|
|
@@ -48,7 +48,10 @@ public class AccessFilter extends OncePerRequestFilter {
|
|
|
@Override
|
|
|
protected void doFilterInternal(@NonNull HttpServletRequest request, @NonNull HttpServletResponse response, @NonNull FilterChain chain) throws IOException, ServletException {
|
|
|
//忽略非get请求
|
|
|
- if (!request.getMethod().equals(HttpMethod.GET.name())) return;
|
|
|
+ if (!request.getMethod().equals(HttpMethod.GET.name())) {
|
|
|
+ chain.doFilter(request, response);
|
|
|
+ return;
|
|
|
+ }
|
|
|
//如果忽略列表包含该url,则直接放行
|
|
|
if (securityProperties.getPermitPattern().stream()
|
|
|
.anyMatch(s -> new AntPathRequestMatcher(s).matches(request))) {
|
|
|
@@ -68,50 +71,36 @@ public class AccessFilter extends OncePerRequestFilter {
|
|
|
|
|
|
//请求头访问密钥
|
|
|
String accessKey = request.getHeader(AccessMetadata.Headers.ACCESS_KEY);
|
|
|
- if (StringUtils.isBlank(accessKey)) {
|
|
|
- AccessUtil.writeResponseCode(response, ResponseCode.ACCESS_KEY_MISS);
|
|
|
- return;
|
|
|
- }
|
|
|
+ if (StringUtils.isBlank(accessKey)) AccessUtil.writeResponseCode(response, ResponseCode.ACCESS_KEY_MISS);
|
|
|
//访问密钥
|
|
|
AccessKeys accessKeys = accessKeysService.findByAccessKey(accessKey);
|
|
|
- if (accessKeys == null || accessKeys.getSecurityKey() == null) {
|
|
|
+ if (accessKeys == null || accessKeys.getSecurityKey() == null)
|
|
|
AccessUtil.writeResponseCode(response, ResponseCode.ACCESS_KEY_INVALID);
|
|
|
- return;
|
|
|
- }
|
|
|
//请求头时间戳
|
|
|
String timestampStr = request.getHeader(AccessMetadata.Headers.TIMESTAMP);
|
|
|
- if (StringUtils.isBlank(timestampStr)) {
|
|
|
- AccessUtil.writeResponseCode(response, ResponseCode.TIMESTAMP_MISS);
|
|
|
- return;
|
|
|
- }
|
|
|
- if (!NumberUtils.isDigits(timestampStr)) {
|
|
|
- AccessUtil.writeResponseCode(response, ResponseCode.TIMESTAMP_INVALID);
|
|
|
- return;
|
|
|
- }
|
|
|
+ if (StringUtils.isBlank(timestampStr)) AccessUtil.writeResponseCode(response, ResponseCode.TIMESTAMP_MISS);
|
|
|
+ if (!NumberUtils.isDigits(timestampStr)) AccessUtil.writeResponseCode(response, ResponseCode.TIMESTAMP_INVALID);
|
|
|
//时间戳
|
|
|
long timestamp = Long.parseLong(timestampStr);
|
|
|
if (ChronoUnit.MINUTES.between(Instant.ofEpochMilli(timestamp), Instant.now()) > 5 ||
|
|
|
- ChronoUnit.MINUTES.between(Instant.ofEpochMilli(timestamp), Instant.now()) < -1) {
|
|
|
+ ChronoUnit.MINUTES.between(Instant.ofEpochMilli(timestamp), Instant.now()) < -1)
|
|
|
AccessUtil.writeResponseCode(response, ResponseCode.TIMESTAMP_EXPIRED);
|
|
|
- return;
|
|
|
- }
|
|
|
//签名
|
|
|
String signature = request.getHeader(AccessMetadata.Headers.SIGNATURE);
|
|
|
- if (StringUtils.isBlank(signature)) {
|
|
|
- AccessUtil.writeResponseCode(response, ResponseCode.SIGNATURE_MISS);
|
|
|
- return;
|
|
|
- }
|
|
|
+ if (StringUtils.isBlank(signature)) AccessUtil.writeResponseCode(response, ResponseCode.SIGNATURE_MISS);
|
|
|
//参数
|
|
|
Map<String, String> params = request.getParameterMap().entrySet().stream()
|
|
|
.collect(Collectors.toMap(Map.Entry::getKey, e -> e.getValue()[0]));
|
|
|
+
|
|
|
//签名验证
|
|
|
- boolean matched = AccessUtil.matchesSignature(params, timestamp, accessKeys.getSecurityKey(), signature);
|
|
|
- if (!matched) {
|
|
|
- AccessUtil.writeResponseCode(response, ResponseCode.SIGNATURE_INVALID);
|
|
|
- return;
|
|
|
+ if (accessKeys != null && accessKeys.getSecurityKey() != null) {
|
|
|
+ boolean matched = AccessUtil.matchesSignature(params, timestamp, accessKeys.getSecurityKey(), signature);
|
|
|
+ //签发token
|
|
|
+ if (matched)
|
|
|
+ SecurityUtil.setAuthentication(AccessToken.authenticated(accessKey, Collections.singletonList(new SimpleGrantedAuthority(AccessMetadata.AUTHORITY))));
|
|
|
+ else AccessUtil.writeResponseCode(response, ResponseCode.SIGNATURE_INVALID);
|
|
|
}
|
|
|
- //签发token
|
|
|
- SecurityUtil.setAuthentication(AccessToken.authenticated(accessKey, Collections.singletonList(new SimpleGrantedAuthority(AccessMetadata.AUTHORITY))));
|
|
|
+
|
|
|
chain.doFilter(request, response);
|
|
|
}
|
|
|
}
|