ACL check auth bugs when http method is post or put , which the params can not get from request.getParams() method
- Dominant language
- Java
- Stars
- 23.1k
- Forks
- 8.1k
- PR merge metrics
- No merged PRs in 30d
Description
## Issue Description
thanks for #1042 contribute 👍 , which provide the @AuthAction to solve the privilege of method ; but when the http params path through http body , the com.alibaba.csp.sentinel.dashboard.auth.AuthorizationInterceptor current is not ok to check auth correctly.
Type: *bug report*
### Describe what happened
I created my own AuthService , and extend auth mehod as my own demand , it works . 😄 but when the http method is post ,put , params path through http body , it not works . such an /v1/flow/rule , /paramFlow/rule and so on.
### Describe what you expected to happen
check auth correctly .
### How to reproduce it (as minimally and precisely as possible)
1. change com.alibaba.csp.sentinel.dashboard.auth.SimpleWebAuthServiceImpl.SimpleWebAuthUserImpl#authTarget code
. add the below code
``` java
//target is the app name , this method to check the app has the PrivilegeType by your own demand.
//when the target is null , return false to deny
if( null == target){
return false;
}
```
2. start or debug DashboardApplication ;
3. find one resource and add a rule ; which method is /v1/flow/rule . the result is "Permission denied" .
### Tell us your environment
jdk 1.8 ,the master branch , the release-1.7 branch is the same result .
### Anything else we need to know?
none .
Contributor guide
Research direction
Start in com.alibaba.csp.sentinel.dashboard.auth.AuthorizationInterceptor and inspect how it obtains parameters for POST and PUT requests before calling SimpleWebAuthServiceImpl.SimpleWebAuthUserImpl#authTarget. Reproduce the failure by running DashboardApplication and adding a rule through /v1/flow/rule; done means authorization succeeds when parameters are sent in the HTTP body.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authorization, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100