生成酒店客用WiFi4位随机密码时规避违规词汇的技术方案咨询

Absolutely—this is a practical, user-friendly solution that fits your exact needs perfectly. Let’s break down why it works, plus the key implementation details to make it run smoothly:

Why This Approach Is Viable #

• Aligns with your core goals: It keeps passwords short/easy to remember (4 characters) while blocking inappropriate content, without adding excessive overhead to the generation process. With only ~450k possible 4-letter combinations, checks are lightning-fast.
• Highly maintainable: You can update the wordlist anytime—add new slang, remove outdated terms, or even block hotel-specific sensitive phrases (like internal codes) as needed.
• Proactive user experience: Catching bad passwords before guests receive them avoids awkward interactions, complaints, or unnecessary support calls way better than fixing issues after the fact.

Key Implementation Details #

1. Design Your Forbidden Word Database Table #

Keep it simple but flexible with these fields:

• forbidden_word: The exact string to block (e.g., POOP, DICK). Store all entries in a consistent case (all uppercase, for example) to avoid case-sensitive misses.
• is_active: A boolean flag to temporarily disable entries without deleting them (useful for testing or edge cases).
• created_at: Timestamp for tracking when terms were added, helpful for auditing.

Since your passwords are exactly 4 characters, full-string matches are all you need—no need to handle substring checks (which would be overkill here).

2. Build the Generation + Check Workflow #

Follow this loop for reliable results:

1. Generate a random 4-character string (stick to uppercase letters if possible—they’re easier for guests to read off a card).
2. Convert the generated password to match your wordlist’s case (e.g., uppercase) to ensure case-insensitive checks.
3. Check if the converted string exists in your forbidden word set.
   • If it does: Discard it and generate a new one.
   • If it doesn’t: Use this password for the guest.
4. Add a retry limit (e.g., 10 attempts) to avoid infinite loops in the unlikely event your wordlist grows unexpectedly large.

3. Optimize for Performance #

• Cache the wordlist in memory: Load the forbidden words into a Set (in your app or a tool like Redis) on startup. This avoids hitting the database for every password check—critical if you’re generating dozens of passwords per hour.
• Sync cache with the database: Set up a scheduled refresh (e.g., daily at 2 AM) or trigger an update whenever you add/remove terms from the database to keep the cache current.

4. Maintain Your Wordlist Proactively #

Don’t stop at obvious slurs—expand it to cover:

• Offensive numeric combinations (e.g., 6969 if you include numbers in passwords).
• Overly predictable sequences (e.g., AAAA, 1234—though this could be a separate rule instead of part of the forbidden wordlist, depending on your anti-cracking needs).
• Hotel-specific no-nos (e.g., abbreviations of your hotel’s name that might be misused).
• Collect feedback from your front desk team—if a guest complains about a password, add it to the list immediately.

5. Handle Edge Cases #

• Case insensitivity: Always normalize both the generated password and wordlist entries to the same case (e.g., all uppercase) so PoOp gets blocked just like POOP.
• Character set consistency: If your passwords include numbers or symbols, make sure your wordlist includes forbidden combinations using those characters too.

内容的提问来源于stack exchange，提问作者Beems