Преглед изворни кода

Update 优化截断token避免日志输出具体token内容,防止盗用隐患

Yue пре 1 недеља
родитељ
комит
40a0d89069

+ 7 - 5
SERVER/VberAdminPlusV3/vber-admin/src/main/java/com/vber/web/listener/UserActionListener.java

@@ -11,6 +11,7 @@ import com.vber.common.core.domain.dto.UserOnlineDTO;
 import com.vber.common.core.utils.MessageUtils;
 import com.vber.common.core.utils.ServletUtils;
 import com.vber.common.core.utils.SpringUtils;
+import com.vber.common.core.utils.StringUtils;
 import com.vber.common.core.utils.ip.AddressUtils;
 import com.vber.common.log.event.LogininforEvent;
 import com.vber.common.redis.utils.RedisUtils;
@@ -61,7 +62,8 @@ public class UserActionListener implements SaTokenListener {
             if (tokenConfig.getTimeout() == -1) {
                 RedisUtils.setCacheObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue, dto);
             } else {
-                RedisUtils.setCacheObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue, dto, Duration.ofSeconds(tokenConfig.getTimeout()));
+                RedisUtils.setCacheObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue, dto,
+                        Duration.ofSeconds(tokenConfig.getTimeout()));
             }
         });
         // 记录登录日志
@@ -74,7 +76,7 @@ public class UserActionListener implements SaTokenListener {
         SpringUtils.context().publishEvent(logininforEvent);
         // 更新登录信息
         loginService.recordLoginInfo((Long) loginParameter.getExtra(LoginHelper.USER_KEY), ip);
-        log.info("user doLogin, userId:{}, token:{}", loginId, tokenValue);
+        log.info("user doLogin, userId:{}, token:***{}", loginId, StringUtils.right(tokenValue, 8));
     }
 
     /**
@@ -83,7 +85,7 @@ public class UserActionListener implements SaTokenListener {
     @Override
     public void doLogout(String loginType, Object loginId, String tokenValue) {
         RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
-        log.info("user doLogout, userId:{}, token:{}", loginId, tokenValue);
+        log.info("user doLogout, userId:{}, token:***{}", loginId, StringUtils.right(tokenValue, 8));
     }
 
     /**
@@ -92,7 +94,7 @@ public class UserActionListener implements SaTokenListener {
     @Override
     public void doKickout(String loginType, Object loginId, String tokenValue) {
         RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
-        log.info("user doKickout, userId:{}, token:{}", loginId, tokenValue);
+        log.info("user doKickout, userId:{}, token:***{}", loginId, StringUtils.right(tokenValue, 8));
     }
 
     /**
@@ -101,7 +103,7 @@ public class UserActionListener implements SaTokenListener {
     @Override
     public void doReplaced(String loginType, Object loginId, String tokenValue) {
         RedisUtils.deleteObject(CacheConstants.ONLINE_TOKEN_KEY + tokenValue);
-        log.info("user doReplaced, userId:{}, token:{}", loginId, tokenValue);
+        log.info("user doReplaced, userId:{}, token:***{}", loginId, StringUtils.right(tokenValue, 8));
     }
 
     /**