test-version22
/
MeterSphere
mirror of https://gitee.com/fit2cloud-feizhiyun/MeterSphere.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

refactor: 优化ApiKeyFilter的执行流程

This commit is contained in:
CaptainB 2022-06-26 09:26:46 +08:00 committed by f2c-ci-robot[bot]
parent c6d21be372
commit fc738a253d
1 changed files with 20 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
backend/src/main/java/io/metersphere/security/ApiKeyFilter.java
View File

@ -15,7 +15,16 @@ public class ApiKeyFilter extends AnonymousFilter {
@Override @Override
protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) { protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) {
try { // 不是apikey的通过
if (!ApiKeyHandler.isApiKeyCall(WebUtils.toHttp(request))) {
String id = (String) SecurityUtils.getSubject().getSession().getId();
// 防止调用时使用 ak 作为 cookie 跳过登入逻辑
if (id.length() < 20) {
SecurityUtils.getSubject().logout();
}
return true;
}
// apikey 验证
if (!SecurityUtils.getSubject().isAuthenticated()) { if (!SecurityUtils.getSubject().isAuthenticated()) {
String userId = ApiKeyHandler.getUser(WebUtils.toHttp(request)); String userId = ApiKeyHandler.getUser(WebUtils.toHttp(request));
if (StringUtils.isNotBlank(userId)) { if (StringUtils.isNotBlank(userId)) {
@ -24,28 +33,11 @@ public class ApiKeyFilter extends AnonymousFilter {
} }
SecurityUtils.getSubject().login(new MsUserToken(userId, ApiKeySessionHandler.random, "LOCAL")); SecurityUtils.getSubject().login(new MsUserToken(userId, ApiKeySessionHandler.random, "LOCAL"));
} }
} else {
if (ApiKeyHandler.isApiKeyCall(WebUtils.toHttp(request))) {
String userId = ApiKeyHandler.getUser(WebUtils.toHttp(request));
SecurityUtils.getSubject().login(new MsUserToken(userId, ApiKeySessionHandler.random, "LOCAL"));
} else {
String id = (String) SecurityUtils.getSubject().getSession().getId();
// 防止调用时使用 ak 作为 cookie 跳过登入逻辑
if (id.length() < 20) {
SecurityUtils.getSubject().logout();
} }
} // 登录之后验证
}
if (!SecurityUtils.getSubject().isAuthenticated()) { if (!SecurityUtils.getSubject().isAuthenticated()) {
((HttpServletResponse) response).setHeader(SessionConstants.AUTHENTICATION_STATUS, SessionConstants.AUTHENTICATION_INVALID); ((HttpServletResponse) response).setHeader(SessionConstants.AUTHENTICATION_STATUS, SessionConstants.AUTHENTICATION_INVALID);
} }
} catch (Exception e) {
if (ApiKeyHandler.isApiKeyCall(WebUtils.toHttp(request))) {
throw e;
}
LogUtil.getLogger().error("failed to handle single sign on..", e);
}
return true; return true;
} }