code-image-backup-public/fastbee
1
0
Fork 0
mirror of https://gitee.com/beecue/fastbee.git synced 2026-11-07 01:18:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(安全): MQTT认证回调强制校验登录态并外置JWT密钥

Browse Source 
修复 #31：/iot/tool/mqtt/auth 与 /authv5 对 web/phone 客户端仅验签名即放行，
现要求 JWT 有效且 Redis 存在活跃会话、用户状态正常（与内置 broker 一致），
伪造 token 无会话即被拒；token.secret 支持经 TOKEN_SECRET 注入唯一值。
This commit is contained in:
gx_ma
2026-11-03 16:42:58 +08:00
parent 527f996872
commit 37d6781e6a
2 changed files with 36 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
springboot/fastbee-admin/src/main/resources/application.yml
View File

@@ -77,7 +77,7 @@ user:
# token配置
token:
header: Authorization # 令牌自定义标识
secret: abcdefghijklfastbeesmartrstuvwxyz # 令牌密钥
secret: ${TOKEN_SECRET:abcdefghijklfastbeesmartrstuvwxyz} # 令牌密钥（生产请通过环境变量 TOKEN_SECRET 注入唯一高强度值）
expireTime: 1440 # 令牌有效期（默认30分钟）1440为一天
# mybatis-plus配置