lsm/sa-token
1
0
Fork 0
mirror of https://gitee.com/dromara/sa-token.git synced 2026-02-27 16:50:24 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Sa-OAuth2 模块密码式新增 client_secret 参数校验

Browse Source
This commit is contained in:
click33
2022-08-23 16:43:17 +08:00
parent 31462217b4
commit 9d6ce502c1
5 changed files with 40 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Handle.java
View File

@@ -255,30 +255,31 @@ public class SaOAuth2Handle {
String username = req.getParamNotNull(Param.username);
String password = req.getParamNotNull(Param.password);
String clientId = req.getParamNotNull(Param.client_id);
String clientSecret = req.getParamNotNull(Param.client_secret);
String scope = req.getParam(Param.scope, "");
// 2、校验 ClientScope
SaOAuth2Util.checkContract(clientId, scope);
// 2、校验 ClientScope 和 scope
SaOAuth2Util.checkClientSecretAndScope(clientId, clientSecret, scope);
// 3、防止因前端误传token造成逻辑干扰
SaHolder.getStorage().set(StpUtil.stpLogic.splicingKeyJustCreatedSave(), "no-token");
// SaHolder.getStorage().set(StpUtil.stpLogic.splicingKeyJustCreatedSave(), "no-token");
// 4、调用API 开始登录，如果没能成功登录，则直接退出
// 3、调用API 开始登录，如果没能成功登录，则直接退出
Object retObj = cfg.getDoLoginHandle().apply(username, password);
if(StpUtil.isLogin() == false) {
return retObj;
}
// 5、构建 ra对象
// 4、构建 ra对象
RequestAuthModel ra = new RequestAuthModel();
ra.clientId = clientId;
ra.loginId = StpUtil.getLoginId();
ra.scope = scope;
// 7、生成 Access-Token
// 5、生成 Access-Token
AccessTokenModel at = SaOAuth2Util.generateAccessToken(ra, true);
// 8、返回 Access-Token
// 6、返回 Access-Token
return SaResult.data(at.toLineMap());
}

19
sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Template.java
View File

@@ -396,6 +396,25 @@ public class SaOAuth2Template {
SaOAuth2Exception.throwBy(cm.clientSecret == null || cm.clientSecret.equals(clientSecret) == false, "无效client_secret: " + clientSecret);
return cm;
}
/**
* 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes
* @param clientId 应用id
* @param clientSecret 秘钥
* @param scopes 权限（多个用逗号隔开）
* @return SaClientModel对象
*/
public SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, String scopes) {
// 先校验 clientSecret
SaClientModel cm = checkClientSecret(clientId, clientSecret);
// 再校验 是否签约
List<String> clientScopeList = SaFoxUtil.convertStringToList(cm.contractScope);
List<String> scopelist = SaFoxUtil.convertStringToList(scopes);
if(clientScopeList.containsAll(scopelist) == false) {
throw new SaOAuth2Exception("请求的Scope暂未签约");
}
// 返回数据
return cm;
}
/**
* 校验：使用 code 获取 token 时提供的参数校验
* @param code 授权码

11
sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/logic/SaOAuth2Util.java
View File

@@ -207,6 +207,17 @@ public class SaOAuth2Util {
return saOAuth2Template.checkClientSecret(clientId, clientSecret);
}
/**
* 校验：clientId 与 clientSecret 是否正确，并且是否签约了指定 scopes
* @param clientId 应用id
* @param clientSecret 秘钥
* @param scopes 权限（多个用逗号隔开）
* @return SaClientModel对象
*/
public static SaClientModel checkClientSecretAndScope(String clientId, String clientSecret, String scopes) {
return saOAuth2Template.checkClientSecretAndScope(clientId, clientSecret, scopes);
}
/**
* 校验：使用 code 获取 token 时提供的参数校验
* @param code 授权码