AlexStocks commented on code in PR #978:
URL: https://github.com/apache/dubbo-go-pixiu/pull/978#discussion_r3563635442
##########
admin/controller/auth/auth.go:
##########
@@ -144,9 +155,7 @@ func (j *JWT) RefreshToken(tokenString string) (string,
error) {
jwt.TimeFunc = func() time.Time {
return time.Unix(0, 0)
}
- token, err := jwt.ParseWithClaims(tokenString, &CustomClaims{},
func(token *jwt.Token) (any, error) {
- return j.SigningKey, nil
- })
+ token, err := jwt.ParseWithClaims(tokenString, &CustomClaims{},
j.keyFunc)
Review Comment:
[P0] `RefreshToken` 在解析前把包级全局 `jwt.TimeFunc` 改成 Unix 0，但解析失败会在第 160
行直接返回，永远不会恢复为 `time.Now`；并发期间普通 `ParseToken`
也会读取这个全局值。一次畸形刷新请求即可让进程后续的过期校验持续失效，合法并发请求也可能接受已过期 Token。必须在修改后立即 `defer`
恢复，并为全局访问加同步；更安全的是不要修改全局时钟，改用 parser/claims 级方式仅忽略本次刷新所需的过期错误。请补充解析失败及并发刷新/校验测试。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
