fix(security): distinguish gateway context failures

2026-09-08 21:29:23 +08:00
parent 781669dfaf
commit e9ad7e333a
2 changed files with 11 additions and 3 deletions
@@ -31,8 +31,13 @@ public final class GatewayAccessTokenSessionValidator implements AccessTokenSess
    @Override
    public AccessTokenSession validate(Jwt jwt, HttpServletRequest request) {
        String supplied = request.getHeader(TOKEN_HEADER);
-        if (supplied == null || !MessageDigest.isEqual(expectedToken, supplied.getBytes(StandardCharsets.UTF_8))) {
-            throw new IllegalArgumentException("Untrusted overseas gateway authorization context");
+        if (supplied == null || supplied.isBlank()) {
+            throw new IllegalArgumentException("Missing overseas gateway authorization context");
+        }
+        byte[] suppliedToken = supplied.getBytes(StandardCharsets.UTF_8);
+        if (!MessageDigest.isEqual(expectedToken, suppliedToken)) {
+            throw new IllegalArgumentException("Invalid overseas gateway authorization context (expectedBytes="
+                    + expectedToken.length + ", suppliedBytes=" + suppliedToken.length + ")");
        }
        Long userId = number(jwt.getClaims().getOrDefault("userId", jwt.getClaims().get("user_id")));
        if (userId == null) {