center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

fix: token验签逻辑错误

Browse Source
This commit is contained in:
fit2cloud-chenyw 2021-11-26 13:47:17 +08:00
parent eef5baed06
commit 036859f670
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
backend/src/main/java/io/dataease/auth/filter/JWTFilter.java
View File

@ -1,5 +1,6 @@
package io.dataease.auth.filter; package io.dataease.auth.filter;
import com.auth0.jwt.algorithms.Algorithm;
import io.dataease.auth.entity.ASKToken; import io.dataease.auth.entity.ASKToken;
import io.dataease.auth.entity.JWTToken; import io.dataease.auth.entity.JWTToken;
import io.dataease.auth.entity.SysUserEntity; import io.dataease.auth.entity.SysUserEntity;
@ -115,9 +116,9 @@ public class JWTFilter extends BasicHttpAuthenticationFilter {
DataEaseException.throwException(Translator.get("i18n_not_find_user")); DataEaseException.throwException(Translator.get("i18n_not_find_user"));
} }
String password = user.getPassword(); String password = user.getPassword();
Algorithm algorithm = Algorithm.HMAC256(password);
JWTUtils.verifySign(algorithm, token);
String newToken = JWTUtils.sign(tokenInfo, password); String newToken = JWTUtils.sign(tokenInfo, password);
// 设置响应的Header头新Token // 设置响应的Header头新Token
HttpServletResponse httpServletResponse = (HttpServletResponse) response; HttpServletResponse httpServletResponse = (HttpServletResponse) response;
httpServletResponse.addHeader("Access-Control-Expose-Headers", "RefreshAuthorization"); httpServletResponse.addHeader("Access-Control-Expose-Headers", "RefreshAuthorization");

8
backend/src/main/java/io/dataease/auth/util/JWTUtils.java
View File

@ -35,15 +35,23 @@ public class JWTUtils {
* @return 是否正确 * @return 是否正确
*/ */
public static boolean verify(String token, TokenInfo tokenInfo, String secret) { public static boolean verify(String token, TokenInfo tokenInfo, String secret) {
Algorithm algorithm = Algorithm.HMAC256(secret); Algorithm algorithm = Algorithm.HMAC256(secret);
Verification verification = JWT.require(algorithm) Verification verification = JWT.require(algorithm)
.withClaim("username", tokenInfo.getUsername()) .withClaim("username", tokenInfo.getUsername())
.withClaim("userId", tokenInfo.getUserId()); .withClaim("userId", tokenInfo.getUserId());
JWTVerifier verifier = verification.build(); JWTVerifier verifier = verification.build();
verifySign(algorithm, token);
verifier.verify(token); verifier.verify(token);
return true; return true;
} }
public static void verifySign(Algorithm algorithm, String token) {
DecodedJWT decode = JWT.decode(token);
algorithm.verify(decode);
}
/** /**
* 获得token中的信息无需secret解密也能获得 * 获得token中的信息无需secret解密也能获得
* *