SaTokenDubbo3ProviderFilter无法进行指定接口方法的豁免
- Dominant language
- Java
- Stars
- 19k
- Forks
- 2.9k
- PR merge metrics
- No merged PRs in 30d
Description
### 使用版本:
1.44.0
### 报错信息:
cause: org.apache.dubbo.remoting.RemotingException: cn.dev33.satoken.exception.SameTokenInvalidException: 无效Same-Token:
### 希望结果:
对于用@SaIgnore标记了的类或者方法,能够不进行same-token校验,或者有类似的功能能够对指定的方法进行豁免
### 复现步骤:
dubbo consumer先通过@DubboReference标记的remoteLogin方法进行登录获取到token后,后续的remoteFunction会携带token进行访问,这个provider端实现的remoteLogin应该要被校验忽略,使用了@SaIgnore注解标记了但没有效果,SaTokenDubbo3ProviderFilter进行检查后肯定是没有same-token的,这时候连token都没有。所以就陷入了一个死循环,就是因为没有token才去login获取token,结果因为login的这个动作没有token而被拦截因此获取不到token
< 备注:如果复现步骤比较复杂,请将 demo 上传到 gitee 并留下地址 >
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading SaTokenDubbo3ProviderFilter and tracing how it handles the @SaIgnore annotation on the remoteLogin method or class. Reproduce the Dubbo 3 provider flow with remoteLogin followed by remoteFunction; done means the login method can run without same-token validation while subsequent protected methods still validate the token.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100