This is an automated email from the ASF dual-hosted git repository.
zihaoxiang pushed a commit to branch dev
in repository https://gitbox.apache.org/repos/asf/dolphinscheduler.git
The following commit(s) were added to refs/heads/dev by this push:
new bf5aeb107d [Fix-16627] [dolphinscheduler-api]
LoginHandlerInterceptor.preHandle check session without expire time check
(#16989)
bf5aeb107d is described below
commit bf5aeb107d22f1ea0575b30669a10cbf6d3f0529
Author: Wenjun Ruan <[email protected]>
AuthorDate: Tue Feb 4 17:12:02 2025 +0800
[Fix-16627] [dolphinscheduler-api] LoginHandlerInterceptor.preHandle check
session without expire time check (#16989)
---
.../api/interceptor/LoginHandlerInterceptor.java | 6 ++++--
.../api/security/impl/AbstractAuthenticator.java | 6 +++++-
.../security/impl/pwd/PasswordAuthenticator.java | 4 +++-
.../api/service/impl/SessionServiceImpl.java | 2 +-
.../api/controller/LoginControllerTest.java | 21 +++++++++++++++++++++
5 files changed, 34 insertions(+), 5 deletions(-)
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/interceptor/LoginHandlerInterceptor.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/interceptor/LoginHandlerInterceptor.java
index cc1928404b..49eacaa59c 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/interceptor/LoginHandlerInterceptor.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/interceptor/LoginHandlerInterceptor.java
@@ -96,8 +96,10 @@ public class LoginHandlerInterceptor implements
HandlerInterceptor {
}
@Override
- public void postHandle(HttpServletRequest request, HttpServletResponse
response, Object handler,
- ModelAndView modelAndView) throws Exception {
+ public void postHandle(HttpServletRequest request,
+ HttpServletResponse response,
+ Object handler,
+ ModelAndView modelAndView) {
ThreadLocalContext.getTimezoneThreadLocal().remove();
int code = response.getStatus();
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/AbstractAuthenticator.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/AbstractAuthenticator.java
index 7b9c3f5a43..b840a02796 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/AbstractAuthenticator.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/AbstractAuthenticator.java
@@ -119,10 +119,14 @@ public abstract class AbstractAuthenticator implements
Authenticator {
sessionId = cookie.getValue();
}
}
- Session session = sessionService.getSession(sessionId);
+ final Session session = sessionService.getSession(sessionId);
if (session == null) {
return null;
}
+ if (sessionService.isSessionExpire(session)) {
+ sessionService.expireSession(session.getUserId());
+ return null;
+ }
// get user object from session
return userService.queryUser(session.getUserId());
}
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/pwd/PasswordAuthenticator.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/pwd/PasswordAuthenticator.java
index 86c419a605..9770041606 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/pwd/PasswordAuthenticator.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/pwd/PasswordAuthenticator.java
@@ -20,10 +20,12 @@ package org.apache.dolphinscheduler.api.security.impl.pwd;
import org.apache.dolphinscheduler.api.security.impl.AbstractAuthenticator;
import org.apache.dolphinscheduler.dao.entity.User;
+import lombok.NonNull;
+
public class PasswordAuthenticator extends AbstractAuthenticator {
@Override
- public User login(String userName, String password) {
+ public User login(@NonNull String userName, String password) {
return userService.queryUser(userName, password);
}
}
diff --git
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/SessionServiceImpl.java
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/SessionServiceImpl.java
index 79816c58d9..a3571eb19e 100644
---
a/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/SessionServiceImpl.java
+++
b/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/SessionServiceImpl.java
@@ -94,7 +94,7 @@ public class SessionServiceImpl extends BaseServiceImpl
implements SessionServic
@Override
public boolean isSessionExpire(Session session) {
- return System.currentTimeMillis() -
session.getLastLoginTime().getTime() <= Constants.SESSION_TIME_OUT * 1000;
+ return System.currentTimeMillis() -
session.getLastLoginTime().getTime() >= Constants.SESSION_TIME_OUT * 1000;
}
}
diff --git
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/LoginControllerTest.java
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/LoginControllerTest.java
index bad2825145..c954f22498 100644
---
a/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/LoginControllerTest.java
+++
b/dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/controller/LoginControllerTest.java
@@ -27,7 +27,12 @@ import org.apache.dolphinscheduler.api.enums.Status;
import org.apache.dolphinscheduler.api.utils.Result;
import org.apache.dolphinscheduler.common.constants.Constants;
import org.apache.dolphinscheduler.common.utils.JSONUtils;
+import org.apache.dolphinscheduler.dao.entity.Session;
+import org.apache.dolphinscheduler.dao.repository.SessionDao;
+import org.apache.http.HttpStatus;
+
+import java.util.Date;
import java.util.Map;
import javax.servlet.http.Cookie;
@@ -36,6 +41,7 @@ import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.MediaType;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.test.web.servlet.MvcResult;
@@ -49,6 +55,9 @@ public class LoginControllerTest extends
AbstractControllerTest {
private static final Logger logger =
LoggerFactory.getLogger(LoginControllerTest.class);
+ @Autowired
+ private SessionDao sessionDao;
+
@Test
public void testLogin() throws Exception {
MultiValueMap<String, String> paramsMap = new LinkedMultiValueMap<>();
@@ -85,6 +94,18 @@ public class LoginControllerTest extends
AbstractControllerTest {
logger.info(mvcResult.getResponse().getContentAsString());
}
+ @Test
+ void testSignOutWithExpireSession() throws Exception {
+ final Session session = sessionDao.queryById(sessionId);
+ session.setLastLoginTime(new Date(System.currentTimeMillis() -
Constants.SESSION_TIME_OUT * 1000 - 1));
+ sessionDao.updateById(session);
+
+ mockMvc.perform(post("/signOut")
+ .header("sessionId", sessionId))
+ .andExpect(status().is(HttpStatus.SC_UNAUTHORIZED))
+ .andReturn();
+ }
+
@Test
void testClearCookie() throws Exception {
MvcResult mvcResult = mockMvc.perform(delete("/cookies")
