You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@seata.apache.org by "Muluo-cyan (via GitHub)" <gi...@apache.org> on 2024/10/14 18:36:27 UTC
[PR] feature: add double token support for console and raft registry api [incubator-seata]
Muluo-cyan opened a new pull request, #6924:
URL: https://github.com/apache/incubator-seata/pull/6924
- [ ] I have registered the PR [changes](../changes).
### Ⅰ. Describe what this PR did
1. Console后端的鉴权方案现在改为双token方案(前端还暂不支持，现在实际效果与之前相同。
2. Client请求raft集群信息的鉴权方案现在采用双token方案。
3. 分离Console和Client请求raft集群信息使用的鉴权配置
### Ⅱ. Does this pull request fix one issue?
### Ⅲ. Why don't you add test cases (unit test/integration test)?
### Ⅳ. Describe how to verify it
1. 配置raft集群信息，启动seata server的raft集群
2. 下载[seata-samples/at-samples](https://github.com/apache/incubator-seata-samples/tree/master/at-sample)，配置对应的raft集群，修改maven仓库的依赖为该pr版本(删除seata-samples在本地maven仓库中对seata的相关依赖，拉取代码到本地并执行 mvn clean install -DskipTests=true -P release-seata)，配置便于测试的token有效时间
3. 启动客户端
- Client启动后，会定期与TC进行交互，观察交互时Client向TC发起的http请求的鉴权流程是否符合预期即可(首次请求会使用用户名密码请求登录接口，登录成功获取access token和refresh token，后续请求都会使用access token进行。如果Server响应Client access token即将过期时，Client下次发起请求会使用refresh token 刷新access token。如果Server响应Client access token已经过期，Client会使用refresh token重发请求。使用refresh token进行请求，鉴权成功后服务端的响应里会携带access token，refresh token过期或token鉴权失败后会重新请求登录接口获取新的access token和refresh token)
-
- 打开console控制台，登录后，浏览器查看登录请求，从响应中获取access token和refresh token。使用postman模拟上述流程进行测试，观察服务端响应是否符合预期。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: add double token support for console and raft registry api [incubator-seata]
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #6924:
URL: https://github.com/apache/incubator-seata/pull/6924#discussion_r1818061622
##########
server/src/main/java/org/apache/seata/server/auth/config/ClusterSecurityConfig.java:
##########
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.seata.server.auth.config;
+
+import org.apache.seata.server.auth.filter.ClusterAuthenticationTokenFilter;
+import org.apache.seata.server.auth.security.CustomUserDetailsServiceImpl;
+import org.apache.seata.server.auth.security.JwtAuthenticationEntryPoint;
+import org.apache.seata.server.auth.utils.ClusterJwtTokenUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
+import org.springframework.core.annotation.Order;
+import org.springframework.core.env.Environment;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+
+/**
+ * Spring security config
+ *
+ */
+@Configuration(proxyBeanMethods = false)
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+@Order(1)
+public class ClusterSecurityConfig extends WebSecurityConfigurerAdapter {
+
+ /**
+ * The constant AUTHORIZATION_HEADER.
+ */
+ public static final String AUTHORIZATION_HEADER = "Authorization";
+
+ /**
+ * The constant REFRESH_TOKEN.
+ */
+ public static final String REFRESH_TOKEN = "refresh_token";
+
+ /**
+ * The constant AUTHORIZATION_TOKEN.
+ */
+ public static final String AUTHORIZATION_TOKEN = "access_token";
+
+ /**
+ * The constant ACCESS_TOKEN_NEAR_EXPIRATION.
+ */
+ public static final String ACCESS_TOKEN_NEAR_EXPIRATION = "Access_token_near_expiration";
+
+ /**
+ * The constant SECURITY_IGNORE_URLS_SPILT_CHAR.
+ */
+ public static final String SECURITY_IGNORE_URLS_SPILT_CHAR = ",";
+
+ /**
+ * The constant TOKEN_PREFIX.
+ */
+ public static final String TOKEN_PREFIX = "Bearer ";
+
+ @Autowired
+ @Qualifier("clusterUserDetailsService")
+ private CustomUserDetailsServiceImpl userDetailsService;
+
+ @Autowired
+ @Qualifier("clusterJwtAuthenticationEntryPoint")
+ private JwtAuthenticationEntryPoint unauthorizedHandler;
+
+ @Autowired
+ @Qualifier("clusterJwtTokenUtils")
+ private ClusterJwtTokenUtils tokenProvider;
+
+ @Autowired
+ private Environment env;
+
+ @Bean("clusterAuthenticationManager")
+ @Override
+ @Primary
+ public AuthenticationManager authenticationManagerBean() throws Exception {
+ return super.authenticationManagerBean();
+ }
+
+ @Override
+ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+ auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
+ }
+
+ @Override
+ public void configure(WebSecurity web) {
+ String ignoreURLs = env.getProperty("seata.security.ignore.urls", "/**");
+ for (String ignoreURL : ignoreURLs.trim().split(SECURITY_IGNORE_URLS_SPILT_CHAR)) {
+ web.ignoring().antMatchers(ignoreURL.trim());
+ }
+ }
+
+ @Override
+ protected void configure(HttpSecurity http) throws Exception {
+ http.authorizeRequests().anyRequest().authenticated().and()
+ // custom token authorize exception handler
+ .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
+ // since we use jwt, session is not necessary
+ .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
+ // since we use jwt, csrf is not necessary
+ .csrf().disable();
Review Comment:
## Disabled Spring CSRF protection
CSRF vulnerability due to protection being disabled.
[Show more details](https://github.com/apache/incubator-seata/security/code-scanning/44)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org