dromara / dromara/Sa-Token

SaTokenDubbo3ProviderFilter无法进行指定接口方法的豁免

Open
#862 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
19k
Forks
2.9k
PR merge metrics
No merged PRs in 30d

Description

### 使用版本:
1.44.0

### 报错信息:
cause: org.apache.dubbo.remoting.RemotingException: cn.dev33.satoken.exception.SameTokenInvalidException: 无效Same-Token:

### 希望结果:
对于用@SaIgnore标记了的类或者方法,能够不进行same-token校验,或者有类似的功能能够对指定的方法进行豁免

### 复现步骤:
dubbo consumer先通过@DubboReference标记的remoteLogin方法进行登录获取到token后,后续的remoteFunction会携带token进行访问,这个provider端实现的remoteLogin应该要被校验忽略,使用了@SaIgnore注解标记了但没有效果,SaTokenDubbo3ProviderFilter进行检查后肯定是没有same-token的,这时候连token都没有。所以就陷入了一个死循环,就是因为没有token才去login获取token,结果因为login的这个动作没有token而被拦截因此获取不到token

< 备注:如果复现步骤比较复杂,请将 demo 上传到 gitee 并留下地址 >

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading SaTokenDubbo3ProviderFilter and tracing how it handles the @SaIgnore annotation on the remoteLogin method or class. Reproduce the Dubbo 3 provider flow with remoteLogin followed by remoteFunction; done means the login method can run without same-token validation while subsequent protected methods still validate the token.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.