-
-
Notifications
You must be signed in to change notification settings - Fork 9.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add device management mechanism #6100
Conversation
Hi @ruibaby , 需要在个人中心增加设备管理的入口,帮忙补充一下 UI 部分 |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6100 +/- ##
============================================
- Coverage 56.91% 54.59% -2.32%
- Complexity 3319 3507 +188
============================================
Files 587 643 +56
Lines 18968 21713 +2745
Branches 1401 1516 +115
============================================
+ Hits 10795 11855 +1060
- Misses 7594 9247 +1653
- Partials 579 611 +32 ☔ View full report in Codecov by Sentry. |
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Done |
c38e427
to
68607ea
Compare
application/src/main/java/run/halo/app/security/device/DeviceEndpoint.java
Outdated
Show resolved
Hide resolved
#### What type of PR is this? /kind feature /area core /milestone 2.17.x #### What this PR does / why we need it: 新增基于持久化 Token 的 RememberMe 机制 本次更新引入了一种新的 RememberMe 机制,该机制基于持久化 Token,以增强安全性和管理灵活性。在此之前,RememberMe 功能通过以下方式生成 Token,并将其作为 cookie 发送回客户端: ``` username + ":" + expiryTime + ":" + algorithmName + ":" + algorithmHex(username + ":" + expiryTime + ":" + password + ":" + key) ``` 此方法的优点在于无需存储 Token 就可以进行验证,并且用户密码的更改会自动使 Token 失效。然而,它的主要缺点是缺乏管理能力,例如无法手动撤销 Token。 鉴于最新的设备管理需求(见 PR #6100),我们需要一种支持设备撤销(revoke)的机制。因此,我们采用了持久化 Token 的方式,并通过随机生成的方法来提高安全性,而不将用户名和密码直接签名在 Token 中。新的 Token 格式如下: ``` base64(tokenValue:series) ``` 此更改将为系统带来更高的安全保障和更灵活的管理选项,特别是在需要高度控制和监管设备访问时。 #### Does this PR introduce a user-facing change? ```release-note 引入基于持久化 Token 的新 RememberMe 机制以增强安全性和管理灵活性,升级后需要重新登录 ```
@ruibaby 设备管理页面需要处理一下空状态 |
What type of PR is this?
/kind feature
/area core
/milestone 2.17.x
What this PR does / why we need it:
新增设备管理功能,实现机制:
Which issue(s) this PR fixes:
Fixes #6023
Does this PR introduce a user-facing change?