package com.yami.trading.security.common.filter;
|
|
import java.io.IOException;
|
import java.net.URLDecoder;
|
import java.time.ZoneId;
|
import java.util.HashSet;
|
import java.util.List;
|
import java.util.Map;
|
import java.util.Objects;
|
import java.util.concurrent.ConcurrentHashMap;
|
|
import javax.servlet.Filter;
|
import javax.servlet.FilterChain;
|
import javax.servlet.ServletException;
|
import javax.servlet.ServletRequest;
|
import javax.servlet.ServletResponse;
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
|
import cn.hutool.core.util.CharsetUtil;
|
import com.yami.trading.bean.model.RiskClient;
|
import com.yami.trading.bean.model.User;
|
import com.yami.trading.common.exception.BusinessException;
|
import com.yami.trading.common.util.*;
|
import com.yami.trading.security.common.util.RiskClientUtil;
|
import com.yami.trading.service.user.RiskClientService;
|
import com.yami.trading.service.user.UserService;
|
import org.apache.commons.lang3.ObjectUtils;
|
import org.slf4j.Logger;
|
import org.slf4j.LoggerFactory;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.beans.factory.annotation.Value;
|
import org.springframework.http.MediaType;
|
import org.springframework.stereotype.Component;
|
import org.springframework.util.AntPathMatcher;
|
|
import com.yami.trading.common.constants.RedisKeys;
|
import com.yami.trading.common.exception.YamiShopBindException;
|
import com.yami.trading.common.handler.HttpHandler;
|
import com.yami.trading.security.common.adapter.AuthConfigAdapter;
|
import com.yami.trading.security.common.bo.UserInfoInTokenBO;
|
import com.yami.trading.security.common.enums.SysTypeEnum;
|
import com.yami.trading.security.common.manager.TokenStore;
|
import com.yami.trading.security.common.util.AuthUserContext;
|
import com.yami.trading.security.common.util.ItemRedisKeys;
|
import com.yami.trading.security.common.util.MD5;
|
|
import cn.hutool.core.collection.CollectionUtil;
|
import cn.hutool.core.util.StrUtil;
|
|
/**
|
* 授权过滤，只要实现AuthConfigAdapter接口，添加对应路径即可：
|
*
|
* @author 菠萝凤梨
|
* @date 2022/3/25 17:33
|
*/
|
@Component
|
public class AuthFilter implements Filter {
|
private static final Logger logger = LoggerFactory.getLogger(AuthFilter.class);
|
|
@Value("${sign.encryption-key}")
|
private String ENCRYPTION_KEY;
|
|
@Value("${sign.version-number}")
|
private String VERSION_NUMBER;
|
|
@Autowired
|
private TokenStore tokenStore;
|
|
@Autowired
|
private HttpHandler httpHandler;
|
|
@Autowired
|
private AuthConfigAdapter authConfigAdapter;
|
|
@Autowired
|
private RiskClientService riskClientService;
|
|
@Autowired
|
UserService userService;
|
|
/**
|
* 白名单URL
|
*/
|
private static final HashSet<String> WHITE_URLS2 = new HashSet<String>();
|
|
/**
|
* 随机数与时间戳字典
|
*/
|
private static final Map<String, Long> ADMINCACHEMAP = new ConcurrentHashMap<>();
|
|
AntPathMatcher pathMatcher = new AntPathMatcher();
|
|
@Override
|
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
|
throws IOException, ServletException {
|
HttpServletRequest req = (HttpServletRequest) request;
|
HttpServletResponse resp = (HttpServletResponse) response;
|
String requestUri = req.getRequestURI();
|
String servletPath = req.getServletPath();
|
|
boolean servletPathWhiteUri = false;
|
if (WHITE_URLS2.contains(servletPath)) {
|
servletPathWhiteUri = true;
|
}
|
|
// 无需识别 token 的白名单
|
boolean ignoreTokenUri = false;
|
List<String> excludePathPatterns = authConfigAdapter.excludePathPatterns();
|
// 如果匹配不需要授权的路径，就不需要校验是否需要授权
|
if (CollectionUtil.isNotEmpty(excludePathPatterns)) {
|
for (String excludePathPattern : excludePathPatterns) {
|
if (pathMatcher.match(excludePathPattern, requestUri)) {
|
ignoreTokenUri = true;
|
}
|
}
|
}
|
|
// 如果 uri 请求携带 token，则校验 token，如果未携带 token，则不校验 token
|
boolean optionalTokenUri = false; // 其他接口，都务必需要携带 token，并且需要成功校验 token
|
List<String> maybeAuthUris = authConfigAdapter.maybeAuthUri();
|
if (CollectionUtil.isNotEmpty(maybeAuthUris)) {
|
for (String maybe : maybeAuthUris) {
|
if (pathMatcher.match(maybe, requestUri)) {
|
optionalTokenUri = true;
|
break;
|
}
|
}
|
}
|
|
String token = req.getHeader("token");
|
String accessToken = req.getHeader("Authorization");
|
if (StrUtil.isBlank(accessToken) || Objects.equals(accessToken, "null")) {
|
accessToken = token;
|
}
|
if (StrUtil.isBlank(accessToken) || Objects.equals(accessToken, "null")) {
|
accessToken = req.getParameter("token");
|
}
|
if (StrUtil.isBlank(accessToken) || Objects.equals(accessToken, "null")) {
|
accessToken = "";
|
}
|
if (requestUri.contains("adminLogin")) {
|
logger.info("---> requestUri:{}, accessToken:*{}*", requestUri, accessToken);
|
}
|
|
UserInfoInTokenBO userInfoInToken = null;
|
String clientIp = IPHelper.getIpAddr();
|
String userCode = "";
|
// 解析token的异常对象
|
YamiShopBindException tokenErr = null;
|
if (StrUtil.isNotBlank(accessToken)) {
|
try {
|
userInfoInToken = tokenStore.getUserInfoByAccessToken(accessToken, true);
|
if (userInfoInToken.getSysType().intValue() == SysTypeEnum.ORDINARY.value().intValue()) {
|
String userId = userInfoInToken.getUserId();
|
// 缓存优化 TODO
|
User userEntity = userService.cacheUserBy(userId);
|
if (userEntity != null) {
|
userCode = userEntity.getUserCode();
|
}
|
}
|
} catch (Exception e) {
|
if (e instanceof YamiShopBindException) {
|
logger.error("---> AuthFilter doFilter 处理 uri:{}, accessToken:{} 报 YamiShopBindException 异常:{}", requestUri, accessToken, e.getMessage());
|
tokenErr = (YamiShopBindException)e;
|
} else {
|
logger.error("---> AuthFilter doFilter 处理 uri:{}, accessToken:{} 报错:", requestUri, accessToken, e);
|
throw e;
|
}
|
}
|
}
|
// 处理黑名单访问，断网逻辑
|
if (checkBlackRequest(req, resp, clientIp, userCode)) {
|
return;
|
}
|
|
try {
|
// 识别时区信息
|
processTimezone(req);
|
|
// 白名单
|
if (servletPathWhiteUri) {
|
chain.doFilter(req, resp);
|
return;
|
}
|
|
//
|
if (ObjectUtils.isNotEmpty(VERSION_NUMBER)) {
|
// 验证时间戳签名
|
if (checkSign(req,response)) {
|
return;
|
}
|
}
|
|
// 当前 uri 不用检查是否携带 token，直接执行对应的接口
|
if (ignoreTokenUri) {
|
chain.doFilter(req, resp);
|
return;
|
}
|
|
// 有 token 就用，没 token 也无所谓的 api
|
if (userInfoInToken != null) {
|
// 如果有 token，并且解析成功，则走以下处理逻辑
|
if (userInfoInToken.getSysType().intValue() == SysTypeEnum.ADMIN.value().intValue()) {
|
if (!pathMatcher.match("/updateCheckIp", requestUri)) {
|
Object loginIP = RedisUtil.get(RedisKeys.ACCESS_IP + userInfoInToken.getUserId());
|
if (null != loginIP && !IPHelper.equalIpSegment(loginIP.toString(), clientIp)) {
|
logger.error("The Login IP Is Inconsistent With The Operation IP! Login-IP:{} Access-IP:{} Servlet-Path:{}", loginIP, clientIp, servletPath);
|
httpHandler.printServerResponseToWeb("", 1001);
|
return;
|
}
|
}
|
}
|
|
// 保存上下文
|
AuthUserContext.set(userInfoInToken);
|
} else if (!optionalTokenUri) {
|
// token 必填的路径
|
// 如果没有 token，或者 token 解析失败/过期，但是当前请求 uri 又不是一个可选 token 的uri，则报错，提示 token 无效
|
// 返回前端401
|
logger.error("---> requestUri:{} 未配置 optional 白名单", requestUri);
|
httpHandler.printServerResponseToWeb("您的账号已过期或已经在其他地方登录，请重新登录", 403);
|
return;
|
}
|
if (tokenErr != null) {
|
// 前面解析 token 报错，此处抛出
|
throw tokenErr;
|
}
|
|
// token 逻辑校验顺利
|
chain.doFilter(req, resp);
|
} catch (Exception e) {
|
// 手动捕获下非controller异常
|
if (e instanceof YamiShopBindException) {
|
httpHandler.printServerResponseToWeb("您的账号已经在其他地方登录", 403);
|
return;
|
} else {
|
logger.error("---> AuthFilter requestUri:{}, accessToken:{}, 请求处理报错: ", requestUri, accessToken, e);
|
throw e;
|
}
|
} finally {
|
AuthUserContext.clean();
|
TimeZoneContext.clientTimeZoneId.remove();
|
TimeZoneContext.showTimeZoneId.remove();
|
}
|
}
|
|
/**
|
* 普通请求处理处理
|
* @throws IOException
|
*/
|
public boolean checkSign(HttpServletRequest request, ServletResponse response) throws IOException {
|
String servletPath2 = request.getServletPath();
|
// 响应请求前参数校验
|
// 获取请求头中的时间戳参数
|
String timestamp = request.getHeader("tissuePaper");
|
String systemRandom = request.getHeader("systemRandom");
|
String waitSign = ENCRYPTION_KEY+timestamp;
|
|
if (timestamp == null) {
|
// 没有时间戳参数返回验签失败
|
logger.error("---> AuthFilter checkSign 时间戳为空:{} ", servletPath2);
|
((HttpServletResponse)response).sendError(201, "时间戳为空");
|
return true;
|
}
|
|
long currDate = System.currentTimeMillis()/1000L;
|
long oldDate = currDate - 60;
|
if (ADMINCACHEMAP.size() > 500) {
|
for (Map.Entry<String, Long> entry : ADMINCACHEMAP.entrySet()) {
|
if (entry.getValue().longValue() < oldDate) {
|
ADMINCACHEMAP.remove(entry.getKey());
|
}
|
}
|
}
|
if (ObjectUtils.isEmpty(systemRandom)) {
|
// 没有时间戳参数返回验签失败
|
logger.error("---> AuthFilter checkSign 时间戳和随机数为空:{}", servletPath2);
|
((HttpServletResponse)response).sendError(207, "时间戳和随机数为空");
|
return true;
|
}
|
String key = ItemRedisKeys.ITEM_ADMIN_SYSTEM_RANDOM;
|
if(ObjectUtils.isNotEmpty(ADMINCACHEMAP)) {
|
if(ObjectUtils.isNotEmpty(ADMINCACHEMAP.get(key+systemRandom))) {
|
//请求时间一致
|
logger.error("---> AuthFilter checkSign 当前请求时间戳和随机数和上次一样,请求拒绝:{} ", servletPath2);
|
((HttpServletResponse)response).sendError(208, "当前请求时间戳和随机数和上次一样,请求拒绝");
|
return true;
|
}
|
}
|
ADMINCACHEMAP.put(key+systemRandom,Long.parseLong(timestamp));
|
waitSign = ENCRYPTION_KEY+timestamp+systemRandom;
|
|
|
try {
|
// 20秒内有效
|
long timestampDate = Long.parseLong(timestamp) + (60 * 2);
|
if (timestampDate < currDate) {
|
// 请求过期
|
logger.error("---> AuthFilter checkSign 请求过期:{} ", servletPath2);
|
((HttpServletResponse)response).sendError(202, "请求过期");
|
return true;
|
}
|
} catch (NumberFormatException e) {
|
assert response != null;
|
logger.error("---> AuthFilter checkSign 请求异常:{}", servletPath2);
|
((HttpServletResponse)response).sendError(204, "请求异常");
|
return true;
|
}
|
|
String sign = request.getHeader("sign");
|
if (sign == null || "".equals(sign.trim())) {
|
// 没有签名返回验签失败
|
assert response != null;
|
logger.error("---> AuthFilter checkSign 签名为空:{}", servletPath2);
|
((HttpServletResponse)response).sendError(205, "签名为空");
|
return true;
|
}
|
|
// 验签， 根据时间戳生成签名加盐值反复加密两次， 对比是否一致
|
// 第一个参数为加密内容， 第二个参数为加密时的盐值
|
// 获取后台管理MD5盐值
|
String md5_result = MD5.sign(waitSign).toUpperCase();
|
if (!md5_result.equals(sign)) {
|
// 验签失败
|
logger.error("---> AuthFilter checkSign 签名失败:{}", servletPath2);
|
((HttpServletResponse)response).sendError(206, "签名失败");
|
return true;
|
}
|
|
return false;
|
}
|
|
private void processTimezone(HttpServletRequest req) throws IOException {
|
// 前端定制了展示数据使用的时区
|
String showTimeZone = req.getParameter("timezone");
|
if (StrUtil.isBlank(showTimeZone)) {
|
showTimeZone = req.getHeader("x-api-timezone");
|
}
|
if (StrUtil.isBlank(showTimeZone)) {
|
// 默认使用配置的时区
|
showTimeZone = ApplicationUtil.getProperty("config.timezone.show", "");
|
} else {
|
if (showTimeZone.contains("%")) {
|
showTimeZone = URLDecoder.decode(showTimeZone, "UTF-8");
|
}
|
}
|
if (StrUtil.isBlank(showTimeZone) || Objects.equals(showTimeZone, "default")) {
|
// 默认使用存储数据使用的时区，内部 feign 调用时，需要传固定值：default，代表不执行时间转换
|
showTimeZone = ZoneId.systemDefault().getId();
|
}
|
|
// 校验传入的 tz 格式是否正确
|
ZoneId.of(showTimeZone);
|
TimeZoneContext.showTimeZoneId.set(showTimeZone);
|
|
// 前端告知本地使用的时区
|
String clientTimeZone = req.getHeader("x-api-client-timezone");
|
if (StrUtil.isBlank(clientTimeZone)) {
|
clientTimeZone = ZoneId.systemDefault().getId();
|
}
|
// 校验传入的 tz 格式是否正确
|
ZoneId.of(clientTimeZone);
|
TimeZoneContext.clientTimeZoneId.set(clientTimeZone);
|
}
|
|
private boolean checkBlackRequest(HttpServletRequest req, HttpServletResponse resp, String clientIp, String userCode) {
|
String requestUri = req.getRequestURI();
|
if (requestUri.contains("riskclient/save") || requestUri.contains("demo/checkip")) {
|
return false;
|
}
|
//logger.info("---> AuthFilter.checkBlackRequest 中的 urlBuffer = {}, clientIp:{}, userId:{}", requestUri, clientIp, userId);
|
if (StrUtil.isNotBlank(userCode) && !Objects.equals(userCode, "0")) {
|
// 先处理断网逻辑
|
List<RiskClient> riskList = RiskClientUtil.getRiskInfoByUserCode(userCode, "badnetwork");
|
if (CollectionUtil.isNotEmpty(riskList)) {
|
logger.info("---> AuthFilter.checkBlackRequest 当前用户断网 requestUri = {}, clientIp:{}, userCode:{}", requestUri, clientIp, userCode);
|
// 模拟基于用户断网
|
//closeAction(requestUri, resp);
|
return true;
|
}
|
|
// 处理黑名单逻辑
|
riskList = RiskClientUtil.getRiskInfoByUserCode(userCode, "black");
|
if (CollectionUtil.isNotEmpty(riskList)) {
|
try {
|
logger.info("---> AuthFilter.checkBlackRequest 当前用户断网 requestUri = {}, clientIp:{}, userCode:{}", requestUri, clientIp, userCode);
|
resp.setCharacterEncoding(CharsetUtil.UTF_8);
|
resp.setContentType(MediaType.APPLICATION_JSON_VALUE);
|
resp.setStatus(200);
|
//req.getRequestDispatcher("/html/404").forward(req, resp); // 断网展示网页，使用 forward 请求转发
|
String responseJson = "{\"code\":1,\"msg\":\"Forbidden\"}";
|
resp.getWriter().write(responseJson);
|
} catch (Exception e) {
|
logger.error("---> AuthFilter.checkBlackRequest requestUri:{} 访问报错: ", requestUri, e);
|
}
|
return true;
|
}
|
}
|
|
// 未能基于用户来识别，则继续尝试基于 ip 判断
|
List<RiskClient> riskList = RiskClientUtil.getRiskInfoByIp(clientIp, "badnetwork");
|
if (CollectionUtil.isNotEmpty(riskList)) {
|
logger.info("---> AuthFilter.checkBlackRequest 当前IP断网 requestUri = {}, clientIp:{}", requestUri, clientIp);
|
// 模拟基于客户端ip断网
|
//closeAction(requestUri, resp);
|
return true;
|
}
|
|
// 处理黑名单逻辑
|
riskList = RiskClientUtil.getRiskInfoByIp(clientIp, "black");
|
if (CollectionUtil.isNotEmpty(riskList)) {
|
try {
|
logger.info("---> AuthFilter.checkBlackRequest 当前IP断网 requestUri = {}, clientIp:{}", requestUri, clientIp);
|
resp.setCharacterEncoding(CharsetUtil.UTF_8);
|
resp.setContentType(MediaType.APPLICATION_JSON_VALUE);
|
resp.setStatus(200);
|
//req.getRequestDispatcher("/html/404").forward(req, resp); // 断网展示网页，使用 forward 请求转发
|
String responseJson = "{\"code\":1,\"msg\":\"Forbidden\"}";
|
resp.getWriter().write(responseJson);
|
} catch (Exception e) {
|
logger.error("---> AuthFilter.checkBlackRequest requestUri:{} 访问报错: ", requestUri, e);
|
}
|
return true;
|
}
|
|
return false;
|
}
|
|
private static void closeAction(String requestUri, HttpServletResponse resp) {
|
if (requestUri.contains("!close.action")) {
|
ThreadUtils.sleep(3000);
|
resp.setCharacterEncoding(CharsetUtil.UTF_8);
|
resp.setContentType(MediaType.APPLICATION_JSON_VALUE);
|
resp.setStatus(200);
|
String responseJson = "{\"code\":1,\"msg\":\"Network Unavailable\"}";
|
try {
|
resp.getWriter().write(responseJson);
|
} catch (IOException e) {
|
throw new BusinessException(e);
|
}
|
}
|
}
|
}
|
