Hass/xiaozhi-esp32-server
1
0
Fork 0
mirror of https://github.com/xinnan-tech/xiaozhi-esp32-server.git synced 2026-07-22 15:13:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

优化登录 token 校验：

Browse Source 
1、后端新增 /api/v1/user/info 接口，优化 Oauth2Filter.getRequestToken 逻辑；
2、前端 /api/v1/user/login 登录成功后，保存 token 至浏览器本地；
3、前端请求添加本地 token。
This commit is contained in:
pengzhisheng
2025-03-14 09:54:54 +08:00
parent 40eb4ea4ec
commit 5b2957e7eb
14 changed files with 131 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main/manager-api/src/main/java/xiaozhi/common/constant/Constant.java
+2
View File
@@ -78,6 +78,8 @@ public interface Constant {
*/
String TOKEN_HEADER = "token";
String AUTHORIZATION = "Authorization";
/**
* 路径分割符
*/
main/manager-api/src/main/java/xiaozhi/modules/security/config/ShiroConfig.java
+6
View File
@@ -58,6 +58,12 @@ public class ShiroConfig {
filters.put("oauth2", new Oauth2Filter());
shiroFilter.setFilters(filters);
//添加Shiro的内置过滤器
/*anon：无需认证就可以访问
authc：必须认证了才能让问
user：必须拥有，记住我功能，才能访问
perms：拥有对某个资源的权限才能访问
role：拥有某个角色权限才能访问*/
Map<String, String> filterMap = new LinkedHashMap<>();
filterMap.put("/webjars/**", "anon");
filterMap.put("/druid/**", "anon");
main/manager-api/src/main/java/xiaozhi/modules/security/controller/LoginController.java
+24 -1
View File
@@ -4,11 +4,16 @@ import io.swagger.v3.oas.annotations.Operation;
import io.swagger.v3.oas.annotations.tags.Tag;
import jakarta.servlet.http.HttpServletResponse;
import lombok.AllArgsConstructor;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.*;
import xiaozhi.common.exception.ErrorCode;
import xiaozhi.common.exception.RenException;
import xiaozhi.common.page.TokenDTO;
import xiaozhi.common.utils.Result;
import xiaozhi.common.validator.AssertUtils;
import xiaozhi.modules.security.dao.SysUserTokenDao;
import xiaozhi.modules.security.dto.LoginDTO;
import xiaozhi.modules.security.password.PasswordUtils;
import xiaozhi.modules.security.service.CaptchaService;
@@ -31,6 +36,7 @@ public class LoginController {
private final SysUserTokenService sysUserTokenService;
private final CaptchaService captchaService;
private static final Logger logger = LoggerFactory.getLogger(LoginController.class);
@GetMapping("/captcha")
@Operation(summary = "验证码")
@@ -44,7 +50,7 @@ public class LoginController {
@PostMapping("/login")
@Operation(summary = "登录")
public Result login( @RequestBody LoginDTO login) {
public Result<TokenDTO> login(@RequestBody LoginDTO login) {
// 验证是否正确输入验证码
boolean validate = captchaService.validate(login.getCaptchaId(), login.getCaptcha());
if (!validate) {
@@ -84,4 +90,21 @@ public class LoginController {
}
@GetMapping("/info")
@Operation(summary = "用户信息获取")
public Result<SysUserDTO> info(@RequestHeader("Authorization")String authorization) {
logger.info("the authorization:{}", authorization);
String token;
if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
throw new RenException(ErrorCode.UNAUTHORIZED);
}
token = authorization.replace("Bearer ", "");
if (StringUtils.isBlank(token)) {
throw new RenException(ErrorCode.UNAUTHORIZED);
}
SysUserDTO sysUserDTO = sysUserTokenService.getUserByToken(token);
Result result = new Result<SysUserDTO>();
return result.ok(sysUserDTO);
}
}
main/manager-api/src/main/java/xiaozhi/modules/security/oauth2/Oauth2Filter.java
+13 -2
View File
@@ -11,6 +11,7 @@ import org.apache.shiro.web.filter.authc.AuthenticatingFilter;
import org.springframework.web.bind.annotation.RequestMethod;
import xiaozhi.common.constant.Constant;
import xiaozhi.common.exception.ErrorCode;
import xiaozhi.common.exception.RenException;
import xiaozhi.common.utils.HttpContextUtils;
import xiaozhi.common.utils.JsonUtils;
import xiaozhi.common.utils.Result;
@@ -89,12 +90,22 @@ public class Oauth2Filter extends AuthenticatingFilter {
* 获取请求的token
*/
private String getRequestToken(HttpServletRequest httpRequest) {
String token;
//从header中获取token
String token = httpRequest.getHeader(Constant.TOKEN_HEADER);
String authorization = httpRequest.getHeader(Constant.AUTHORIZATION);
if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
throw new RenException(ErrorCode.UNAUTHORIZED);
}
token = authorization.replace("Bearer ", "");
//如果header中不存在token，则从参数中获取token
if (StringUtils.isBlank(token)) {
token = httpRequest.getParameter(Constant.TOKEN_HEADER);
authorization = httpRequest.getParameter(Constant.AUTHORIZATION);
if (StringUtils.isBlank(authorization) && authorization.contains("Bearer ")) {
throw new RenException(ErrorCode.UNAUTHORIZED);
}
token = authorization.replace("Bearer ", "");
}
return token;
}
main/manager-api/src/main/java/xiaozhi/modules/security/oauth2/Oauth2Realm.java
+10
View File
@@ -6,12 +6,15 @@ import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Lazy;
import org.springframework.stereotype.Component;
import xiaozhi.common.exception.ErrorCode;
import xiaozhi.common.user.UserDetail;
import xiaozhi.common.utils.ConvertUtils;
import xiaozhi.common.utils.MessageUtils;
import xiaozhi.modules.security.controller.LoginController;
import xiaozhi.modules.security.entity.SysUserTokenEntity;
import xiaozhi.modules.security.service.ShiroService;
import xiaozhi.modules.sys.entity.SysUserEntity;
@@ -30,6 +33,8 @@ public class Oauth2Realm extends AuthorizingRealm {
@Resource
private ShiroService shiroService;
private static final Logger logger = LoggerFactory.getLogger(Oauth2Realm.class);
@Override
public boolean supports(AuthenticationToken token) {
return token instanceof Oauth2Token;
@@ -82,6 +87,11 @@ public class Oauth2Realm extends AuthorizingRealm {
userDetail.setToken(accessToken);
//账号锁定
if (userDetail.getStatus() == null) {
logger.error("账号状态异常，status 不能为空");
throw new DisabledAccountException(MessageUtils.getMessage(ErrorCode.ACCOUNT_DISABLE));
}
if (userDetail.getStatus() == 0) {
throw new LockedAccountException(MessageUtils.getMessage(ErrorCode.ACCOUNT_LOCK));
}
main/manager-api/src/main/java/xiaozhi/modules/security/service/SysUserTokenService.java
+5 -1
View File
@@ -1,9 +1,11 @@
package xiaozhi.modules.security.service;
import xiaozhi.common.page.PageData;
import xiaozhi.common.page.TokenDTO;
import xiaozhi.common.service.BaseService;
import xiaozhi.common.utils.Result;
import xiaozhi.modules.security.entity.SysUserTokenEntity;
import xiaozhi.modules.sys.dto.SysUserDTO;
import java.util.Map;
@@ -19,7 +21,9 @@ public interface SysUserTokenService extends BaseService<SysUserTokenEntity> {
*
* @param userId 用户ID
*/
Result createToken(Long userId);
Result<TokenDTO> createToken(Long userId);
SysUserDTO getUserByToken(String token);
/**
* 退出
main/manager-api/src/main/java/xiaozhi/modules/security/service/impl/SysUserTokenServiceImpl.java
+23 -1
View File
@@ -1,6 +1,9 @@
package xiaozhi.modules.security.service.impl;
import cn.hutool.core.date.DateUtil;
import lombok.AllArgsConstructor;
import xiaozhi.common.exception.ErrorCode;
import xiaozhi.common.exception.RenException;
import xiaozhi.common.page.TokenDTO;
import xiaozhi.common.service.impl.BaseServiceImpl;
import xiaozhi.common.utils.HttpContextUtils;
@@ -10,18 +13,23 @@ import xiaozhi.modules.security.entity.SysUserTokenEntity;
import xiaozhi.modules.security.oauth2.TokenGenerator;
import xiaozhi.modules.security.service.SysUserTokenService;
import org.springframework.stereotype.Service;
import xiaozhi.modules.sys.dto.SysUserDTO;
import xiaozhi.modules.sys.service.SysUserService;
import java.util.Date;
@AllArgsConstructor
@Service
public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, SysUserTokenEntity> implements SysUserTokenService {
private final SysUserService sysUserService;
/**
* 12小时后过期
*/
private final static int EXPIRE = 3600 * 12;
@Override
public Result createToken(Long userId) {
public Result<TokenDTO> createToken(Long userId) {
//用户token
String token;
@@ -70,6 +78,20 @@ public class SysUserTokenServiceImpl extends BaseServiceImpl<SysUserTokenDao, Sy
return new Result().ok(tokenDTO);
}
@Override
public SysUserDTO getUserByToken(String token) {
SysUserTokenEntity userToken = baseDao.getByToken(token);
Date now = new Date();
if (userToken.getExpireDate().before(now)) {
throw new RenException(ErrorCode.UNAUTHORIZED);
}
SysUserDTO userDTO = sysUserService.getByUserId(userToken.getUserId());
userDTO.setPassword("");
return userDTO;
}
@Override
public void logout(Long userId) {
Date expireDate = DateUtil.offsetMinute(new Date(), -1);
main/manager-api/src/main/java/xiaozhi/modules/sys/service/SysUserService.java
+2
View File
@@ -12,6 +12,8 @@ public interface SysUserService extends BaseService<SysUserEntity> {
SysUserDTO getByUsername(String username);
SysUserDTO getByUserId(Long userId);
void save(SysUserDTO dto);
void delete(Long[] ids);
main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysUserServiceImpl.java
+7
View File
@@ -41,6 +41,13 @@ public class SysUserServiceImpl extends BaseServiceImpl<SysUserDao, SysUserEntit
return ConvertUtils.sourceToTarget(entity, SysUserDTO.class);
}
@Override
public SysUserDTO getByUserId(Long userId) {
SysUserEntity sysUserEntity = sysUserDao.selectById(userId);
return ConvertUtils.sourceToTarget(sysUserEntity, SysUserDTO.class);
}
@Override
@Transactional(rollbackFor = Exception.class)
public void save(SysUserDTO dto) {
main/manager-web/src/apis/httpRequest.js
+4 -2
View File
@@ -1,6 +1,7 @@
import {goToPage, showDanger, showWarning} from '../utils/index'
import Constant from '../utils/constant'
import Fly from 'flyio/dist/npm/fly';
import store from '../store/index'
const fly = new Fly()
// 设置超时
@@ -25,7 +26,7 @@ function sendRequest() {
_url: '',
_responseType: undefined, // 新增响应类型字段
'send'() {
this._header.token = localStorage.getItem(Constant.STORAGE_KEY.TOKEN)
this._header.Authorization = 'Bearer ' + (JSON.parse(store.getters.getToken)).token
// 打印请求信息
fly.request(this._url, this._data, {
@@ -43,7 +44,7 @@ function sendRequest() {
}
}).catch((res) => {
// 打印失败响应
console.log(res)
console.log('catch', res)
httpHandlerError(res, this._failCallback)
})
return this
@@ -97,6 +98,7 @@ function sendRequest() {
*/
// 在错误处理函数中添加日志
function httpHandlerError(info, callBack) {
console.log('httpHandlerError', info)
/** 请求成功，退出该函数 可以根据项目需求来判断是否请求成功。这里判断的是status为200的时候是成功 */
let networkError = false
main/manager-web/src/apis/module/user.js
+1 -1
View File
@@ -32,7 +32,7 @@ export default {
},
// 获取设备信息
getHomeList(callback) {
RequestService.sendRequest().url(`${getServiceUrl()}/api/v1/user/device/bind`).method('GET')
RequestService.sendRequest().url(`${getServiceUrl()}/api/v1/device/bind`).method('GET')
.success((res) => {
RequestService.clearRequestTime()
callback(res)
main/manager-web/src/store/index.js
+12
View File
@@ -1,14 +1,26 @@
import Vue from 'vue'
import Vuex from 'vuex'
import Constant from '../utils/constant'
Vue.use(Vuex)
export default new Vuex.Store({
state: {
token: ''
},
getters: {
getToken(state) {
if (!state.token) {
state.token = localStorage.getItem('token')
}
return state.token
}
},
mutations: {
setToken(state, token) {
state.token = token
localStorage.token = token
}
},
actions: {
},
main/manager-web/src/views/home.vue
+4 -4
View File
@@ -27,7 +27,7 @@
</div>
<img src="@/assets/home/avatar.png" alt="" style="width: 21px;height: 21px;" />
<div class="user-info">
{{ userInfo.mobile }}
{{ userInfo.username }}
</div>
</div>
</div>
@@ -251,7 +251,7 @@ export default {
label: '双皮奶'
}],
userInfo: {
mobile: '' // 初始化用户信息
username: '' // 初始化用户信息
}
};
},
@@ -331,8 +331,8 @@ export default {
}
},
mounted() {
this.fetchUserInfo(); // 组件加载时获取用户信息
this.getList(); // 初始化设备列表
// this.fetchUserInfo(); // 组件加载时获取用户信息
// this.getList(); // 初始化设备列表
}
}
</script>
main/manager-web/src/views/login.vue
+18 -10
View File
@@ -87,18 +87,22 @@ export default {
},
methods: {
fetchCaptcha() {
this.captchaUuid = getUUID();
if (this.$store.getters.getToken) {
goToPage('/home')
} else {
this.captchaUuid = getUUID();
Api.user.getCaptcha(this.captchaUuid, (res) => {
if (res.status === 200) {
const blob = new Blob([res.data], {type: res.data.type});
this.captchaUrl = URL.createObjectURL(blob);
Api.user.getCaptcha(this.captchaUuid, (res) => {
if (res.status === 200) {
const blob = new Blob([res.data], {type: res.data.type});
this.captchaUrl = URL.createObjectURL(blob);
} else {
console.error('验证码加载异常:', error);
showDanger('验证码加载失败，点击刷新')
}
});
} else {
console.error('验证码加载异常:', error);
showDanger('验证码加载失败，点击刷新')
}
});
}
},
async login() {
@@ -119,8 +123,12 @@ export default {
Api.user.login(this.form, ({data}) => {
console.log(data)
showSuccess('登陆成功！')
this.$store.commit('setToken', JSON.stringify(data.data))
goToPage('/home')
})
setTimeout(() => {
this.fetchCaptcha()
}, 1000)