center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

Merge pull request #1286 from dataease/pr@dev@fix_token_security

Browse Source 
fix: token验签逻辑错误
This commit is contained in:
fit2cloud-chenyw 2021-11-26 13:48:20 +08:00 committed by GitHub
commit 1359a673f6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
backend/src/main/java/io/dataease/auth/filter/JWTFilter.java
View File

@ -1,5 +1,6 @@
package io.dataease.auth.filter;
import com.auth0.jwt.algorithms.Algorithm;
import io.dataease.auth.entity.ASKToken;
import io.dataease.auth.entity.JWTToken;
import io.dataease.auth.entity.SysUserEntity;
@ -115,9 +116,9 @@ public class JWTFilter extends BasicHttpAuthenticationFilter {
DataEaseException.throwException(Translator.get("i18n_not_find_user"));
}
String password = user.getPassword();
Algorithm algorithm = Algorithm.HMAC256(password);
JWTUtils.verifySign(algorithm, token);
String newToken = JWTUtils.sign(tokenInfo, password);
// 设置响应的Header头新Token
HttpServletResponse httpServletResponse = (HttpServletResponse) response;
httpServletResponse.addHeader("Access-Control-Expose-Headers", "RefreshAuthorization");

8
backend/src/main/java/io/dataease/auth/util/JWTUtils.java
View File

@ -35,15 +35,23 @@ public class JWTUtils {
* @return 是否正确
*/
public static boolean verify(String token, TokenInfo tokenInfo, String secret) {
Algorithm algorithm = Algorithm.HMAC256(secret);
Verification verification = JWT.require(algorithm)
.withClaim("username", tokenInfo.getUsername())
.withClaim("userId", tokenInfo.getUserId());
JWTVerifier verifier = verification.build();
verifySign(algorithm, token);
verifier.verify(token);
return true;
}
public static void verifySign(Algorithm algorithm, String token) {
DecodedJWT decode = JWT.decode(token);
algorithm.verify(decode);
}
/**
* 获得token中的信息无需secret解密也能获得
*