Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feature: add double token support for console and raft registry api #6924

Open
wants to merge 4 commits into
base: 2.x
Choose a base branch
from

Conversation

Muluo-cyan
Copy link
Contributor

  • I have registered the PR changes.

Ⅰ. Describe what this PR did

  1. Console后端的鉴权方案现在改为双token方案(前端还暂不支持,现在实际效果与之前相同。
  2. Client请求raft集群信息的鉴权方案现在采用双token方案。
  3. 分离Console和Client请求raft集群信息使用的鉴权配置

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

  1. 配置raft集群信息,启动seata server的raft集群
  2. 下载seata-samples/at-samples,配置对应的raft集群,修改maven仓库的依赖为该pr版本(删除seata-samples在本地maven仓库中对seata的相关依赖,拉取代码到本地并执行 mvn clean install -DskipTests=true -P release-seata),配置便于测试的token有效时间
  3. 启动客户端
  • Client启动后,会定期与TC进行交互,观察交互时Client向TC发起的http请求的鉴权流程是否符合预期即可(首次请求会使用用户名密码请求登录接口,登录成功获取access token和refresh token,后续请求都会使用access token进行。如果Server响应Client access token即将过期时,Client下次发起请求会使用refresh token 刷新access token。如果Server响应Client access token已经过期,Client会使用refresh token重发请求。使用refresh token进行请求,鉴权成功后服务端的响应里会携带access token,refresh token过期或token鉴权失败后会重新请求登录接口获取新的access token和refresh token)
  • 打开console控制台,登录后,浏览器查看登录请求,从响应中获取access token和refresh token。使用postman模拟上述流程进行测试,观察服务端响应是否符合预期。

@Muluo-cyan Muluo-cyan force-pushed the authAPI branch 2 times, most recently from f97c103 to ffa5816 Compare October 15, 2024 16:37
@Muluo-cyan Muluo-cyan force-pushed the authAPI branch 2 times, most recently from d340516 to 2069813 Compare October 19, 2024 07:19
Comment on lines +118 to +124
http.authorizeRequests().anyRequest().authenticated().and()
// custom token authorize exception handler
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
// since we use jwt, session is not necessary
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
// since we use jwt, csrf is not necessary
.csrf().disable();

Check failure

Code scanning / CodeQL

Disabled Spring CSRF protection High

CSRF vulnerability due to protection being disabled.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants