You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@shenyu.apache.org by nuoyan <nu...@apache.org> on 2021/06/01 12:08:36 UTC

Data permission module stores user ids causing multi-threaded security issues

Hi

Did not consider the admin multi-user online, store the user id only using
a String, causing multi-threaded security problems！

Solutions

Use concurrentHashMap and  SecurityUtils.getSubject().getPrincipal() for
storage!

Re: Data permission module stores user ids causing multi-threaded security issues

Posted by Liming Deng <de...@apache.org>.

I suggest you wrapper the userId and userName to new Class like UserInfo
and  put it in SimpleAuthenticationInfo. see
org.apache.shenyu.admin.shiro.config.ShiroRealm#doGetAuthenticationInfo

[image: 微信图片_20210602180348.png]

XiaoYu <xi...@apache.org> 于2021年6月2日周三 上午11:30写道：

> Hi
>
> this is bug.  can you fix it?
>
> nuoyan <nu...@apache.org> 于2021年6月1日周二 下午8:08写道：
>
> > Hi
> >
> > Did not consider the admin multi-user online, store the user id only
> using
> > a String, causing multi-threaded security problems！
> >
> > Solutions
> >
> > Use concurrentHashMap and  SecurityUtils.getSubject().getPrincipal() for
> > storage!
> >
>

Re: Data permission module stores user ids causing multi-threaded security issues

Posted by XiaoYu <xi...@apache.org>.

Hi

this is bug.  can you fix it?

nuoyan <nu...@apache.org> 于2021年6月1日周二 下午8:08写道：

> Hi
>
> Did not consider the admin multi-user online, store the user id only using
> a String, causing multi-threaded security problems！
>
> Solutions
>
> Use concurrentHashMap and  SecurityUtils.getSubject().getPrincipal() for
> storage!
>