You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2021/02/04 17:24:13 UTC

[GitHub] [apisix-dashboard] starsz opened a new pull request #1429: fix: change the /version to /apisix/admin/tool/version

starsz opened a new pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429


   Please answer these questions before submitting a pull request
   
   - Why submit this pull request?
   - [ ] Bugfix
   - [x] New feature provided
   - [ ] Improve performance
   - [ ] Backport patches
   
   - Related issues
   - 
   https://github.com/apache/apisix-dashboard/pull/1408#discussion_r570317906
   
   ### New feature or improvement
   - Describe the details and related test reports.
   
   change the /version to /apisix/admin/tool/version
   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570716382



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       Yes.It's created already.

##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {

Review comment:
       Good capture. I will do this in another PR.

##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       See the PR https://github.com/apache/apisix-dashboard/issues/758

##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       See the ISSUE: https://github.com/apache/apisix-dashboard/issues/758




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] tokers commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
tokers commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570712580



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {

Review comment:
       What about swapping these two if block? URI without /apisix can be judged firstly.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] juzhiyuan commented on pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
juzhiyuan commented on pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#issuecomment-773775629


   ping @tokers @imjoey 's help to review codes.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570738755



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       See the PR https://github.com/apache/apisix-dashboard/issues/758




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz merged pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz merged pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429


   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz merged pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz merged pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429


   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] juzhiyuan commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
juzhiyuan commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570709552



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       may have a tracker issue

##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       Could you reference this PR with that issue? to prevent from missing this case.

##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       ![image](https://user-images.githubusercontent.com/2106987/106996049-1c85ad00-67bb-11eb-8d5e-abc0ead27e84.png)
   
   OK, once this issue occurred here once, then that issue will have the ability to track this PR.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] juzhiyuan commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
juzhiyuan commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570740069



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       ![image](https://user-images.githubusercontent.com/2106987/106996049-1c85ad00-67bb-11eb-8d5e-abc0ead27e84.png)
   
   OK, once this issue occurred here once, then that issue will have the ability to track this PR.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] juzhiyuan commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
juzhiyuan commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570734642



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       Could you reference this PR with that issue? to prevent from missing this case.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570716382



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       Yes.It's created already.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570738755



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       See the ISSUE: https://github.com/apache/apisix-dashboard/issues/758




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] juzhiyuan commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
juzhiyuan commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570709552



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {
 		return mw.BaseMiddleware.Handle(ctx)
 	}
 
+	// Need check the auth header
+	tokenStr := req.Header.Get("Authorization")
+
+	// verify token
+	token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(conf.AuthConf.Secret), nil
+	})
+
+	// TODO: design the response error code

Review comment:
       may have a tracker issue




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] starsz commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
starsz commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570716879



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {

Review comment:
       Good capture. I will do this in another PR.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] tokers commented on a change in pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
tokers commented on a change in pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#discussion_r570712580



##########
File path: api/internal/filter/authentication.go
##########
@@ -45,50 +45,55 @@ func (mw *AuthenticationMiddleware) Handle(ctx droplet.Context) error {
 
 	req := httpReq.(*http.Request)
 
-	if req.URL.Path != "/apisix/admin/user/login" && strings.HasPrefix(req.URL.Path, "/apisix") {
-		tokenStr := req.Header.Get("Authorization")
-
-		// verify token
-		token, err := jwt.ParseWithClaims(tokenStr, &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(conf.AuthConf.Secret), nil
-		})
-
-		// TODO: design the response error code
-		response := data.Response{Code: 010013, Message: "request unauthorized"}
-
-		if err != nil || token == nil || !token.Valid {
-			log.Warnf("token validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		claims, ok := token.Claims.(*jwt.StandardClaims)
-		if !ok {
-			log.Warnf("token validate failed: %s, %v", err, token.Valid)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if err := token.Claims.Valid(); err != nil {
-			log.Warnf("token claims validate failed: %s", err)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if claims.Subject == "" {
-			log.Warn("token claims subject empty")
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
-
-		if _, ok := conf.UserList[claims.Subject]; !ok {
-			log.Warnf("user not exists by token claims subject %s", claims.Subject)
-			ctx.SetOutput(&data.SpecCodeResponse{StatusCode: http.StatusUnauthorized, Response: response})
-			return nil
-		}
+	if req.URL.Path == "/apisix/admin/tool/version" || req.URL.Path == "/apisix/admin/user/login" {
+		return mw.BaseMiddleware.Handle(ctx)
+	}
 
+	if !strings.HasPrefix(req.URL.Path, "/apisix") {

Review comment:
       What about swapping these two if block? URI without /apisix can be judged firstly.




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [apisix-dashboard] juzhiyuan commented on pull request #1429: fix: change the /version to /apisix/admin/tool/version

Posted by GitBox <gi...@apache.org>.
juzhiyuan commented on pull request #1429:
URL: https://github.com/apache/apisix-dashboard/pull/1429#issuecomment-773775629


   ping @tokers @imjoey 's help to review codes.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org