center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

fix: token验签逻辑错误

Browse Source
This commit is contained in:
fit2cloud-chenyw 2021-11-26 13:47:17 +08:00
parent eef5baed06
commit 036859f670
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
backend/src/main/java/io/dataease/auth/filter/JWTFilter.java
View File

@ -1,5 +1,6 @@
package io.dataease.auth.filter;
import com.auth0.jwt.algorithms.Algorithm;
import io.dataease.auth.entity.ASKToken;
import io.dataease.auth.entity.JWTToken;
import io.dataease.auth.entity.SysUserEntity;
@ -115,9 +116,9 @@ public class JWTFilter extends BasicHttpAuthenticationFilter {
DataEaseException.throwException(Translator.get("i18n_not_find_user"));
}
String password = user.getPassword();
Algorithm algorithm = Algorithm.HMAC256(password);
JWTUtils.verifySign(algorithm, token);
String newToken = JWTUtils.sign(tokenInfo, password);
// 设置响应的Header头新Token
HttpServletResponse httpServletResponse = (HttpServletResponse) response;
httpServletResponse.addHeader("Access-Control-Expose-Headers", "RefreshAuthorization");

8
backend/src/main/java/io/dataease/auth/util/JWTUtils.java
View File

@ -35,15 +35,23 @@ public class JWTUtils {
* @return 是否正确
*/
public static boolean verify(String token, TokenInfo tokenInfo, String secret) {
Algorithm algorithm = Algorithm.HMAC256(secret);
Verification verification = JWT.require(algorithm)
.withClaim("username", tokenInfo.getUsername())
.withClaim("userId", tokenInfo.getUserId());
JWTVerifier verifier = verification.build();
verifySign(algorithm, token);
verifier.verify(token);
return true;
}
public static void verifySign(Algorithm algorithm, String token) {
DecodedJWT decode = JWT.decode(token);
algorithm.verify(decode);
}
/**
* 获得token中的信息无需secret解密也能获得
*