Aias00 opened a new issue, #6399:
URL: https://github.com/apache/shenyu/issues/6399
### Description
ShiroRealm.doGetAuthenticationInfo() fetches the full DashboardUserVO from
the database on every authenticated request, which includes the enabled field.
However, it does not check this field. As a result, a user whose account is
administratively disabled retains full access using any previously-issued JWT
until the token expires (default 24 hours).
Affected File:
shenyu-admin/src/main/java/org/apache/shenyu/admin/shiro/config/ShiroRealm.java
Proposed Change:
Add an enabled check immediately after the null check in
doGetAuthenticationInfo():
javaif (!Boolean.TRUE.equals(dashboardUserVO.getEnabled())) {
throw new AuthenticationException(
String.format("user(%s) is disabled.", userName));
}
Acceptance Criteria:
A disabled user's JWT is rejected immediately on the next request after the
account is disabled.
The fix requires no additional database queries (the enabled field is
already loaded).
Existing tests for authentication pass; a new test covers the disabled-user
case.
### Task List
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
