Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: implement persistent token based remember me mechanism #6131

Merged
merged 6 commits into from
Jun 26, 2024

Conversation

guqing
Copy link
Member

@guqing guqing commented Jun 24, 2024

What type of PR is this?

/kind feature
/area core
/milestone 2.17.x

What this PR does / why we need it:

新增基于持久化 Token 的 RememberMe 机制

本次更新引入了一种新的 RememberMe 机制,该机制基于持久化 Token,以增强安全性和管理灵活性。在此之前,RememberMe 功能通过以下方式生成 Token,并将其作为 cookie 发送回客户端:

 username + ":" + expiryTime + ":" + algorithmName + ":"
   + algorithmHex(username + ":" + expiryTime + ":" + password + ":" + key)

此方法的优点在于无需存储 Token 就可以进行验证,并且用户密码的更改会自动使 Token 失效。然而,它的主要缺点是缺乏管理能力,例如无法手动撤销 Token。

鉴于最新的设备管理需求(见 PR #6100),我们需要一种支持设备撤销(revoke)的机制。因此,我们采用了持久化 Token 的方式,并通过随机生成的方法来提高安全性,而不将用户名和密码直接签名在 Token 中。新的 Token 格式如下:

base64(tokenValue:series)

此更改将为系统带来更高的安全保障和更灵活的管理选项,特别是在需要高度控制和监管设备访问时。

Does this PR introduce a user-facing change?

引入基于持久化 Token 的新 RememberMe 机制以增强安全性和管理灵活性,升级后需要重新登录

@f2c-ci-robot f2c-ci-robot bot added kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Jun 24, 2024
@f2c-ci-robot f2c-ci-robot bot added this to the 2.17.x milestone Jun 24, 2024
@f2c-ci-robot f2c-ci-robot bot added the area/core Issues or PRs related to the Halo Core label Jun 24, 2024
@f2c-ci-robot f2c-ci-robot bot requested review from LIlGG and ruibaby June 24, 2024 09:26
Copy link

codecov bot commented Jun 24, 2024

Codecov Report

Attention: Patch coverage is 49.65986% with 74 lines in your changes missing coverage. Please review.

Project coverage is 55.04%. Comparing base (5fdf6c0) to head (774faad).
Report is 267 commits behind head on main.

Files Patch % Lines
...berme/PersistentRememberMeTokenRepositoryImpl.java 2.94% 33 Missing ⚠️
...uthentication/rememberme/RememberTokenCleaner.java 23.07% 10 Missing ⚠️
...a/run/halo/app/core/extension/RememberMeToken.java 0.00% 8 Missing ⚠️
...ation/rememberme/TokenBasedRememberMeServices.java 11.11% 8 Missing ⚠️
...mberme/PersistentTokenBasedRememberMeServices.java 89.47% 5 Missing and 1 partial ⚠️
...un/halo/app/security/LogoutSecurityConfigurer.java 63.63% 3 Missing and 1 partial ⚠️
...hentication/rememberme/RememberMeTokenRevoker.java 25.00% 3 Missing ⚠️
...ain/java/run/halo/app/infra/SchemeInitializer.java 81.81% 2 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main    #6131      +/-   ##
============================================
- Coverage     56.91%   55.04%   -1.88%     
- Complexity     3319     3490     +171     
============================================
  Files           587      635      +48     
  Lines         18968    21388    +2420     
  Branches       1401     1496      +95     
============================================
+ Hits          10795    11772     +977     
- Misses         7594     9010    +1416     
- Partials        579      606      +27     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Member

@ruibaby ruibaby left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@f2c-ci-robot f2c-ci-robot bot added the lgtm Indicates that a PR is ready to be merged. label Jun 25, 2024
Copy link
Member

@JohnNiang JohnNiang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. 建议添加一些必要的测试。
  2. 如果引用了其他代码,建议添加对应的引用,以便后期维护。

@f2c-ci-robot f2c-ci-robot bot removed the lgtm Indicates that a PR is ready to be merged. label Jun 25, 2024
@guqing
Copy link
Member Author

guqing commented Jun 25, 2024

  1. 建议添加一些必要的测试。
  2. 如果引用了其他代码,建议添加对应的引用,以便后期维护。

Done

@guqing guqing requested a review from JohnNiang June 25, 2024 06:36
@guqing guqing requested a review from JohnNiang June 26, 2024 07:14
Copy link
Member

@JohnNiang JohnNiang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@f2c-ci-robot f2c-ci-robot bot added the lgtm Indicates that a PR is ready to be merged. label Jun 26, 2024
Copy link

f2c-ci-robot bot commented Jun 26, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JohnNiang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@f2c-ci-robot f2c-ci-robot bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 26, 2024
@f2c-ci-robot f2c-ci-robot bot merged commit ae6724a into halo-dev:main Jun 26, 2024
7 checks passed
@ruibaby ruibaby modified the milestones: 2.17.x, 2.17.0 Jun 26, 2024
@guqing guqing deleted the refactor/remember-me branch July 17, 2024 10:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/core Issues or PRs related to the Halo Core kind/feature Categorizes issue or PR as related to a new feature. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants