feat: csrf, two tokens verify #5692
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Preview sandbox Image: |
Preview fastgpt Image: |
fishwww-ww
force-pushed
the
feat/twoTokens
branch
from
e7d6534 to
151237e
Compare
Preview mcp_server Image: |
FinleyGe
requested changes
Sep 25, 2025
| @@ -0,0 +1,32 @@ | |||
| import type { NextApiRequest, NextApiResponse } from 'next'; | |||
| import { verifyCsrfToken } from '../../support/permission/auth/common'; | |||
| import { generateCsrfToken } from '../../../../projects/app/src/web/support/user/api'; | |||
There was a problem hiding this comment.
verifyCsrfToken 和 generateCsrfToken 应该放在一个模块里面
There was a problem hiding this comment.
前端检测到cookie即将过期, 要主动请求generateCsrfToken, 所以generateCsrfToken放在了api模块, 便于请求; verifyCsrfToken则放在中间件模块用于验证CsrfToken
|
|
||
| try { | ||
| const csrfToken = await getCsrfTokenFromRequest(req); | ||
| verifyCsrfToken(csrfToken || ''); |
| }; | ||
|
|
||
| const isTokenValid = (expiresAt: number): boolean => { | ||
| const currentTime = Math.floor(Date.now() / 1000); |
There was a problem hiding this comment.
怎么还 /1000，直接比较 timestamp 不就行了吗
There was a problem hiding this comment.
jwt标准是用秒级时间戳来生成签名, 这里 /1000 是为与jwt的秒级别统一
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.