Browse Source

提交漏洞修复代码

v2
chenrui 3 years ago
parent
commit
e34a0acc8f
  1. 14
      lib/EmergencyService/pom.xml
  2. 13
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java
  3. 5
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java
  4. 162
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java
  5. 72
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java
  6. 55
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MyDefaultWebSessionManager.java
  7. 84
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MySimpleCookie.java
  8. 21
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java
  9. 3
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java
  10. 25
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/SpringSessionConfiguration.java
  11. 116
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java
  12. 9
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java
  13. 22
      lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/domain/LoginDTO.java
  14. 1
      lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html

14
lib/EmergencyService/pom.xml

@ -92,7 +92,19 @@
<artifactId>spring-boot-devtools</artifactId> <artifactId>spring-boot-devtools</artifactId>
<optional>true</optional> <!-- 表示依赖不会传递 --> <optional>true</optional> <!-- 表示依赖不会传递 -->
</dependency> </dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-core</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session</artifactId>
<version>1.3.1.RELEASE</version>
</dependency>
<!-- Mysql驱动包 --> <!-- Mysql驱动包 -->
<dependency> <dependency>
<groupId>mysql</groupId> <groupId>mysql</groupId>

13
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java

@ -1,5 +1,6 @@
package com.zdxt.auth.framework.config; package com.zdxt.auth.framework.config;
import org.apache.tomcat.util.http.SameSiteCookies;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseCookie; import org.springframework.http.ResponseCookie;
import org.springframework.stereotype.Component; import org.springframework.stereotype.Component;
@ -10,7 +11,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
import java.io.IOException; import java.io.IOException;
//@Component @Component
public class CookieFilter implements Filter { public class CookieFilter implements Filter {
@ -21,6 +22,7 @@ public class CookieFilter implements Filter {
String url = httpRequest.getRequestURL().toString(); String url = httpRequest.getRequestURL().toString();
Cookie[] cookies = httpRequest.getCookies(); Cookie[] cookies = httpRequest.getCookies();
if (cookies != null){ if (cookies != null){
StringBuilder sb = new StringBuilder(); StringBuilder sb = new StringBuilder();
@ -28,10 +30,13 @@ public class CookieFilter implements Filter {
String cookieName = cookie.getName(); String cookieName = cookie.getName();
String cookieValue = cookie.getValue(); String cookieValue = cookie.getValue();
System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue); System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue);
ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Strict").build(); // ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Lax").build();
httpResponse.addHeader(HttpHeaders.SET_COOKIE,lastCookie.toString());
httpResponse.addHeader(HttpHeaders.COOKIE,lastCookie.toString()); sb.append(cookieName).append("=").append(cookieValue).append(";");
} }
sb.append("HttpOnly; SameSite=Lax");
httpResponse.addHeader(HttpHeaders.SET_COOKIE,sb.toString());
httpResponse.addHeader(HttpHeaders.COOKIE,sb.toString());
} }
filterChain.doFilter(httpRequest,httpResponse); filterChain.doFilter(httpRequest,httpResponse);

5
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java

@ -25,8 +25,7 @@ public class CorsFilter implements Filter {
throws IOException, ServletException { throws IOException, ServletException {
HttpServletResponse res = (HttpServletResponse) response; HttpServletResponse res = (HttpServletResponse) response;
res.addHeader("Access-Control-Allow-Credentials", "true"); res.addHeader("Access-Control-Allow-Credentials", "true");
res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin")); res.addHeader("Access-Control-Allow-Origin", "*");
// res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3");
res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token"); res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token");
res.addHeader("X-Frame-Options", "SAMEORIGIN"); res.addHeader("X-Frame-Options", "SAMEORIGIN");
@ -42,7 +41,7 @@ public class CorsFilter implements Filter {
// response.getWriter().println("ok"); // response.getWriter().println("ok");
// return; // return;
// } // }
// 判断请求方法是否为OPTIONS // TODO 暂时允许options 判断请求方法是否为OPTIONS
// if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) { // if (((HttpServletRequest) request).getMethod().equals("OPTIONS")) {
// // 设置响应头信息,禁止OPTIONS请求 // // 设置响应头信息,禁止OPTIONS请求
// res.setHeader("Allow", "GET, POST, HEAD, PUT, DELETE"); // res.setHeader("Allow", "GET, POST, HEAD, PUT, DELETE");

162
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/FilterConfig.java

@ -1,81 +1,81 @@
//package com.zdxt.auth.framework.config; package com.zdxt.auth.framework.config;
//
//import java.util.Map; import java.util.Map;
//import javax.servlet.DispatcherType; import javax.servlet.DispatcherType;
//
//import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
//import org.springframework.beans.factory.annotation.Value; import org.springframework.beans.factory.annotation.Value;
//import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.boot.web.servlet.FilterRegistrationBean;
//import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
//import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
//import com.google.common.collect.Maps; import com.google.common.collect.Maps;
//import com.zdxt.auth.common.utils.StringUtils; import com.zdxt.auth.common.utils.StringUtils;
//import com.zdxt.auth.common.xss.XssFilter; import com.zdxt.auth.common.xss.XssFilter;
//import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfiguration;
//import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
//import org.springframework.web.filter.CorsFilter; import org.springframework.web.filter.CorsFilter;
//
///** /**
// * Filter配置 * Filter配置
// * *
// * @author ruoyi * @author ruoyi
// */ */
//@Configuration @Configuration
//public class FilterConfig public class FilterConfig
//{ {
// @Value("${xss.enabled}") @Value("${xss.enabled}")
// private String enabled; private String enabled;
//
// @Value("${xss.excludes}") @Value("${xss.excludes}")
// private String excludes; private String excludes;
//
// @Value("${xss.urlPatterns}") @Value("${xss.urlPatterns}")
// private String urlPatterns; private String urlPatterns;
//
// //http host头攻击漏洞处理过滤器 //http host头攻击漏洞处理过滤器
// @Autowired @Autowired
// HostFilter hostFilter; HostFilter hostFilter;
//
// @SuppressWarnings({ "rawtypes", "unchecked" }) @SuppressWarnings({ "rawtypes", "unchecked" })
// @Bean @Bean
// public FilterRegistrationBean xssFilterRegistration() public FilterRegistrationBean xssFilterRegistration()
// { {
// FilterRegistrationBean registration = new FilterRegistrationBean(); FilterRegistrationBean registration = new FilterRegistrationBean();
// registration.setDispatcherTypes(DispatcherType.REQUEST); registration.setDispatcherTypes(DispatcherType.REQUEST);
// registration.setFilter(new XssAndSqlFilter()); registration.setFilter(new XssAndSqlFilter());
// registration.addUrlPatterns(StringUtils.split(urlPatterns, ",")); registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
// registration.setName("xssFilter"); registration.setName("xssFilter");
// registration.setOrder(Integer.MAX_VALUE); registration.setOrder(Integer.MAX_VALUE);
// Map<String, String> initParameters = Maps.newHashMap(); Map<String, String> initParameters = Maps.newHashMap();
// initParameters.put("excludes", excludes); initParameters.put("excludes", excludes);
// initParameters.put("enabled", enabled); initParameters.put("enabled", enabled);
// registration.setInitParameters(initParameters); registration.setInitParameters(initParameters);
// return registration; return registration;
// } }
// @Bean @Bean
// public FilterRegistrationBean hostfilter() { public FilterRegistrationBean hostfilter() {
// FilterRegistrationBean registration = new FilterRegistrationBean(); FilterRegistrationBean registration = new FilterRegistrationBean();
// registration.setFilter(hostFilter); registration.setFilter(hostFilter);
// registration.addUrlPatterns("/*"); registration.addUrlPatterns("/*");
// registration.setName("hostFilter"); registration.setName("hostFilter");
// registration.setOrder(1); // 值越小,Filter越靠前。 registration.setOrder(1); // 值越小,Filter越靠前。
// return registration; return registration;
// } }
// @Bean @Bean
// public FilterRegistrationBean corsNewFilter() { public FilterRegistrationBean corsNewFilter() {
// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
// CorsConfiguration config = new CorsConfiguration(); CorsConfiguration config = new CorsConfiguration();
// config.setAllowCredentials(true); config.setAllowCredentials(true);
// config.addAllowedOrigin("http://10.132.108.3:85"); config.addAllowedOrigin("http://10.132.108.3:85");
// config.addAllowedOrigin("http://10.132.108.3:80"); config.addAllowedOrigin("http://10.132.108.3:80");
// config.addAllowedOrigin("http://10.132.108.3:81"); config.addAllowedOrigin("http://10.132.108.3:81");
// config.addAllowedHeader("*"); config.addAllowedHeader("*");
// config.addAllowedMethod("*"); config.addAllowedMethod("*");
// source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效 source.registerCorsConfiguration("/**", config); // CORS 配置对所有接口都有效
// FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source)); FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
// bean.setOrder(0); bean.setOrder(0);
// return bean; return bean;
// } }
//
//
//} }

72
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java

@ -1,37 +1,37 @@
//package com.zdxt.auth.framework.config; package com.zdxt.auth.framework.config;
//
//import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.boot.web.servlet.FilterRegistrationBean;
//import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
//import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
//import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfiguration;
//import org.springframework.web.cors.UrlBasedCorsConfigurationSource; import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
//
//import java.util.Arrays; import java.util.Arrays;
//
//@Configuration //@Configuration
//public class GlobalCorsConfig { public class GlobalCorsConfig {
// @Bean @Bean
// public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() { public FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsfilter() {
// FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>(); FilterRegistrationBean<org.springframework.web.filter.CorsFilter> corsFilterFilterRegistrationBean = new FilterRegistrationBean<>();
// //添加CORS配置信息 //添加CORS配置信息
// CorsConfiguration corsConfiguration = new CorsConfiguration(); CorsConfiguration corsConfiguration = new CorsConfiguration();
// //允许的域,不要写*,否则cookie就无法使用了 //允许的域,不要写*,否则cookie就无法使用了
// corsConfiguration.addAllowedOrigin("http://10.132.108.3"); corsConfiguration.addAllowedOrigin("http://10.132.108.3");
// //允许的头信息 //允许的头信息
// corsConfiguration.addAllowedHeader("*"); corsConfiguration.addAllowedHeader("*");
// //允许的请求方式 //允许的请求方式
// corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE")); corsConfiguration.setAllowedMethods(Arrays.asList("POST", "PUT", "GET", "DELETE"));
// //是否发送cookie信息 //是否发送cookie信息
// corsConfiguration.setAllowCredentials(true); corsConfiguration.setAllowCredentials(true);
// //预检请求的有效期,单位为秒 //预检请求的有效期,单位为秒
// corsConfiguration.setMaxAge(3600L); corsConfiguration.setMaxAge(3600L);
//
// //添加映射路径,标识待拦截的请求 //添加映射路径,标识待拦截的请求
// UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
// source.registerCorsConfiguration("/**", corsConfiguration); source.registerCorsConfiguration("/**", corsConfiguration);
//
// corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source)); corsFilterFilterRegistrationBean.setFilter(new org.springframework.web.filter.CorsFilter(source));
// corsFilterFilterRegistrationBean.setOrder(-1); corsFilterFilterRegistrationBean.setOrder(-1);
// return corsFilterFilterRegistrationBean; return corsFilterFilterRegistrationBean;
// } }
//} }

55
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MyDefaultWebSessionManager.java

@ -0,0 +1,55 @@
package com.zdxt.auth.framework.config;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.SessionContext;
import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
import org.apache.shiro.web.servlet.ShiroHttpSession;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.util.WebUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.Serializable;
public class MyDefaultWebSessionManager extends DefaultWebSessionManager {
private static final Logger log = LoggerFactory.getLogger(MyDefaultWebSessionManager.class);
@Override
protected void onStart(Session session, SessionContext context) {
super.onStart(session, context);
if (!WebUtils.isHttp(context)) {
log.debug("SessionContext argument is not HTTP compatible or does not have an HTTP request/response pair. No session ID cookie will be set.");
} else {
HttpServletRequest request = WebUtils.getHttpRequest(context);
HttpServletResponse response = WebUtils.getHttpResponse(context);
if (this.isSessionIdCookieEnabled()) {
Serializable sessionId = session.getId();
//重写父类方法,使用我们自己定义的cookie
this.storeSessionId(sessionId, request, response);
} else {
log.debug("Session ID cookie is disabled. No cookie has been set for new session with id {}", session.getId());
}
request.removeAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE);
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
}
}
private void storeSessionId(Serializable currentId, HttpServletRequest request, HttpServletResponse response) {
if (currentId == null) {
String msg = "sessionId cannot be null when persisting for subsequent requests.";
throw new IllegalArgumentException(msg);
} else {
// Cookie cookie = this.getSessionIdCookie();
Cookie cookie = new MySimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME,"Lax");
String idString = currentId.toString();
cookie.setValue(idString);
//这一行决定自定义的cookie中的属性
cookie.saveTo(request, response);
log.trace("Set session ID cookie for session with id {}", idString);
}
}
}

84
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/MySimpleCookie.java

@ -0,0 +1,84 @@
package com.zdxt.auth.framework.config;
import org.apache.shiro.util.StringUtils;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class MySimpleCookie extends SimpleCookie {
private static final transient Logger log = LoggerFactory.getLogger(MySimpleCookie.class);
//自定义的属性sameSite
private String sameSite;
//重写该方法,添加SameSite属性
@Override
public void saveTo(HttpServletRequest request, HttpServletResponse response) {
String name = this.getName();
String value = this.getValue();
String comment = this.getComment();
String domain = this.getDomain();
String path = this.calculatePath(request);
int maxAge = this.getMaxAge();
int version = this.getVersion();
boolean secure = this.isSecure();
boolean httpOnly = this.isHttpOnly();
String s = this.addCookieHeader(name, value, comment, domain, path, maxAge,
version, secure, httpOnly);
//在原来的基础上添加SameSite属性
String headerValue = appendtSameSite(s, sameSite);
String s1 = s.replace("lax","Lax;");
response.addHeader("Set-Cookie", s1);
}
private String addCookieHeader(String name,
String value, String comment, String domain,
String path, int maxAge, int version, boolean secure,
boolean httpOnly) {
String headerValue = this.buildHeaderValue(name, value, comment, domain, path, maxAge, version, secure, httpOnly);
if (log.isDebugEnabled()) {
log.debug("Added HttpServletResponse Cookie [{}]", headerValue);
}
return headerValue;
}
private String calculatePath(HttpServletRequest request) {
String path = StringUtils.clean(this.getPath());
if (!StringUtils.hasText(path)) {
path = StringUtils.clean(request.getContextPath());
}
if (path == null) {
path = "/";
}
log.trace("calculated path: {}", path);
return path;
}
//这里只拼接一个字符串,没用StringBuilder,不考虑效率问题
private String appendtSameSite(String s, String sameSite) {
if (org.apache.commons.lang3.StringUtils.isNotBlank(sameSite)) {
s += ("; ");
s += ("SameSite=") + sameSite;
}
return s;
}
public SameSiteOptions getSameSite() {
System.out.println(SameSiteOptions.LAX);
return SameSiteOptions.LAX;
}
public void setSameSite(String sameSite) {
this.sameSite = sameSite;
}
public MySimpleCookie(String name, String sameSite) {
super(name);
this.sameSite = sameSite;
}
}

21
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java

@ -50,9 +50,10 @@ public class ResourcesConfig implements WebMvcConfigurer
public void addCorsMappings(CorsRegistry registry){ public void addCorsMappings(CorsRegistry registry){
registry.addMapping("/**") //对哪种格式的路径进行跨域处理 registry.addMapping("/**") //对哪种格式的路径进行跨域处理
.allowedHeaders("*") //允许的请求头 .allowedHeaders("*") //允许的请求头
.allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法 .allowedOrigins("*") //支持的域
.maxAge(1800) //探测请求的有效期 .allowedMethods("GET", "POST", "PUT", "DELETE","oprion") //允许的请求方法
.allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85","http://192.168.31.71:85"); //支持的域 .maxAge(1800); //探测请求的有效期
} }
/** /**
@ -63,10 +64,7 @@ public class ResourcesConfig implements WebMvcConfigurer
{ {
// registry.addInterceptor(repeatSubmitInterceptor).addPathPatterns("/**"); // registry.addInterceptor(repeatSubmitInterceptor).addPathPatterns("/**");
registry.addInterceptor(new JWTInterceptor()) registry.addInterceptor(new JWTInterceptor())
.addPathPatterns("/**") .excludePathPatterns("/app/thirdLogin/siqLogin", "/appLogin","/login","/index",
.excludePathPatterns("/app/thirdLogin/siqLogin", "/appLogin","/login","/index","/**/*.css",
"/**/*.js", "/**/*.png", "/**/*.jpg",
"/**/*.jpeg", "/**/*.gif", "/**/fonts/*",
"/enterpriseInformation", "/enterpriseInformation",
"/code/registration", "/code/registration",
"/code/linkage", "/code/linkage",
@ -80,11 +78,14 @@ public class ResourcesConfig implements WebMvcConfigurer
"/monitor/operlog", "/monitor/operlog",
"/monitor/logininfor", "/monitor/logininfor",
"/system/dict", "/system/dict",
// "/system/config", "/system/config",
"/monitor/job", "/monitor/job",
"/statistical/analysis", "/statistical/analysis",
"/statistical/view" "/statistical/view",
); "/**/*.css",
"/**/*.js", "/**/*.png", "/**/*.jpg",
"/**/*.jpeg", "/**/*.gif", "/**/fonts/*"
).addPathPatterns("/**");
// 除了登录放行,其他接口都token验证 // 除了登录放行,其他接口都token验证
} }
} }

3
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ShiroConfig.java

@ -180,7 +180,8 @@ public class ShiroConfig {
@Bean @Bean
public SessionManager sessionManager() public SessionManager sessionManager()
{ {
DefaultWebSessionManager manager = new DefaultWebSessionManager(); // DefaultWebSessionManager manager = new DefaultWebSessionManager();
MyDefaultWebSessionManager manager = new MyDefaultWebSessionManager();
// 加入缓存管理器 // 加入缓存管理器
manager.setCacheManager(redisCacheManager()); manager.setCacheManager(redisCacheManager());
// 去掉 JSESSIONID // 去掉 JSESSIONID

25
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/SpringSessionConfiguration.java

@ -0,0 +1,25 @@
package com.zdxt.auth.framework.config;
import org.apache.tomcat.util.http.SameSiteCookies;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;
@Configuration
public class SpringSessionConfiguration {
@Bean
public CookieSerializer cookieSerializer() {
DefaultCookieSerializer serializer = new DefaultCookieSerializer ();
serializer.setCookieName("JSESSIONID");
serializer.setDomainName("localhost");
serializer.setCookiePath("/**");
serializer.setCookieMaxAge(3600);
serializer.setSameSite(SameSiteCookies.LAX.getValue()); // 设置SameSite属性
serializer.setUseHttpOnlyCookie(true);
// serializer.setUseSecureCookie(true);
return serializer;
}
}

116
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java

@ -1,58 +1,58 @@
//package com.zdxt.auth.framework.config; package com.zdxt.auth.framework.config;
//
//import org.apache.catalina.Context; import org.apache.catalina.Context;
//import org.apache.tomcat.util.descriptor.web.SecurityCollection; import org.apache.tomcat.util.descriptor.web.SecurityCollection;
//import org.apache.tomcat.util.descriptor.web.SecurityConstraint; import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
//import org.apache.tomcat.util.http.Rfc6265CookieProcessor; import org.apache.tomcat.util.http.Rfc6265CookieProcessor;
//import org.apache.tomcat.util.http.SameSiteCookies; import org.apache.tomcat.util.http.SameSiteCookies;
//import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer; import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
//import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
//import org.springframework.boot.web.servlet.server.ServletWebServerFactory; import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
//import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
//import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Configuration;
//
//@Configuration @Configuration
//public class TomcatConfig { public class TomcatConfig {
//
// @Bean @Bean
// public ServletWebServerFactory servletContainer() { public ServletWebServerFactory servletContainer() {
//
// TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory(); TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory();
//
// tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){ tomcatServletContainerFactory.addContextCustomizers(new TomcatContextCustomizer(){
//
// @Override @Override
// public void customize(Context context) { public void customize(Context context) {
// SecurityConstraint constraint = new SecurityConstraint(); SecurityConstraint constraint = new SecurityConstraint();
// SecurityCollection collection = new SecurityCollection(); SecurityCollection collection = new SecurityCollection();
// //http方法 //http方法
// collection.addMethod("PUT"); collection.addMethod("PUT");
// collection.addMethod("DELETE"); collection.addMethod("DELETE");
// collection.addMethod("HEAD"); collection.addMethod("HEAD");
//// collection.addMethod("OPTIONS"); // collection.addMethod("OPTIONS");
// collection.addMethod("TRACE"); collection.addMethod("TRACE");
// //url匹配表达式 所有路径 //url匹配表达式 所有路径
// collection.addPattern("/*"); collection.addPattern("/*");
// constraint.addCollection(collection); constraint.addCollection(collection);
// //设置以上HTTP方法在指定路径下需要身份验证约束 //设置以上HTTP方法在指定路径下需要身份验证约束
// constraint.setAuthConstraint(true); constraint.setAuthConstraint(true);
// context.addConstraint(constraint); context.addConstraint(constraint);
//
// //设置使用httpOnly //设置使用httpOnly
// context.setUseHttpOnly(true); context.setUseHttpOnly(true);
// } }
// }); });
// return tomcatServletContainerFactory; return tomcatServletContainerFactory;
// } }
// //tomcat配置 //tomcat配置
// @Bean @Bean
// public TomcatContextCustomizer sameSiteCookiesConfig() { public TomcatContextCustomizer sameSiteCookiesConfig() {
// return context -> { return context -> {
// final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
// // 设置Cookie的SameSite // 设置Cookie的SameSite
// cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue()); cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue());
// context.setCookieProcessor(cookieProcessor); context.setCookieProcessor(cookieProcessor);
// }; };
// } }
//} }
//

9
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java

@ -164,8 +164,7 @@ public class LoginController extends BaseController
//return null; //return null;
} else { //PC } else { //PC
subject.login(token); subject.login(token);
return success();
return success("登录成功");
} }
} catch (AuthenticationException e) { } catch (AuthenticationException e) {
String msg = "用户或密码错误"; String msg = "用户或密码错误";
@ -178,20 +177,20 @@ public class LoginController extends BaseController
@PostMapping("/appLogin") @PostMapping("/appLogin")
@ResponseBody @ResponseBody
public AjaxResult appLogin(String username, String secretKey, Boolean rememberMe, String type, String clientid) { public AjaxResult appLogin(String secretName, String secretKey) {
SecurityUtils.getSubject().logout(); SecurityUtils.getSubject().logout();
// username = username.toUpperCase(); // username = username.toUpperCase();
//解密 //解密
secretKey = AesHelper.desEncrypt(secretKey); secretKey = AesHelper.desEncrypt(secretKey);
// UsernamePasswordToken token = new UsernamePasswordToken(username, password, false); // UsernamePasswordToken token = new UsernamePasswordToken(username, password, false);
UserToken token = new UserToken(username, secretKey, LoginType.PASSWORD); UserToken token = new UserToken(secretName, secretKey, LoginType.PASSWORD);
Subject subject = SecurityUtils.getSubject(); Subject subject = SecurityUtils.getSubject();
try { try {
//PC //PC
subject.login(token); subject.login(token);
// 把 tonken 塞进去 // 把 tonken 塞进去
User userDB = iUserService.selectUserByLoginName(username); User userDB = iUserService.selectUserByLoginName(secretName);
Map<String,Object> payload = new HashMap<>(); Map<String,Object> payload = new HashMap<>();
payload.put("id", userDB.getUserId()); payload.put("id", userDB.getUserId());
payload.put("name", userDB.getLoginName()); payload.put("name", userDB.getLoginName());

22
lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/domain/LoginDTO.java

@ -0,0 +1,22 @@
package com.zdxt.auth.project.system.user.domain;
public class LoginDTO {
String secretName;
String secretKey;
public String getSecretName() {
return secretName;
}
public void setSecretName(String secretName) {
this.secretName = secretName;
}
public String getSecretKey() {
return secretKey;
}
public void setSecretKey(String secretKey) {
this.secretKey = secretKey;
}
}

1
lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/index.html

@ -382,6 +382,7 @@
var excludesUrl = ["/system/user/profile"]; var excludesUrl = ["/system/user/profile"];
var token = [[${token}]]; var token = [[${token}]];
console.log(token); console.log(token);
console.log(document.cookie);
// 本地主题优先,未设置取系统配置 // 本地主题优先,未设置取系统配置
if ($.common.isNotEmpty(skin)) { if ($.common.isNotEmpty(skin)) {

Loading…
Cancel
Save