diff --git a/lib/EmergencyService/pom.xml b/lib/EmergencyService/pom.xml index c4a1c19f..02f3a93f 100644 --- a/lib/EmergencyService/pom.xml +++ b/lib/EmergencyService/pom.xml @@ -92,7 +92,19 @@ spring-boot-devtools true - + + org.springframework.session + spring-session-core + + + org.springframework.session + spring-session-data-redis + + + org.springframework.session + spring-session + 1.3.1.RELEASE + mysql diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java index 18a85cc2..a9ff8df2 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java @@ -1,5 +1,6 @@ package com.zdxt.auth.framework.config; +import org.apache.tomcat.util.http.SameSiteCookies; import org.springframework.http.HttpHeaders; import org.springframework.http.ResponseCookie; import org.springframework.stereotype.Component; @@ -10,7 +11,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; -//@Component +@Component public class CookieFilter implements Filter { @@ -21,6 +22,7 @@ public class CookieFilter implements Filter { String url = httpRequest.getRequestURL().toString(); + Cookie[] cookies = httpRequest.getCookies(); if (cookies != null){ StringBuilder sb = new StringBuilder(); @@ -28,10 +30,13 @@ public class CookieFilter implements Filter { String cookieName = cookie.getName(); String cookieValue = cookie.getValue(); System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue); - ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Strict").build(); - httpResponse.addHeader(HttpHeaders.SET_COOKIE,lastCookie.toString()); - httpResponse.addHeader(HttpHeaders.COOKIE,lastCookie.toString()); +// ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Lax").build(); + + sb.append(cookieName).append("=").append(cookieValue).append(";"); } + sb.append("HttpOnly; SameSite=Lax"); + httpResponse.addHeader(HttpHeaders.SET_COOKIE,sb.toString()); + httpResponse.addHeader(HttpHeaders.COOKIE,sb.toString()); } filterChain.doFilter(httpRequest,httpResponse); diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java index c8df44f6..bad19d9b 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java @@ -25,8 +25,7 @@ public class CorsFilter implements Filter { throws IOException, ServletException { HttpServletResponse res = (HttpServletResponse) response; res.addHeader("Access-Control-Allow-Credentials", "true"); - res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin")); -// res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3"); + res.addHeader("Access-Control-Allow-Origin", "*"); res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token"); res.addHeader("X-Frame-Options", "SAMEORIGIN"); @@ -42,7 +41,7 @@ public class CorsFilter implements Filter { // response.getWriter().println("ok"); // return; // } - // 判断请求方法是否为OPTIONS +// TODO 暂时允许options 判断请求方法是否为OPTIONS // if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) { // // 设置响应头信息，禁止OPTIONS请求 // res.setHeader("Allow", "GET, POST, HEAD, PUT, DELETE"); diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java index 1ad2a9eb..c9b24cde 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java @@ -1,81 +1,81 @@ -//package com.zdxt.auth.framework.config; -// -//import java.util.Map; -//import javax.servlet.DispatcherType; -// -//import org.springframework.beans.factory.annotation.Autowired; -//import org.springframework.beans.factory.annotation.Value; -//import org.springframework.boot.web.servlet.FilterRegistrationBean; -//import org.springframework.context.annotation.Bean; -//import org.springframework.context.annotation.Configuration; -//import com.google.common.collect.Maps; -//import com.zdxt.auth.common.utils.StringUtils; -//import com.zdxt.auth.common.xss.XssFilter; -//import org.springframework.web.cors.CorsConfiguration; -//import org.springframework.web.cors.UrlBasedCorsConfigurationSource; -//import org.springframework.web.filter.CorsFilter; -// -///** -// * Filter配置 -// * -// * @author ruoyi -// */ -//@Configuration -//public class FilterConfig -//{ -// @Value("${xss.enabled}") -// private String enabled; -// -// @Value("${xss.excludes}") -// private String excludes; -// -// @Value("${xss.urlPatterns}") -// private String urlPatterns; -// -// //http host头攻击漏洞处理过滤器 -// @Autowired -// HostFilter hostFilter; -// -// @SuppressWarnings({ "rawtypes", "unchecked" }) -// @Bean -// public FilterRegistrationBean xssFilterRegistration() -// { -// FilterRegistrationBean registration = new FilterRegistrationBean(); -// registration.setDispatcherTypes(DispatcherType.REQUEST); -// registration.setFilter(new XssAndSqlFilter()); -// registration.addUrlPatterns(StringUtils.split(urlPatterns, ",")); -// registration.setName("xssFilter"); -// registration.setOrder(Integer.MAX_VALUE); -// Map initParameters = Maps.newHashMap(); -// initParameters.put("excludes", excludes); -// initParameters.put("enabled", enabled); -// registration.setInitParameters(initParameters); -// return registration; -// } -// @Bean -// public FilterRegistrationBean hostfilter() { -// FilterRegistrationBean registration = new FilterRegistrationBean(); -// registration.setFilter(hostFilter); -// registration.addUrlPatterns("/*"); -// registration.setName("hostFilter"); -// registration.setOrder(1); // 值越小，Filter越靠前。 -// return registration; -// } -// @Bean -// public FilterRegistrationBean corsNewFilter() { -// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); -// CorsConfiguration config = new CorsConfiguration(); -// config.setAllowCredentials(true); -// config.addAllowedOrigin("http://10.132.108.3:85"); -// config.addAllowedOrigin("http://10.132.108.3:80"); -// config.addAllowedOrigin("http://10.132.108.3:81"); -// config.addAllowedHeader("*"); -// config.addAllowedMethod("*"); -// source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效 -// FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source)); -// bean.setOrder(0); -// return bean; -// } -// -// -//} +package com.zdxt.auth.framework.config; + +import java.util.Map; +import javax.servlet.DispatcherType; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.boot.web.servlet.FilterRegistrationBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import com.google.common.collect.Maps; +import com.zdxt.auth.common.utils.StringUtils; +import com.zdxt.auth.common.xss.XssFilter; +import org.springframework.web.cors.CorsConfiguration; +import org.springframework.web.cors.UrlBasedCorsConfigurationSource; +import org.springframework.web.filter.CorsFilter; + +/** + * Filter配置 + * + * @author ruoyi + */ +@Configuration +public class FilterConfig +{ + @Value("${xss.enabled}") + private String enabled; + + @Value("${xss.excludes}") + private String excludes; + + @Value("${xss.urlPatterns}") + private String urlPatterns; + + //http host头攻击漏洞处理过滤器 + @Autowired + HostFilter hostFilter; + + @SuppressWarnings({ "rawtypes", "unchecked" }) + @Bean + public FilterRegistrationBean xssFilterRegistration() + { + FilterRegistrationBean registration = new FilterRegistrationBean(); + registration.setDispatcherTypes(DispatcherType.REQUEST); + registration.setFilter(new XssAndSqlFilter()); + registration.addUrlPatterns(StringUtils.split(urlPatterns, ",")); + registration.setName("xssFilter"); + registration.setOrder(Integer.MAX_VALUE); + Map initParameters = Maps.newHashMap(); + initParameters.put("excludes", excludes); + initParameters.put("enabled", enabled); + registration.setInitParameters(initParameters); + return registration; + } + @Bean + public FilterRegistrationBean hostfilter() { + FilterRegistrationBean registration = new FilterRegistrationBean(); + registration.setFilter(hostFilter); + registration.addUrlPatterns("/*"); + registration.setName("hostFilter"); + registration.setOrder(1); // 值越小，Filter越靠前。 + return registration; + } + @Bean + public FilterRegistrationBean corsNewFilter() { + UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); + CorsConfiguration config = new CorsConfiguration(); + config.setAllowCredentials(true); + config.addAllowedOrigin("http://10.132.108.3:85"); + config.addAllowedOrigin("http://10.132.108.3:80"); + config.addAllowedOrigin("http://10.132.108.3:81"); + config.addAllowedHeader("*"); + config.addAllowedMethod("*"); + source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效 + FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source)); + bean.setOrder(0); + return bean; + } + + +} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java index ccf43f24..1302a354 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java @@ -1,37 +1,37 @@ -//package com.zdxt.auth.framework.config; -// -//import org.springframework.boot.web.servlet.FilterRegistrationBean; -//import org.springframework.context.annotation.Bean; -//import org.springframework.context.annotation.Configuration; -//import org.springframework.web.cors.CorsConfiguration; -//import org.springframework.web.cors.UrlBasedCorsConfigurationSource; -// -//import java.util.Arrays; -// +package com.zdxt.auth.framework.config; + +import org.springframework.boot.web.servlet.FilterRegistrationBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.web.cors.CorsConfiguration; +import org.springframework.web.cors.UrlBasedCorsConfigurationSource; + +import java.util.Arrays; + //@Configuration -//public class GlobalCorsConfig { -// @Bean -// public FilterRegistrationBean corsfilter() { -// FilterRegistrationBean corsFilterFilterRegistrationBean = new FilterRegistrationBean<>(); -// //添加CORS配置信息 -// CorsConfiguration corsConfiguration = new CorsConfiguration(); -// //允许的域，不要写*，否则cookie就无法使用了 -// corsConfiguration.addAllowedOrigin("http://10.132.108.3"); -// //允许的头信息 -// corsConfiguration.addAllowedHeader("*"); -// //允许的请求方式 -// corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE")); -// //是否发送cookie信息 -// corsConfiguration.setAllowCredentials(true); -// //预检请求的有效期，单位为秒 -// corsConfiguration.setMaxAge(3600L); -// -// //添加映射路径，标识待拦截的请求 -// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); -// source.registerCorsConfiguration("/**", corsConfiguration); -// -// corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source)); -// corsFilterFilterRegistrationBean.setOrder(-1); -// return corsFilterFilterRegistrationBean; -// } -//} +public class GlobalCorsConfig { + @Bean + public FilterRegistrationBean corsfilter() { + FilterRegistrationBean corsFilterFilterRegistrationBean = new FilterRegistrationBean<>(); + //添加CORS配置信息 + CorsConfiguration corsConfiguration = new CorsConfiguration(); + //允许的域，不要写*，否则cookie就无法使用了 + corsConfiguration.addAllowedOrigin("http://10.132.108.3"); + //允许的头信息 + corsConfiguration.addAllowedHeader("*"); + //允许的请求方式 + corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE")); + //是否发送cookie信息 + corsConfiguration.setAllowCredentials(true); + //预检请求的有效期，单位为秒 + corsConfiguration.setMaxAge(3600L); + + //添加映射路径，标识待拦截的请求 + UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); + source.registerCorsConfiguration("/**", corsConfiguration); + + corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source)); + corsFilterFilterRegistrationBean.setOrder(-1); + return corsFilterFilterRegistrationBean; + } +} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MyDefaultWebSessionManager.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MyDefaultWebSessionManager.java new file mode 100644 index 00000000..8713576c --- /dev/null +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MyDefaultWebSessionManager.java @@ -0,0 +1,55 @@ +package com.zdxt.auth.framework.config; + +import org.apache.shiro.session.Session; +import org.apache.shiro.session.mgt.SessionContext; +import org.apache.shiro.web.servlet.Cookie; +import org.apache.shiro.web.servlet.ShiroHttpServletRequest; +import org.apache.shiro.web.servlet.ShiroHttpSession; +import org.apache.shiro.web.session.mgt.DefaultWebSessionManager; +import org.apache.shiro.web.util.WebUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.Serializable; + +public class MyDefaultWebSessionManager extends DefaultWebSessionManager { + private static final Logger log = LoggerFactory.getLogger(MyDefaultWebSessionManager.class); + + @Override + protected void onStart(Session session, SessionContext context) { + super.onStart(session, context); + if (!WebUtils.isHttp(context)) { + log.debug("SessionContext argument is not HTTP compatible or does not have an HTTP request/response pair. No session ID cookie will be set."); + } else { + HttpServletRequest request = WebUtils.getHttpRequest(context); + HttpServletResponse response = WebUtils.getHttpResponse(context); + if (this.isSessionIdCookieEnabled()) { + Serializable sessionId = session.getId(); + //重写父类方法,使用我们自己定义的cookie + this.storeSessionId(sessionId, request, response); + } else { + log.debug("Session ID cookie is disabled. No cookie has been set for new session with id {}", session.getId()); + } + + request.removeAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE); + request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_IS_NEW, Boolean.TRUE); + } + } + + private void storeSessionId(Serializable currentId, HttpServletRequest request, HttpServletResponse response) { + if (currentId == null) { + String msg = "sessionId cannot be null when persisting for subsequent requests."; + throw new IllegalArgumentException(msg); + } else { +// Cookie cookie = this.getSessionIdCookie(); + Cookie cookie = new MySimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME,"Lax"); + String idString = currentId.toString(); + cookie.setValue(idString); + //这一行决定自定义的cookie中的属性 + cookie.saveTo(request, response); + log.trace("Set session ID cookie for session with id {}", idString); + } + } +} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MySimpleCookie.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MySimpleCookie.java new file mode 100644 index 00000000..0f752de5 --- /dev/null +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MySimpleCookie.java @@ -0,0 +1,84 @@ +package com.zdxt.auth.framework.config; + +import org.apache.shiro.util.StringUtils; +import org.apache.shiro.web.servlet.SimpleCookie; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +public class MySimpleCookie extends SimpleCookie { + private static final transient Logger log = LoggerFactory.getLogger(MySimpleCookie.class); + //自定义的属性sameSite + private String sameSite; + + //重写该方法，添加SameSite属性 + @Override + public void saveTo(HttpServletRequest request, HttpServletResponse response) { + String name = this.getName(); + String value = this.getValue(); + String comment = this.getComment(); + String domain = this.getDomain(); + String path = this.calculatePath(request); + int maxAge = this.getMaxAge(); + int version = this.getVersion(); + boolean secure = this.isSecure(); + boolean httpOnly = this.isHttpOnly(); + String s = this.addCookieHeader(name, value, comment, domain, path, maxAge, + version, secure, httpOnly); + //在原来的基础上添加SameSite属性 + String headerValue = appendtSameSite(s, sameSite); + String s1 = s.replace("lax","Lax;"); + response.addHeader("Set-Cookie", s1); + } + + private String addCookieHeader(String name, + String value, String comment, String domain, + String path, int maxAge, int version, boolean secure, + boolean httpOnly) { + String headerValue = this.buildHeaderValue(name, value, comment, domain, path, maxAge, version, secure, httpOnly); + + if (log.isDebugEnabled()) { + log.debug("Added HttpServletResponse Cookie [{}]", headerValue); + } + return headerValue; + } + + private String calculatePath(HttpServletRequest request) { + String path = StringUtils.clean(this.getPath()); + if (!StringUtils.hasText(path)) { + path = StringUtils.clean(request.getContextPath()); + } + + if (path == null) { + path = "/"; + } + + log.trace("calculated path: {}", path); + return path; + } + + //这里只拼接一个字符串,没用StringBuilder,不考虑效率问题 + private String appendtSameSite(String s, String sameSite) { + if (org.apache.commons.lang3.StringUtils.isNotBlank(sameSite)) { + s += ("; "); + s += ("SameSite=") + sameSite; + } + return s; + } + + public SameSiteOptions getSameSite() { + System.out.println(SameSiteOptions.LAX); + return SameSiteOptions.LAX; + } + + public void setSameSite(String sameSite) { + this.sameSite = sameSite; + } + + public MySimpleCookie(String name, String sameSite) { + super(name); + this.sameSite = sameSite; + } +} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java index edb40adc..7f2182f1 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java @@ -50,9 +50,10 @@ public class ResourcesConfig implements WebMvcConfigurer public void addCorsMappings(CorsRegistry registry){ registry.addMapping("/**") //对哪种格式的路径进行跨域处理 .allowedHeaders("*") //允许的请求头 - .allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法 - .maxAge(1800) //探测请求的有效期 - .allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85","http://192.168.31.71:85"); //支持的域 + .allowedOrigins("*") //支持的域 + .allowedMethods("GET", "POST", "PUT", "DELETE","oprion") //允许的请求方法 + .maxAge(1800); //探测请求的有效期 + } /** @@ -63,10 +64,7 @@ public class ResourcesConfig implements WebMvcConfigurer { // registry.addInterceptor(repeatSubmitInterceptor).addPathPatterns("/**"); registry.addInterceptor(new JWTInterceptor()) - .addPathPatterns("/**") - .excludePathPatterns("/app/thirdLogin/siqLogin", "/appLogin","/login","/index","/**/*.css", - "/**/*.js", "/**/*.png", "/**/*.jpg", - "/**/*.jpeg", "/**/*.gif", "/**/fonts/*", + .excludePathPatterns("/app/thirdLogin/siqLogin", "/appLogin","/login","/index", "/enterpriseInformation", "/code/registration", "/code/linkage", @@ -80,11 +78,14 @@ public class ResourcesConfig implements WebMvcConfigurer "/monitor/operlog", "/monitor/logininfor", "/system/dict", -// "/system/config", + "/system/config", "/monitor/job", "/statistical/analysis", - "/statistical/view" - ); + "/statistical/view", + "/**/*.css", + "/**/*.js", "/**/*.png", "/**/*.jpg", + "/**/*.jpeg", "/**/*.gif", "/**/fonts/*" + ).addPathPatterns("/**"); // 除了登录放行，其他接口都token验证 } } \ No newline at end of file diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java index 17fe8dfc..a7762ad5 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java @@ -180,7 +180,8 @@ public class ShiroConfig { @Bean public SessionManager sessionManager() { - DefaultWebSessionManager manager = new DefaultWebSessionManager(); +// DefaultWebSessionManager manager = new DefaultWebSessionManager(); + MyDefaultWebSessionManager manager = new MyDefaultWebSessionManager(); // 加入缓存管理器 manager.setCacheManager(redisCacheManager()); // 去掉 JSESSIONID diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/SpringSessionConfiguration.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/SpringSessionConfiguration.java new file mode 100644 index 00000000..fe6cf160 --- /dev/null +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/SpringSessionConfiguration.java @@ -0,0 +1,25 @@ +package com.zdxt.auth.framework.config; + +import org.apache.tomcat.util.http.SameSiteCookies; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.session.web.http.CookieSerializer; +import org.springframework.session.web.http.DefaultCookieSerializer; + + +@Configuration +public class SpringSessionConfiguration { + + @Bean + public CookieSerializer cookieSerializer() { + DefaultCookieSerializer serializer = new DefaultCookieSerializer (); + serializer.setCookieName("JSESSIONID"); + serializer.setDomainName("localhost"); + serializer.setCookiePath("/**"); + serializer.setCookieMaxAge(3600); + serializer.setSameSite(SameSiteCookies.LAX.getValue()); // 设置SameSite属性 + serializer.setUseHttpOnlyCookie(true); +// serializer.setUseSecureCookie(true); + return serializer; + } +} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java index 1b539cb5..9b08f2bd 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java @@ -1,58 +1,58 @@ -//package com.zdxt.auth.framework.config; -// -//import org.apache.catalina.Context; -//import org.apache.tomcat.util.descriptor.web.SecurityCollection; -//import org.apache.tomcat.util.descriptor.web.SecurityConstraint; -//import org.apache.tomcat.util.http.Rfc6265CookieProcessor; -//import org.apache.tomcat.util.http.SameSiteCookies; -//import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; -//import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; -//import org.springframework.boot.web.servlet.server.ServletWebServerFactory; -//import org.springframework.context.annotation.Bean; -//import org.springframework.context.annotation.Configuration; -// -//@Configuration -//public class TomcatConfig { -// -// @Bean -// public ServletWebServerFactory servletContainer() { -// -// TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); -// -// tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ -// -// @Override -// public void customize(Context context) { -// SecurityConstraint constraint = new SecurityConstraint(); -// SecurityCollection collection = new SecurityCollection(); -// //http方法 -// collection.addMethod("PUT"); -// collection.addMethod("DELETE"); -// collection.addMethod("HEAD"); -//// collection.addMethod("OPTIONS"); -// collection.addMethod("TRACE"); -// //url匹配表达式 所有路径 -// collection.addPattern("/*"); -// constraint.addCollection(collection); -// //设置以上HTTP方法在指定路径下需要身份验证约束 -// constraint.setAuthConstraint(true); -// context.addConstraint(constraint); -// -// //设置使用httpOnly -// context.setUseHttpOnly(true); -// } -// }); -// return tomcatServletContainerFactory; -// } -// //tomcat配置 -// @Bean -// public TomcatContextCustomizer sameSiteCookiesConfig() { -// return context -> { -// final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); -// // 设置Cookie的SameSite -// cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue()); -// context.setCookieProcessor(cookieProcessor); -// }; -// } -//} -// +package com.zdxt.auth.framework.config; + +import org.apache.catalina.Context; +import org.apache.tomcat.util.descriptor.web.SecurityCollection; +import org.apache.tomcat.util.descriptor.web.SecurityConstraint; +import org.apache.tomcat.util.http.Rfc6265CookieProcessor; +import org.apache.tomcat.util.http.SameSiteCookies; +import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; +import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; +import org.springframework.boot.web.servlet.server.ServletWebServerFactory; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration +public class TomcatConfig { + + @Bean + public ServletWebServerFactory servletContainer() { + + TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); + + tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ + + @Override + public void customize(Context context) { + SecurityConstraint constraint = new SecurityConstraint(); + SecurityCollection collection = new SecurityCollection(); + //http方法 + collection.addMethod("PUT"); + collection.addMethod("DELETE"); + collection.addMethod("HEAD"); +// collection.addMethod("OPTIONS"); + collection.addMethod("TRACE"); + //url匹配表达式 所有路径 + collection.addPattern("/*"); + constraint.addCollection(collection); + //设置以上HTTP方法在指定路径下需要身份验证约束 + constraint.setAuthConstraint(true); + context.addConstraint(constraint); + + //设置使用httpOnly + context.setUseHttpOnly(true); + } + }); + return tomcatServletContainerFactory; + } + //tomcat配置 + @Bean + public TomcatContextCustomizer sameSiteCookiesConfig() { + return context -> { + final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); + // 设置Cookie的SameSite + cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue()); + context.setCookieProcessor(cookieProcessor); + }; + } +} + diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java index 5fb413b4..75dd74a2 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java @@ -164,8 +164,7 @@ public class LoginController extends BaseController //return null; } else { //PC subject.login(token); - - return success("登录成功"); + return success(); } } catch (AuthenticationException e) { String msg = "用户或密码错误"; @@ -178,20 +177,20 @@ public class LoginController extends BaseController @PostMapping("/appLogin") @ResponseBody - public AjaxResult appLogin(String username, String secretKey, Boolean rememberMe, String type, String clientid) { + public AjaxResult appLogin(String secretName, String secretKey) { SecurityUtils.getSubject().logout(); // username = username.toUpperCase(); //解密 secretKey = AesHelper.desEncrypt(secretKey); // UsernamePasswordToken token = new UsernamePasswordToken(username, password, false); - UserToken token = new UserToken(username, secretKey, LoginType.PASSWORD); + UserToken token = new UserToken(secretName, secretKey, LoginType.PASSWORD); Subject subject = SecurityUtils.getSubject(); try { //PC subject.login(token); // 把 tonken 塞进去 - User userDB = iUserService.selectUserByLoginName(username); + User userDB = iUserService.selectUserByLoginName(secretName); Map payload = new HashMap<>(); payload.put("id", userDB.getUserId()); payload.put("name", userDB.getLoginName()); diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/domain/LoginDTO.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/domain/LoginDTO.java new file mode 100644 index 00000000..dc2efa91 --- /dev/null +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/domain/LoginDTO.java @@ -0,0 +1,22 @@ +package com.zdxt.auth.project.system.user.domain; + +public class LoginDTO { + String secretName; + String secretKey; + + public String getSecretName() { + return secretName; + } + + public void setSecretName(String secretName) { + this.secretName = secretName; + } + + public String getSecretKey() { + return secretKey; + } + + public void setSecretKey(String secretKey) { + this.secretKey = secretKey; + } +} diff --git a/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html b/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html index 2bc92775..845ed974 100644 --- a/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html +++ b/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html @@ -382,6 +382,7 @@ var excludesUrl = ["/system/user/profile"]; var token = [[${token}]]; console.log(token); + console.log(document.cookie); // 本地主题优先，未设置取系统配置 if ($.common.isNotEmpty(skin)) {