修复:解决管理员token访问用户接口401问题
- 修改AuthInterceptor使用JwtUtil直接验证token,支持管理员和普通用户 - 移除AuthService的Redis检查依赖,使用JWT本身的验证机制 - 添加用户类型(userType)信息到请求属性中 - 完善用户上下文设置和清理逻辑 - 添加详细的调试日志 修复内容: 1. 统一token验证:管理员和普通用户token都通过JwtUtil验证 2. 移除权限限制:当前阶段不限制token类型对接口的访问权限 3. 保留扩展性:userType字段为后期权限控制预留配置 4. 验证通过:管理员登录后可以正常访问所有接口
This commit is contained in:
@@ -1,6 +1,10 @@
|
|||||||
package com.emotion.interceptor;
|
package com.emotion.interceptor;
|
||||||
|
|
||||||
import com.emotion.service.AuthService;
|
import com.emotion.service.AuthService;
|
||||||
|
import com.emotion.util.JwtUtil;
|
||||||
|
import com.emotion.util.UserContextHolder;
|
||||||
|
import org.slf4j.Logger;
|
||||||
|
import org.slf4j.LoggerFactory;
|
||||||
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.beans.factory.annotation.Autowired;
|
||||||
import org.springframework.stereotype.Component;
|
import org.springframework.stereotype.Component;
|
||||||
import org.springframework.web.servlet.HandlerInterceptor;
|
import org.springframework.web.servlet.HandlerInterceptor;
|
||||||
@@ -17,9 +21,14 @@ import javax.servlet.http.HttpServletResponse;
|
|||||||
@Component
|
@Component
|
||||||
public class AuthInterceptor implements HandlerInterceptor {
|
public class AuthInterceptor implements HandlerInterceptor {
|
||||||
|
|
||||||
|
private static final Logger log = LoggerFactory.getLogger(AuthInterceptor.class);
|
||||||
|
|
||||||
@Autowired
|
@Autowired
|
||||||
private AuthService authService;
|
private AuthService authService;
|
||||||
|
|
||||||
|
@Autowired
|
||||||
|
private JwtUtil jwtUtil;
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
|
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
|
||||||
// 跨域预检请求直接放行
|
// 跨域预检请求直接放行
|
||||||
@@ -44,24 +53,51 @@ public class AuthInterceptor implements HandlerInterceptor {
|
|||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
// 验证访问令牌
|
// 验证访问令牌 - 使用JwtUtil直接验证,支持管理员和普通用户token
|
||||||
if (!authService.validateToken(token)) {
|
if (!jwtUtil.validateToken(token)) {
|
||||||
|
log.warn("Token验证失败: {}", requestURI);
|
||||||
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||||
response.setContentType("application/json;charset=UTF-8");
|
response.setContentType("application/json;charset=UTF-8");
|
||||||
response.getWriter().write("{\"code\":401,\"message\":\"访问令牌无效或已过期\",\"data\":null}");
|
response.getWriter().write("{\"code\":401,\"message\":\"访问令牌无效或已过期\",\"data\":null}");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 从token中获取用户信息
|
||||||
|
String userId = jwtUtil.getUserIdFromToken(token);
|
||||||
|
String username = jwtUtil.getUsernameFromToken(token);
|
||||||
|
String userType = jwtUtil.getUserTypeFromToken(token);
|
||||||
|
|
||||||
|
if (userId == null) {
|
||||||
|
log.warn("无法从Token获取用户ID: {}", requestURI);
|
||||||
|
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
|
||||||
|
response.setContentType("application/json;charset=UTF-8");
|
||||||
|
response.getWriter().write("{\"code\":401,\"message\":\"访问令牌无效\",\"data\":null}");
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
// 将用户信息存储到请求属性中,供后续使用
|
// 将用户信息存储到请求属性中,供后续使用
|
||||||
String userId = authService.getUserIdFromToken(token);
|
|
||||||
String username = authService.getUsernameFromToken(token);
|
|
||||||
request.setAttribute("userId", userId);
|
request.setAttribute("userId", userId);
|
||||||
request.setAttribute("username", username);
|
request.setAttribute("username", username);
|
||||||
request.setAttribute("token", token);
|
request.setAttribute("token", token);
|
||||||
|
request.setAttribute("userType", userType);
|
||||||
|
|
||||||
|
// 设置用户上下文
|
||||||
|
UserContextHolder.setCurrentUserId(userId);
|
||||||
|
UserContextHolder.setCurrentUsername(username);
|
||||||
|
UserContextHolder.setCurrentToken(token);
|
||||||
|
|
||||||
|
log.debug("Token验证成功: userId={}, username={}, userType={}, uri={}",
|
||||||
|
userId, username, userType, requestURI);
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
|
||||||
|
UserContextHolder.clear();
|
||||||
|
log.debug("请求完成,已清除用户上下文");
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* 检查是否为白名单路径
|
* 检查是否为白名单路径
|
||||||
*/
|
*/
|
||||||
|
|||||||
Reference in New Issue
Block a user