wanglei/AuthPlatform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改jwt接口防护代码，去掉不需要的代码

Browse Source
This commit is contained in:
wanglei 2025-11-01 08:20:23 +08:00
parent 70b308f041
commit fb068ead3e
1 changed files with 3 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/auth/jwt-auth.lua
View File

@ -7,31 +7,6 @@ ngx.log(ngx.INFO, auth_header)
----定义响应数据 ----定义响应数据
local response = {} local response = {}
----如果请求头中没有令牌，则直接返回401 ----如果请求头中没有令牌，则直接返回401
--if auth_header == nil then
-- ngx.log(ngx.WARN, "No Authorization header")
-- ngx.exit(ngx.HTTP_UNAUTHORIZED)
--end
--
--ngx.log(ngx.INFO, "Authorization: " .. auth_header)
--
---- require Bearer token
--local _, _, token = string.find(auth_header, "Bearer%s+(.+)")
--
--if token == nil then
-- ngx.log(ngx.WARN, "Missing token")
-- ngx.exit(ngx.HTTP_UNAUTHORIZED)
--end
--ngx.log(ngx.INFO, "Token: " .. token)
--local jwt_obj = jwt:verify(ngx.decode_base64(secret), token)
--if jwt_obj.verified == false then
-- ngx.log(ngx.WARN, "Invalid token: ".. jwt_obj.reason)
-- ngx.status = ngx.HTTP_UNAUTHORIZED
-- ngx.header.content_type = "application/json; charset=utf-8"
-- ngx.say(cjson.encode(jwt_obj))
-- ngx.exit(ngx.HTTP_UNAUTHORIZED)
--end
--ngx.log(ngx.INFO, "JWT: " .. cjson.encode(jwt_obj))
if auth_header == nil or auth_header == "" then if auth_header == nil or auth_header == "" then
ngx.log(ngx.WARN, "没有找到令牌数据") ngx.log(ngx.WARN, "没有找到令牌数据")
response["code"] = ngx.HTTP_UNAUTHORIZED response["code"] = ngx.HTTP_UNAUTHORIZED
@ -55,6 +30,7 @@ if token == nil then
ngx.exit(ngx.HTTP_UNAUTHORIZED) ngx.exit(ngx.HTTP_UNAUTHORIZED)
end end
--]] --]]
--校验令牌 --校验令牌
local jwt_obj = jwt:verify(conf.secret_key, auth_header) local jwt_obj = jwt:verify(conf.secret_key, auth_header)
--如果校验结果中的verified==false，则表示令牌无效 --如果校验结果中的verified==false，则表示令牌无效
@ -67,6 +43,7 @@ if jwt_obj.verified == false then
ngx.body = response ngx.body = response
ngx.exit(ngx.HTTP_UNAUTHORIZED) ngx.exit(ngx.HTTP_UNAUTHORIZED)
end end
--判断token是否超时 --判断token是否超时
if jwt_obj.payload.exp and os.time() > jwt_obj.payload.exp then if jwt_obj.payload.exp and os.time() > jwt_obj.payload.exp then
ngx.log(ngx.WARN, "token timeout ".. jwt_obj.reason) ngx.log(ngx.WARN, "token timeout ".. jwt_obj.reason)
@ -77,5 +54,6 @@ if jwt_obj.payload.exp and os.time() > jwt_obj.payload.exp then
ngx.body = response ngx.body = response
ngx.exit(ngx.HTTP_UNAUTHORIZED) ngx.exit(ngx.HTTP_UNAUTHORIZED)
end end
--全部校验完成后，说明令牌有效，返回令牌数据 --全部校验完成后，说明令牌有效，返回令牌数据
ngx.log(ngx.INFO, "令牌校验通过 JWT: " .. cjson.encode(jwt_obj)) ngx.log(ngx.INFO, "令牌校验通过 JWT: " .. cjson.encode(jwt_obj))