lsm/sa-token
1
0
Fork 0
mirror of https://gitee.com/dromara/sa-token.git synced 2025-10-15 18:54:54 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

匿名 client 将不再能解析出所有应用的 client

Browse Source
This commit is contained in:
click33
2024-05-02 10:36:54 +08:00
parent 7ee27add84
commit 4c216069aa
4 changed files with 40 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/error/SaSsoErrorCode.java
View File

@@ -59,4 +59,7 @@ public interface SaSsoErrorCode {
/** 当前缺少配置 server-url 地址 */
int CODE_30012 = 30012;
/** 提供的 client 参数值无效 */
int CODE_30013 = 30013;
}

25
sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/processor/SaSsoServerProcessor.java
View File

@@ -20,6 +20,8 @@ import cn.dev33.satoken.context.model.SaRequest;
import cn.dev33.satoken.context.model.SaResponse;
import cn.dev33.satoken.sso.SaSsoManager;
import cn.dev33.satoken.sso.config.SaSsoServerConfig;
import cn.dev33.satoken.sso.error.SaSsoErrorCode;
import cn.dev33.satoken.sso.exception.SaSsoException;
import cn.dev33.satoken.sso.name.ApiName;
import cn.dev33.satoken.sso.name.ParamName;
import cn.dev33.satoken.sso.template.SaSsoServerTemplate;
@@ -112,8 +114,16 @@ public class SaSsoServerProcessor {
return res.redirect(redirect);
} else {
// 方式2：带着ticket参数重定向回Client端 (mode=ticket)
// 校验提供的client是否为非法字符
String client = req.getParam(paramName.client);
if(SaSsoConsts.CLIENT_WILDCARD.equals(client)) {
throw new SaSsoException("无效 client 标识：" + client).setCode(SaSsoErrorCode.CODE_30013);
}
// 开始重定向
String redirectUrl = ssoServerTemplate.buildRedirectUrl(
stpLogic.getLoginId(), req.getParam(paramName.client), req.getParam(paramName.redirect));
stpLogic.getLoginId(), client, req.getParam(paramName.redirect));
return res.redirect(redirectUrl);
}
}
@@ -145,7 +155,12 @@ public class SaSsoServerProcessor {
String ticket = req.getParamNotNull(paramName.ticket);
String sloCallback = req.getParam(paramName.ssoLogoutCall);
// 2、校验签名
// 2、校验提供的client是否为非法字符
if(SaSsoConsts.CLIENT_WILDCARD.equals(client)) {
return SaResult.error("无效 client 标识：" + client);
}
// 3、校验签名
if(ssoServerTemplate.getServerConfig().getIsCheckSign()) {
ssoServerTemplate.getSignTemplate(client).checkRequest(req,
paramName.client, paramName.ticket, paramName.ssoLogoutCall);
@@ -153,16 +168,16 @@ public class SaSsoServerProcessor {
SaSsoManager.printNoCheckSignWarningByRuntime();
}
// 3、校验ticket，获取 loginId
// 4、校验ticket，获取 loginId
Object loginId = ssoServerTemplate.checkTicket(ticket, client);
if(SaFoxUtil.isEmpty(loginId)) {
return SaResult.error("无效ticket：" + ticket);
}
// 4、注册此客户端的单点注销回调URL
// 5、注册此客户端的单点注销回调URL
ssoServerTemplate.registerSloCallbackUrl(loginId, client, sloCallback);
// 5、给 client 端响应结果
// 6、给 client 端响应结果
return SaResult.data(loginId);
}

17
sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/template/SaSsoServerTemplate.java
View File

@@ -187,7 +187,7 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
* @return 账号id
*/
public Object checkTicket(String ticket) {
return checkTicket(ticket, null);
return checkTicket(ticket, SaSsoConsts.CLIENT_WILDCARD);
}
/**
@@ -205,10 +205,17 @@ public class SaSsoServerTemplate extends SaSsoTemplate {
// 解析出这个 ticket 关联的 Client
String ticketClient = getTicketToClient(ticket);
// 如果指定了 client 标识，则校验一下 client 标识是否一致
if(SaFoxUtil.isNotEmpty(client) && SaFoxUtil.notEquals(client, ticketClient)) {
throw new SaSsoException("该 ticket 不属于 client=" + client + ", ticket 值: " + ticket)
.setCode(SaSsoErrorCode.CODE_30011);
// 校验 client 参数是否正确，即：创建 ticket 的 client 和当前校验 ticket 的 client 是否一致
if(SaSsoConsts.CLIENT_WILDCARD.equals(client)) {
// 如果提供的是通配符，直接越过 client 校验
} else if (SaFoxUtil.isEmpty(client) && SaFoxUtil.isEmpty(ticketClient)) {
// 如果提供的和期望的两者均为空，则通过校验
} else {
// 开始详细比对
if(SaFoxUtil.notEquals(client, ticketClient)) {
throw new SaSsoException("该 ticket 不属于 client=" + client + ", ticket 值: " + ticket)
.setCode(SaSsoErrorCode.CODE_30011);
}
}
// 删除 ticket 信息，使其只有一次性有效

5
sa-token-plugin/sa-token-sso/src/main/java/cn/dev33/satoken/sso/util/SaSsoConsts.java
View File

@@ -45,6 +45,9 @@ public class SaSsoConsts {
/** 表示请求没有得到任何有效处理 {msg: "not handle"} */
public static final String NOT_HANDLE = "{\"msg\": \"not handle\"}";
/** client 身份，* 代表通配，可以解析出所有 client 的 ticket */
public static final String CLIENT_WILDCARD = "*";
/** SSO 模式1 */
public static final int SSO_MODE_1 = 1;
/** SSO 模式2 */
@@ -52,4 +55,6 @@ public class SaSsoConsts {
/** SSO 模式3 */
public static final int SSO_MODE_3 = 3;
}