemoryStream stream = new MemoryStream();bitmap.Save(stream, ImageFormat.Jpeg);byte[] data = new byte[stream.Length];stream.Position = 0;stream.Read(data, 0, data.Length);stream.Close();var str64 = Convert.ToBase64String(data);return str64;#endregion}

2.验证码校验

 /// <summary>/// 验证TFACode/// </summary>/// <param name="code"></param>/// <returns></returns>public async Task<bool> VerifyCode(string code, long userId){var user = await _db.Queryable<User>().Where(u => u.Id == userId).FirstOrDefaultAsync();if (user == null)throw new CustomException(ErrorCode.LoginAccountIsNotExist);string keyCode = user.Account + "|" + user.TFASeed;string key = EncryptCodeHelper.MD5Encrypt(code);return TFAHelper.ValidateTwoFactorPIN(key, code);}

TFAHelper.ValidateTwoFactorPIN

/// <summary>
/// 验证TFA验证码
/// </summary>
/// <param name="accountSecretKey"></param>
/// <param name="code"></param>
/// <returns></returns>
public static bool ValidateTwoFactorPIN(string accountSecretKey, string code)
{TwoFactorAuthenticator twoFactor = new TwoFactorAuthenticator();return twoFactor.ValidateTwoFactorPIN(accountSecretKey, code, TimeSpan.FromMinutes(5));//目的是为了防止服务器时间和手机时间有差异,默认5分钟
}