lsm/sa-token
1
0
Fork 0
mirror of https://gitee.com/dromara/sa-token.git synced 2025-05-03 20:27:54 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: 新增 @SaCheckSign 注解鉴权，用于 API 签名参数校验

Browse Source
This commit is contained in:
click33 2025-03-10 00:08:59 +08:00
parent 1c4af4cc03
commit aef5e04abe
6 changed files with 101 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
sa-token-core/src/main/java/cn/dev33/satoken/annotation/SaCheckSign.java Normal file
View File

@ -0,0 +1,42 @@
/*
* Copyright 2020-2099 sa-token.cc
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package cn.dev33.satoken.annotation;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
/**
* 权限认证校验：必须具有正确的参数签名才可以通过校验
*
* <p> 可标注在方法、类上（效果等同于标注在此类的所有方法上）
*
* @author click33
* @since 1.41.0
*/
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD,ElementType.TYPE})
public @interface SaCheckSign {
/**
* 指定参与签名的参数有哪些，如果不填写则默认为全部参数
*
* @return /
*/
String [] verifyParams() default {};
}

46
sa-token-core/src/main/java/cn/dev33/satoken/annotation/handler/SaCheckSignHandler.java Normal file
View File

@ -0,0 +1,46 @@
/*
* Copyright 2020-2099 sa-token.cc
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package cn.dev33.satoken.annotation.handler;
import cn.dev33.satoken.annotation.SaCheckSign;
import cn.dev33.satoken.context.SaHolder;
import cn.dev33.satoken.sign.SaSignUtil;
import java.lang.reflect.Method;
/**
* 注解 SaCheckSign 的处理器
*
* @author click33
* @since 1.41.0
*/
public class SaCheckSignHandler implements SaAnnotationHandlerInterface<SaCheckSign> {
@Override
public Class<SaCheckSign> getHandlerAnnotationClass() {
return SaCheckSign.class;
}
@Override
public void checkMethod(SaCheckSign at, Method method) {
_checkMethod(at.verifyParams());
}
public static void _checkMethod(String[] params) {
SaSignUtil.checkRequest(SaHolder.getRequest(), params);
}
}

2
sa-token-core/src/main/java/cn/dev33/satoken/sign/SaSignTemplate.java
View File

@ -367,8 +367,8 @@ public class SaSignTemplate {
/**
* 校验：一个请求的 nonce、timestamp、sign 是否均为合法的，如果不合法，则抛出对应的异常
* @param paramNames 指定参与签名的参数有哪些，如果不填写则默认为全部参数
* @param request 待校验的请求对象
* @param paramNames 指定参与签名的参数有哪些，如果不填写则默认为全部参数
*/
public void checkRequest(SaRequest request, String... paramNames) {
if (paramNames.length == 0) {

10
sa-token-core/src/main/java/cn/dev33/satoken/sign/SaSignUtil.java
View File

@ -160,18 +160,20 @@ public class SaSignUtil {
/**
* 判断：一个请求中的 nonce、timestamp、sign 是否均为合法的
* @param request 待校验的请求对象
* @param paramNames 指定参与签名的参数有哪些，如果不填写则默认为全部参数
* @return 是否合法
*/
public static boolean isValidRequest(SaRequest request) {
return SaManager.getSaSignTemplate().isValidRequest(request);
public static boolean isValidRequest(SaRequest request, String... paramNames) {
return SaManager.getSaSignTemplate().isValidRequest(request, paramNames);
}
/**
* 校验：一个请求的 nonce、timestamp、sign 是否均为合法的，如果不合法，则抛出对应的异常
* @param request 待校验的请求对象
* @param paramNames 指定参与签名的参数有哪些，如果不填写则默认为全部参数
*/
public static void checkRequest(SaRequest request) {
SaManager.getSaSignTemplate().checkRequest(request);
public static void checkRequest(SaRequest request, String... paramNames) {
SaManager.getSaSignTemplate().checkRequest(request, paramNames);
}
}

1
sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaAnnotationStrategy.java
View File

@ -65,6 +65,7 @@ public final class SaAnnotationStrategy {
annotationHandlerMap.put(SaCheckHttpBasic.class, new SaCheckHttpBasicHandler());
annotationHandlerMap.put(SaCheckHttpDigest.class, new SaCheckHttpDigestHandler());
annotationHandlerMap.put(SaCheckOr.class, new SaCheckOrHandler());
annotationHandlerMap.put(SaCheckSign.class, new SaCheckSignHandler());
}
/**

11
sa-token-demo/sa-token-demo-test/src/main/java/com/pj/test/TestController.java
View File

@ -7,7 +7,6 @@ import cn.dev33.satoken.stp.SaLoginParameter;
import cn.dev33.satoken.stp.StpUtil;
import cn.dev33.satoken.util.SaFoxUtil;
import cn.dev33.satoken.util.SaResult;
import com.pj.model.SysUser;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
@ -46,11 +45,11 @@ public class TestController {
// StpUtil.getLoginId();
// StpUtil.getAnonTokenSession();
// StpUtil.setTokenValue("xxx");
StpUtil.getSession().set("name", "zhang");
StpUtil.getSession().set("age", 18);
SysUser user = new SysUser(10001, "lisi", 22);
StpUtil.getSession().set("user", user);
StpUtil.getTokenSession().set("user", user);
// StpUtil.getSession().set("name", "zhang");
// StpUtil.getSession().set("age", 18);
// SysUser user = new SysUser(10001, "lisi", 22);
// StpUtil.getSession().set("user", user);
// StpUtil.getTokenSession().set("user", user);
// 返回
return SaResult.data(null);