lxm_library_java/JustAuth
1
0
Fork 0
mirror of synced 2026-04-20 16:38:38 +08:00
Code Issues Projects Releases Wiki Activity

♻️ rename

Browse Source
This commit is contained in:
yadong.zhang
2019-07-16 17:59:36 +08:00
parent 65334d0f3f
commit 8a4861075e
50 changed files with 210 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/main/java/me/zhyd/oauth/utils/AuthChecker.java
View File

@@ -3,7 +3,7 @@ package me.zhyd.oauth.utils;
import me.zhyd.oauth.config.AuthConfig;
import me.zhyd.oauth.config.AuthSource;
import me.zhyd.oauth.exception.AuthException;
import me.zhyd.oauth.request.ResponseStatus;
import me.zhyd.oauth.model.AuthResponseStatus;
/**
* 授权配置类的校验器
@@ -38,15 +38,15 @@ public class AuthChecker {
public static void checkConfig(AuthConfig config, AuthSource source) {
String redirectUri = config.getRedirectUri();
if (!GlobalAuthUtil.isHttpProtocol(redirectUri) && !GlobalAuthUtil.isHttpsProtocol(redirectUri)) {
throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI);
}
// facebook的回调地址必须为https的链接
if (AuthSource.FACEBOOK == source && !GlobalAuthUtil.isHttpsProtocol(redirectUri)) {
throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI);
}
// 支付宝在创建回调地址时，不允许使用localhost或者127.0.0.1
if (AuthSource.ALIPAY == source && GlobalAuthUtil.isLocalHost(redirectUri)) {
throw new AuthException(ResponseStatus.ILLEGAL_REDIRECT_URI);
throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI);
}
}
@@ -57,7 +57,7 @@ public class AuthChecker {
*/
public static void checkCode(String code) {
if (StringUtils.isEmpty(code)) {
throw new AuthException(ResponseStatus.ILLEGAL_CODE);
throw new AuthException(AuthResponseStatus.ILLEGAL_CODE);
}
}
@@ -74,11 +74,11 @@ public class AuthChecker {
}
// 如果授权之前使用了state，但是回调时未返回state，则表示当前请求为非法的请求，可能正在被CSRF攻击
if (StringUtils.isEmpty(newState)) {
throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
throw new AuthException(AuthResponseStatus.ILLEGAL_REQUEST);
}
// 如果授权前后的state不一致，则表示当前请求为非法的请求，新的state可能为伪造
if (!newState.equals(originalState)) {
throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
throw new AuthException(AuthResponseStatus.ILLEGAL_REQUEST);
}
}
}

4
src/main/java/me/zhyd/oauth/utils/AuthState.java
View File

@@ -5,7 +5,7 @@ import cn.hutool.core.util.RandomUtil;
import com.alibaba.fastjson.JSON;
import lombok.extern.slf4j.Slf4j;
import me.zhyd.oauth.exception.AuthException;
import me.zhyd.oauth.request.ResponseStatus;
import me.zhyd.oauth.model.AuthResponseStatus;
import java.nio.charset.Charset;
import java.util.concurrent.ConcurrentHashMap;
@@ -113,7 +113,7 @@ public class AuthState {
String noneSourceState = decodedState.substring(source.length() + 1);
if (!noneSourceState.startsWith(currentIp)) {
// ip不相同，可能为非法的请求
throw new AuthException(ResponseStatus.ILLEGAL_REQUEST);
throw new AuthException(AuthResponseStatus.ILLEGAL_REQUEST);
}
String body = noneSourceState.substring(currentIp.length() + 1);
log.debug("body is [{}]", body);