mirror of
https://github.com/0xJacky/nginx-ui.git
synced 2026-05-09 23:39:24 +08:00
fb37c94276
- Added `InitTokenRouter` to define the `/token/short` endpoint for issuing short tokens. - Created `IssueShortToken` function to handle short token generation and response. - Updated WebSocket middleware to require short token for authentication, preventing CSWSH attacks. - Modified user store and login handling to integrate short token functionality. - Enhanced documentation to reflect changes in WebSocket security requirements.
35 lines
818 B
Go
35 lines
818 B
Go
package user
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/0xJacky/Nginx-UI/api"
|
|
"github.com/0xJacky/Nginx-UI/internal/middleware"
|
|
"github.com/0xJacky/Nginx-UI/internal/user"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/uozi-tech/cosy"
|
|
)
|
|
|
|
// IssueShortToken creates a short token for WebSocket authentication.
|
|
// Requires both JWT (via AuthRequired) and the session-binding cookie.
|
|
func IssueShortToken(c *gin.Context) {
|
|
sessionCookie, err := c.Cookie(middleware.SecureSessionCookieName)
|
|
if err != nil || sessionCookie == "" {
|
|
c.JSON(http.StatusForbidden, gin.H{
|
|
"message": "Session binding cookie required",
|
|
})
|
|
return
|
|
}
|
|
|
|
u := api.CurrentUser(c)
|
|
shortToken, err := user.GenerateShortToken(u.ID)
|
|
if err != nil {
|
|
cosy.ErrHandler(c, err)
|
|
return
|
|
}
|
|
|
|
c.JSON(http.StatusOK, gin.H{
|
|
"short_token": shortToken,
|
|
})
|
|
}
|