center/dataease-dm
center/dataease-dm
13
0
Fork 0
forked from github/dataease
Code Pull Requests Activity

Merge pull request #4457 from dataease/pr@dev@fix_token_valid_after_logout

Browse Source 
fix(登录): 退出登录后token依然可用(jwt通病)
This commit is contained in:
fit2cloud-chenyw 2023-02-04 21:00:59 +08:00 committed by GitHub
commit 1840a40fb3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 51 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/main/java/io/dataease/auth/config/F2CRealm.java
View File

@ -11,6 +11,7 @@ import io.dataease.auth.service.AuthUserService;
import io.dataease.auth.util.JWTUtils;
import io.dataease.commons.utils.BeanUtils;
import io.dataease.commons.utils.LogUtil;
import io.dataease.commons.utils.TokenCacheUtils;
import io.dataease.listener.util.CacheUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
@ -83,6 +84,9 @@ public class F2CRealm extends AuthorizingRealm {
token = (String) auth.getCredentials();
// 解密获得username，用于和数据库进行对比
tokenInfo = JWTUtils.tokenInfoByToken(token);
if (!TokenCacheUtils.validate(token)) {
throw new AuthenticationException("token invalid");
}
} catch (Exception e) {
throw new AuthenticationException(e);
}

4
backend/src/main/java/io/dataease/auth/filter/JWTFilter.java
View File

@ -10,6 +10,7 @@ import io.dataease.auth.service.AuthUserService;
import io.dataease.auth.util.JWTUtils;
import io.dataease.commons.utils.CommonBeanFactory;
import io.dataease.commons.utils.LogUtil;
import io.dataease.commons.utils.TokenCacheUtils;
import io.dataease.exception.DataEaseException;
import io.dataease.i18n.Translator;
import org.apache.commons.lang3.StringUtils;
@ -65,6 +66,9 @@ public class JWTFilter extends BasicHttpAuthenticationFilter {
if (StringUtils.startsWith(authorization, "Basic")) {
return false;
}
if (!TokenCacheUtils.validate(authorization)) {
throw new AuthenticationException(expireMessage);
}
// 当没有出现登录超时 且需要刷新token 则执行刷新token
if (JWTUtils.loginExpire(authorization)) {
throw new AuthenticationException(expireMessage);

2
backend/src/main/java/io/dataease/auth/server/AuthServer.java
View File

@ -234,6 +234,7 @@ public class AuthServer implements AuthApi {
if (StringUtils.isBlank(result)) {
result = "success";
}
TokenCacheUtils.remove(token);
} catch (Exception e) {
LogUtil.error(e);
if (StringUtils.isBlank(result)) {
@ -287,6 +288,7 @@ public class AuthServer implements AuthApi {
if (StringUtils.isBlank(result)) {
result = "success";
}
TokenCacheUtils.remove(token);
} catch (Exception e) {
LogUtil.error(e);
if (StringUtils.isBlank(result)) {

5
backend/src/main/java/io/dataease/auth/util/JWTUtils.java
View File

@ -10,6 +10,7 @@ import com.auth0.jwt.interfaces.Verification;
import io.dataease.auth.entity.TokenInfo;
import io.dataease.auth.entity.TokenInfo.TokenInfoBuilder;
import io.dataease.commons.utils.CommonBeanFactory;
import io.dataease.commons.utils.TokenCacheUtils;
import io.dataease.exception.DataEaseException;
import org.apache.commons.lang3.ObjectUtils;
import org.apache.commons.lang3.StringUtils;
@ -117,7 +118,9 @@ public class JWTUtils {
Builder builder = JWT.create()
.withClaim("username", tokenInfo.getUsername())
.withClaim("userId", tokenInfo.getUserId());
return builder.withExpiresAt(date).sign(algorithm);
String sign = builder.withExpiresAt(date).sign(algorithm);
TokenCacheUtils.add(sign, tokenInfo.getUserId());
return sign;
} catch (Exception e) {
return null;

28
backend/src/main/java/io/dataease/commons/utils/TokenCacheUtils.java Normal file
View File

@ -0,0 +1,28 @@
package io.dataease.commons.utils;
import io.dataease.listener.util.CacheUtils;
import org.apache.commons.lang3.ObjectUtils;
import org.apache.commons.lang3.StringUtils;
public class TokenCacheUtils {
private static final String KEY = "sys_token_store";
public static void add(String token, Long userId) {
CacheUtils.put(KEY, token, userId, null, null);
}
public static void remove(String token) {
CacheUtils.remove(KEY, token);
}
public static boolean validate(String token) {
Object sys_token_store = CacheUtils.get(KEY, token);
return ObjectUtils.isNotEmpty(sys_token_store) && StringUtils.isNotBlank(sys_token_store.toString());
}
public static boolean validate(String token, Long userId) {
Object sys_token_store = CacheUtils.get(KEY, token);
return ObjectUtils.isNotEmpty(sys_token_store) && StringUtils.isNotBlank(sys_token_store.toString()) && userId == Long.parseLong(sys_token_store.toString());
}
}

9
backend/src/main/resources/ehcache/ehcache.xml
View File

@ -270,5 +270,14 @@
memoryStoreEvictionPolicy="LRU"
/>
<cache
name="sys_token_store"
eternal="true"
maxElementsInMemory="100"
maxElementsOnDisk="3000"
overflowToDisk="true"
diskPersistent="false"
/>
</ehcache>