From 5479fb72b84a41e586e8ca9fba71981227c48f81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=BA=84=E9=94=90=E6=B3=A2?= <10549902+zhuangruibo@user.noreply.gitee.com> Date: Tue, 23 Jun 2026 20:22:09 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=89=E5=85=A8=E6=89=AB=E6=8F=8F=E5=A4=84?= =?UTF-8?q?=E7=90=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- doc/部署说明/安全扫描.md | 20 +++++++++++ .../src/main/resources/common-satoken.yml | 4 +-- .../controller/app/LoginController.java | 4 +-- .../zdxt-admin-plus-ui/.env.development | 2 +- .../.env.development-zrb-cust | 2 +- .../zdxt-admin-plus-ui/.env.production | 2 +- .../web/listener/UserActionListener.java | 35 ++++++++++++++----- 7 files changed, 53 insertions(+), 16 deletions(-) create mode 100644 doc/部署说明/安全扫描.md diff --git a/doc/部署说明/安全扫描.md b/doc/部署说明/安全扫描.md new file mode 100644 index 00000000..c68ca204 --- /dev/null +++ b/doc/部署说明/安全扫描.md @@ -0,0 +1,20 @@ +执法/企业端: +1: 支持较老的 TLS 版本- 中 (已改) +2: 未实施加密- 中 (一期的https问题. 不好改变当前生产环境) +3: 检测到 SHA-1 密码套件- 中 (已改) + +监督端: +1: JWT中的弱签名(3个) - 高 (已改) +2: JWT过期(3个) - 高 (已改) +3: 易受攻击的组件(2个) - 高 +4: 查询中的密码参数 - 高 +5: SRI (Subresource Integrity) 的检查 - 中 + +主机: +.25: waf 我们动不了 +- SSLV2和SSLV3 协议检测【原理扫描】 - 高 +- 目标使用过期的TLS1.0 版协议【原理扫描】 - 中 +.19: 目标主机showmount -e信息泄露(CVE-1999-0554) - 高 (同步服务器) +.3: 目标使用过期的TLS1.0 版协议【原理扫描】 - 中 (已改) +.6: SSH 服务支持弱加密算法【原理扫描】 - 中 (已改) +.5: SSH 服务支持弱加密算法【原理扫描】 - 中 (已改) \ No newline at end of file diff --git a/zdxt-common/zdxt-common-satoken/src/main/resources/common-satoken.yml b/zdxt-common/zdxt-common-satoken/src/main/resources/common-satoken.yml index 86589582..70a327a5 100644 --- a/zdxt-common/zdxt-common-satoken/src/main/resources/common-satoken.yml +++ b/zdxt-common/zdxt-common-satoken/src/main/resources/common-satoken.yml @@ -1,8 +1,8 @@ # 内置配置 不允许修改 如需修改请在 nacos 上写相同配置覆盖 # Sa-Token配置 sa-token: - # token有效期（单位：秒） 默认7天 - timeout: 604800 + # token有效期（单位：秒） 默认1天 + timeout: 86400 # token最低活跃频率（单位：秒） 默认30分钟无操作则过期 active-timeout: 1800 # 允许动态设置 token 有效期 diff --git a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/LoginController.java b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/LoginController.java index 7b5827f7..5041b5a5 100644 --- a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/LoginController.java +++ b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/LoginController.java @@ -30,9 +30,9 @@ public abstract class LoginController { /** - * App端token固定超时时间（单位：秒） 7天 + * App端token固定超时时间（单位：秒） 1天 */ - protected static final long APP_TOKEN_TIMEOUT = 604800; + protected static final long APP_TOKEN_TIMEOUT = 86400; /** * App端token活跃超时时间（单位：秒） 30分钟 diff --git a/zdxt-web-client/zdxt-admin-plus-ui/.env.development b/zdxt-web-client/zdxt-admin-plus-ui/.env.development index f1ad37f8..4778c907 100644 --- a/zdxt-web-client/zdxt-admin-plus-ui/.env.development +++ b/zdxt-web-client/zdxt-admin-plus-ui/.env.development @@ -36,4 +36,4 @@ VITE_APP_CLIENT_ID = 'e5cd7e4891bf95d1d19206ce24a7b32e' VITE_APP_WEBSOCKET = false # sse 开关 -VITE_APP_SSE = true +VITE_APP_SSE = false diff --git a/zdxt-web-client/zdxt-admin-plus-ui/.env.development-zrb-cust b/zdxt-web-client/zdxt-admin-plus-ui/.env.development-zrb-cust index c1aada7a..906411e7 100644 --- a/zdxt-web-client/zdxt-admin-plus-ui/.env.development-zrb-cust +++ b/zdxt-web-client/zdxt-admin-plus-ui/.env.development-zrb-cust @@ -34,4 +34,4 @@ VITE_APP_CLIENT_ID = 'e5cd7e4891bf95d1d19206ce24a7b32e' VITE_APP_WEBSOCKET = false # sse 开关 -VITE_APP_SSE = true +VITE_APP_SSE = false diff --git a/zdxt-web-client/zdxt-admin-plus-ui/.env.production b/zdxt-web-client/zdxt-admin-plus-ui/.env.production index 2ebaaf20..67776ff3 100644 --- a/zdxt-web-client/zdxt-admin-plus-ui/.env.production +++ b/zdxt-web-client/zdxt-admin-plus-ui/.env.production @@ -36,4 +36,4 @@ VITE_APP_CLIENT_ID = 'e5cd7e4891bf95d1d19206ce24a7b32e' VITE_APP_WEBSOCKET = false # sse 开关 -VITE_APP_SSE = true +VITE_APP_SSE = false diff --git a/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/listener/UserActionListener.java b/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/listener/UserActionListener.java index 6c8accb6..3cc1b9ae 100644 --- a/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/listener/UserActionListener.java +++ b/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/listener/UserActionListener.java @@ -6,6 +6,7 @@ import cn.dev33.satoken.stp.parameter.SaLoginParameter; import cn.hutool.core.convert.Convert; import cn.hutool.http.useragent.UserAgent; import cn.hutool.http.useragent.UserAgentUtil; +import cn.dev33.satoken.jwt.exception.SaJwtException; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.dromara.common.core.constant.CacheConstants; @@ -81,10 +82,16 @@ public class UserActionListener implements SaTokenListener { */ @Override public void doLogout(String loginType, Object loginId, String tokenValue) { - String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY)); - TenantHelper.dynamic(tenantId, () -> { + try { + String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY)); + TenantHelper.dynamic(tenantId, () -> { + RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue); + }); + } catch (SaJwtException e) { + // token已过期时直接删除缓存（不依赖租户隔离） + log.warn("doLogout时JWT已过期, 直接清理在线缓存, userId:{}", loginId); RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue); - }); + } log.info("user doLogout, userId:{}, token:{}", loginId, tokenValue); } @@ -93,10 +100,15 @@ public class UserActionListener implements SaTokenListener { */ @Override public void doKickout(String loginType, Object loginId, String tokenValue) { - String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY)); - TenantHelper.dynamic(tenantId, () -> { + try { + String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY)); + TenantHelper.dynamic(tenantId, () -> { + RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue); + }); + } catch (SaJwtException e) { + log.warn("doKickout时JWT已过期, 直接清理在线缓存, userId:{}", loginId); RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue); - }); + } log.info("user doKickout, userId:{}, token:{}", loginId, tokenValue); } @@ -105,10 +117,15 @@ public class UserActionListener implements SaTokenListener { */ @Override public void doReplaced(String loginType, Object loginId, String tokenValue) { - String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY)); - TenantHelper.dynamic(tenantId, () -> { + try { + String tenantId = Convert.toStr(StpUtil.getExtra(tokenValue, LoginHelper.TENANT_KEY)); + TenantHelper.dynamic(tenantId, () -> { + RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue); + }); + } catch (SaJwtException e) { + log.warn("doReplaced时JWT已过期, 直接清理在线缓存, userId:{}", loginId); RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue); - }); + } log.info("user doReplaced, userId:{}, token:{}", loginId, tokenValue); }