java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): distinguish gateway context failures

Browse Source
This commit is contained in:
ouyangxq
2026-09-08 21:29:23 +08:00
parent 781669dfaf
commit e9ad7e333a
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common-security/src/main/java/com/baiyue/common/security/GatewayAccessTokenSessionValidator.java
+7 -2
View File
@@ -31,8 +31,13 @@ public final class GatewayAccessTokenSessionValidator implements AccessTokenSess
@Override
public AccessTokenSession validate(Jwt jwt, HttpServletRequest request) {
String supplied = request.getHeader(TOKEN_HEADER);
if (supplied == null || !MessageDigest.isEqual(expectedToken, supplied.getBytes(StandardCharsets.UTF_8))) {
throw new IllegalArgumentException("Untrusted overseas gateway authorization context");
if (supplied == null || supplied.isBlank()) {
throw new IllegalArgumentException("Missing overseas gateway authorization context");
}
byte[] suppliedToken = supplied.getBytes(StandardCharsets.UTF_8);
if (!MessageDigest.isEqual(expectedToken, suppliedToken)) {
throw new IllegalArgumentException("Invalid overseas gateway authorization context (expectedBytes="
+ expectedToken.length + ", suppliedBytes=" + suppliedToken.length + ")");
}
Long userId = number(jwt.getClaims().getOrDefault("userId", jwt.getClaims().get("user_id")));
if (userId == null) {
common-security/src/test/java/com/baiyue/common/security/GatewayAccessTokenSessionValidatorTest.java
+4 -1
View File
@@ -34,7 +34,10 @@ class GatewayAccessTokenSessionValidatorTest {
forged.addHeader(GatewayAccessTokenSessionValidator.AUTHORITIES_HEADER,
"platform:overseas-warehouse:last-mile-order:list");
assertThatThrownBy(() -> validator.validate(jwt(), forged))
.isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Untrusted");
.isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Invalid overseas gateway");
assertThatThrownBy(() -> validator.validate(jwt(), new MockHttpServletRequest()))
.isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Missing overseas gateway");
}
private Jwt jwt() {