From 6bcbe72b43d6fa041d06878d1dae09a6d8903895 Mon Sep 17 00:00:00 2001
From: jack <jack.su@pollex.com.tw>
Date: 星期五, 11 八月 2023 16:19:02 +0800
Subject: [PATCH] [ADD] 為了解決滲透測試JWT token 登出未失效問題, 在登出後會需要建立黑名單並在filter中確定token是否非黑名單
---
pamapi/src/main/java/com/pollex/pam/web/rest/UserJWTController.java | 30 ++++++++++++++++++++++++++++++
1 files changed, 30 insertions(+), 0 deletions(-)
diff --git a/pamapi/src/main/java/com/pollex/pam/web/rest/UserJWTController.java b/pamapi/src/main/java/com/pollex/pam/web/rest/UserJWTController.java
index 90c0be8..a0ce0eb 100644
--- a/pamapi/src/main/java/com/pollex/pam/web/rest/UserJWTController.java
+++ b/pamapi/src/main/java/com/pollex/pam/web/rest/UserJWTController.java
@@ -3,8 +3,15 @@
import com.fasterxml.jackson.annotation.JsonProperty;
import com.pollex.pam.security.jwt.JWTFilter;
import com.pollex.pam.security.jwt.TokenProvider;
+import com.pollex.pam.business.domain.TokenBlackList;
+import com.pollex.pam.business.repository.TokenBlackListRepository;
import com.pollex.pam.business.web.vm.LoginVM;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.http.HttpServletRequest;
import javax.validation.Valid;
+
+import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
@@ -12,6 +19,7 @@
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.*;
/**
@@ -24,6 +32,9 @@
private final TokenProvider tokenProvider;
private final AuthenticationManagerBuilder authenticationManagerBuilder;
+
+ @Autowired
+ TokenBlackListRepository tokenBlackListRepository;
public UserJWTController(TokenProvider tokenProvider, AuthenticationManagerBuilder authenticationManagerBuilder) {
this.tokenProvider = tokenProvider;
@@ -44,6 +55,25 @@
httpHeaders.add(JWTFilter.AUTHORIZATION_HEADER, "Bearer " + jwt);
return new ResponseEntity<>(new JWTToken(jwt), httpHeaders, HttpStatus.OK);
}
+
+ @PostMapping("/logout")
+ public void logout(HttpServletRequest servletRequest) {
+ String jwtToken = resolveToken(servletRequest);
+ TokenBlackList blackList = new TokenBlackList(jwtToken);
+ tokenBlackListRepository.save(blackList);
+ }
+
+ private String resolveToken(HttpServletRequest request) {
+ String bearerToken = request.getHeader(JWTFilter.AUTHORIZATION_HEADER);
+ if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
+ return bearerToken.substring(7);
+ }
+ String jwt = request.getParameter(JWTFilter.AUTHORIZATION_TOKEN);
+ if (StringUtils.hasText(jwt)) {
+ return jwt;
+ }
+ return null;
+ }
/**
* Object to return as body in JWT Authentication.
--
Gitblit v1.8.0