xinyin025/RuoYi-Vue-Plus
1
0
Fork 0
mirror of https://github.com/dromara/RuoYi-Vue-Plus.git synced 2025-11-04 16:23:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

update 优化 SaInterceptor 拦截器判断 token 客户端id是否有效 ;

Browse Source
This commit is contained in:
zlyx
2023-07-24 18:05:01 +08:00
parent 9e9a1920ac
commit 0217706960
7 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ruoyi-admin/src/main/java/org/dromara/web/service/impl/EmailAuthStrategy.java
View File

@@ -66,6 +66,7 @@ public class EmailAuthStrategy implements IAuthStrategy {
// 例如: 后台用户30分钟过期 app用户1天过期
model.setTimeout(client.getTimeout());
model.setActiveTimeout(client.getActiveTimeout());
model.setExtra(LoginHelper.CLIENT_KEY, clientId);
// 生成token
LoginHelper.login(loginUser, model);

1
ruoyi-admin/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java
View File

@@ -76,6 +76,7 @@ public class PasswordAuthStrategy implements IAuthStrategy {
// 例如: 后台用户30分钟过期 app用户1天过期
model.setTimeout(client.getTimeout());
model.setActiveTimeout(client.getActiveTimeout());
model.setExtra(LoginHelper.CLIENT_KEY, clientId);
// 生成token
LoginHelper.login(loginUser, model);

1
ruoyi-admin/src/main/java/org/dromara/web/service/impl/SmsAuthStrategy.java
View File

@@ -66,6 +66,7 @@ public class SmsAuthStrategy implements IAuthStrategy {
// 例如: 后台用户30分钟过期 app用户1天过期
model.setTimeout(client.getTimeout());
model.setActiveTimeout(client.getActiveTimeout());
model.setExtra(LoginHelper.CLIENT_KEY, clientId);
// 生成token
LoginHelper.login(loginUser, model);

1
ruoyi-admin/src/main/java/org/dromara/web/service/impl/SocialAuthStrategy.java
View File

@@ -103,6 +103,7 @@ public class SocialAuthStrategy implements IAuthStrategy {
// 例如: 后台用户30分钟过期 app用户1天过期
model.setTimeout(client.getTimeout());
model.setActiveTimeout(client.getActiveTimeout());
model.setExtra(LoginHelper.CLIENT_KEY, clientId);
// 生成token
LoginHelper.login(loginUser, model);

1
ruoyi-admin/src/main/java/org/dromara/web/service/impl/XcxAuthStrategy.java
View File

@@ -61,6 +61,7 @@ public class XcxAuthStrategy implements IAuthStrategy {
// 例如: 后台用户30分钟过期 app用户1天过期
model.setTimeout(client.getTimeout());
model.setActiveTimeout(client.getActiveTimeout());
model.setExtra(LoginHelper.CLIENT_KEY, clientId);
// 生成token
LoginHelper.login(loginUser, model);

1
ruoyi-common/ruoyi-common-satoken/src/main/java/org/dromara/common/satoken/utils/LoginHelper.java
View File

@@ -34,6 +34,7 @@ public class LoginHelper {
public static final String LOGIN_USER_KEY = "loginUser";
public static final String TENANT_KEY = "tenantId";
public static final String USER_KEY = "userId";
public static final String CLIENT_KEY = "clientid";
/**
* 登录系统 基于 设备类型

16
ruoyi-common/ruoyi-common-security/src/main/java/org/dromara/common/security/config/SecurityConfig.java
View File

@@ -1,9 +1,13 @@
package org.dromara.common.security.config;
import cn.dev33.satoken.exception.NotLoginException;
import cn.dev33.satoken.interceptor.SaInterceptor;
import cn.dev33.satoken.router.SaRouter;
import cn.dev33.satoken.stp.StpUtil;
import org.dromara.common.core.utils.ServletUtils;
import org.dromara.common.core.utils.SpringUtils;
import org.dromara.common.core.utils.StringUtils;
import org.dromara.common.satoken.utils.LoginHelper;
import org.dromara.common.security.config.properties.SecurityProperties;
import org.dromara.common.security.handler.AllUrlHandler;
import lombok.RequiredArgsConstructor;
@@ -44,6 +48,18 @@ public class SecurityConfig implements WebMvcConfigurer {
// 检查是否登录 是否有token
StpUtil.checkLogin();
// 检查 header 里的 clientId 与 token 里的是否一致
String headerCid = ServletUtils.getRequest().getHeader(LoginHelper.CLIENT_KEY);
String clientId = StpUtil.getExtra(LoginHelper.CLIENT_KEY).toString();
if (!StringUtils.equals(headerCid, clientId)) {
// token 无效
throw NotLoginException.newInstance(
StpUtil.getLoginType(),
NotLoginException.INVALID_TOKEN,
NotLoginException.NOT_TOKEN_MESSAGE,
StpUtil.getTokenValue());
}
// 有效率影响 用于临时测试
// if (log.isDebugEnabled()) {
// log.debug("剩余有效时间: {}", StpUtil.getTokenTimeout());