mirror/MCSManager
2
0
Fork 1
mirror of https://github.com/MCSManager/MCSManager.git synced 2025-03-01 16:16:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

修改 token 验证机制

Browse Source
This commit is contained in:
suwings 2018-04-03 08:36:45 +08:00
parent a2b82aad2f
commit fadac07462
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
helper/Permission.js
View File

@ -40,6 +40,9 @@ module.exports.needLogin = (req, res, trueCallBack, falseCallBack) => {
const counter = require('../core/counter');
module.exports.isMaster = (wsSession, notPermssionCounter) => {
if (!wsSession.username || typeof wsSession.username != 'string') {
return false;
}
let username = wsSession.username.trim() || '';
if (username) {
if (username.substr(0, 1) == '#') {

10
route/token.js
View File

@ -4,17 +4,25 @@ const response = require('../helper/Response');
const permssion = require('../helper/Permission');
const VarCenter = require('../model/VarCenter');
const counter = require('../core/counter');
const UUID = require('uuid');
//Token
router.get('/', function (req, res) {
//ajax 会受到浏览器跨域限制，姑不能对其进行csrf攻击获取token，尽管它可伪造。
if (req.xhr) {
var UUID = require('uuid');
if (!req.session['token']) {
//强化 token
req.session['token'] = permssion.randomString(6) + UUID.v4().replace(/-/igm, "");
}
let username = req.session['username'] || undefined;
if (username == undefined || username.trim() == '') {
//用户未登录，返回一个随机的 token 给它，并且这个 token 与正常的 token 几乎一模一样
response.returnMsg(res, 'token', {
token: permssion.randomString(6) + UUID.v4().replace(/-/igm, ""),
username: username,
});
return;
}
VarCenter.get('user_token')[req.session['token']] = username;
response.returnMsg(res, 'token', {
token: req.session['token'],