From 8726fb38ce242df54cdc343aa505b2db276eeda4 Mon Sep 17 00:00:00 2001 From: WenG <450292408@qq.com> Date: Fri, 1 Apr 2022 23:59:50 +0800 Subject: [PATCH] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E7=99=BB=E5=BD=95=E8=A1=A8?= =?UTF-8?q?=E5=8D=95=E7=9A=84refer=E9=AA=8C=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../BaseAuthenticationProcessingFilter.java | 21 ++++++++++++++++++ .../user/UserAuthenticationFilter.java | 1 + .../login/base/consts/IUserCenterConst.java | 5 +++++ .../base/service/impl/OAuthServiceImpl.java | 7 ++++++ .../src/main/resources/templates/login.html | 4 +++- .../resources/templates/login/form/save.html | 22 +++++++++++-------- .../templates/login/form/update.html | 22 +++++++++++-------- 7 files changed, 63 insertions(+), 19 deletions(-) diff --git a/login-base/src/main/java/ink/wgink/login/base/authentication/BaseAuthenticationProcessingFilter.java b/login-base/src/main/java/ink/wgink/login/base/authentication/BaseAuthenticationProcessingFilter.java index e8e65690..f543d292 100644 --- a/login-base/src/main/java/ink/wgink/login/base/authentication/BaseAuthenticationProcessingFilter.java +++ b/login-base/src/main/java/ink/wgink/login/base/authentication/BaseAuthenticationProcessingFilter.java @@ -1,6 +1,7 @@ package ink.wgink.login.base.authentication; import ink.wgink.interfaces.consts.ISystemConstant; +import ink.wgink.login.base.consts.IUserCenterConst; import ink.wgink.login.base.exceptions.UserAuthenticationException; import ink.wgink.login.base.manager.ConfigManager; import org.apache.commons.lang3.StringUtils; @@ -65,4 +66,24 @@ public abstract class BaseAuthenticationProcessingFilter extends AbstractAuthent throw new UserAuthenticationException("登录方法必须是POST"); } } + + protected void checkReferToken(HttpServletRequest request) { + Object referToken = request.getSession().getAttribute(IUserCenterConst.REFER_TOKEN); + if(referToken == null) { + throw new UserAuthenticationException("refer参数为空，请重新刷新页面"); + } + String sessionReferToken = referToken.toString(); + if(StringUtils.isBlank(sessionReferToken)) { + throw new UserAuthenticationException("refer参数为空，请重新刷新页面"); + } + String pageReferToken = request.getParameter(IUserCenterConst.REFER_TOKEN); + if(StringUtils.isBlank(pageReferToken)) { + throw new UserAuthenticationException("请求头中缺少refer参数"); + } + if(!StringUtils.equals(sessionReferToken, pageReferToken)) { + throw new UserAuthenticationException("refer不匹配"); + } + // 校验成功删除session中的refer + request.getSession().removeAttribute(IUserCenterConst.REFER_TOKEN); + } } diff --git a/login-base/src/main/java/ink/wgink/login/base/authentication/user/UserAuthenticationFilter.java b/login-base/src/main/java/ink/wgink/login/base/authentication/user/UserAuthenticationFilter.java index ee213bf8..2fe1f2aa 100644 --- a/login-base/src/main/java/ink/wgink/login/base/authentication/user/UserAuthenticationFilter.java +++ b/login-base/src/main/java/ink/wgink/login/base/authentication/user/UserAuthenticationFilter.java @@ -32,6 +32,7 @@ public class UserAuthenticationFilter extends BaseAuthenticationProcessingFilter public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException { checkVerificationCode(request); checkPostMethod(request); + checkReferToken(request); String username = request.getParameter(KEY_USERNAME); String password = request.getParameter(KEY_PASSWORD); diff --git a/login-base/src/main/java/ink/wgink/login/base/consts/IUserCenterConst.java b/login-base/src/main/java/ink/wgink/login/base/consts/IUserCenterConst.java index 6b36cea4..417a174d 100644 --- a/login-base/src/main/java/ink/wgink/login/base/consts/IUserCenterConst.java +++ b/login-base/src/main/java/ink/wgink/login/base/consts/IUserCenterConst.java @@ -103,4 +103,9 @@ public interface IUserCenterConst { */ String CUSTOM_LOGIN_FORM = "customLoginForm"; + /** + * refer验证token + */ + String REFER_TOKEN = "referToken"; + } diff --git a/login-base/src/main/java/ink/wgink/login/base/service/impl/OAuthServiceImpl.java b/login-base/src/main/java/ink/wgink/login/base/service/impl/OAuthServiceImpl.java index 5984ade2..561a19b9 100644 --- a/login-base/src/main/java/ink/wgink/login/base/service/impl/OAuthServiceImpl.java +++ b/login-base/src/main/java/ink/wgink/login/base/service/impl/OAuthServiceImpl.java @@ -6,6 +6,7 @@ import ink.wgink.login.base.manager.ConfigManager; import ink.wgink.login.base.service.IOAuthService; import ink.wgink.properties.BaseProperties; import ink.wgink.properties.ServerProperties; +import ink.wgink.util.UUIDUtil; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; @@ -30,8 +31,14 @@ public class OAuthServiceImpl implements IOAuthService { @Override public Map getPageParams(HttpServletRequest request) { + // session中设置refer验证token + String referHeaderToken = UUIDUtil.getUUID(); + request.getSession().setAttribute(IUserCenterConst.REFER_TOKEN, referHeaderToken); + Map config = ConfigManager.getInstance().getConfig(); Map pageParams = new HashMap<>(16); + pageParams.put(IUserCenterConst.REFER_TOKEN, referHeaderToken); + Object errorMessage = request.getSession().getAttribute(IUserCenterConst.ERROR_MESSAGE); Object loginUsername = request.getSession().getAttribute(IUserCenterConst.LOGIN_USERNAME); pageParams.put(IUserCenterConst.ERROR_MESSAGE, errorMessage == null ? null : errorMessage.toString()); diff --git a/login-base/src/main/resources/templates/login.html b/login-base/src/main/resources/templates/login.html index 94b88059..b73f4dec 100644 --- a/login-base/src/main/resources/templates/login.html +++ b/login-base/src/main/resources/templates/login.html @@ -50,6 +50,7 @@