hhyykk/RuoYi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

动态生成密匙，防止默认密钥泄露

Browse Source
This commit is contained in:
RuoYi
2021-05-15 21:54:32 +08:00
parent b9b2b866b2
commit 4d55f5df17
3 changed files with 38 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ruoyi-framework/src/main/java/com/ruoyi/framework/config/ShiroConfig.java
View File

@ -8,7 +8,6 @@ import java.util.Map;
import javax.servlet.Filter;
import org.apache.commons.io.IOUtils;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.config.ConfigurationException;
import org.apache.shiro.io.ResourceUtils;
import org.apache.shiro.mgt.SecurityManager;
@ -23,6 +22,7 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import com.ruoyi.common.constant.Constants;
import com.ruoyi.common.utils.StringUtils;
import com.ruoyi.common.utils.security.CipherUtils;
import com.ruoyi.common.utils.spring.SpringUtils;
import com.ruoyi.framework.shiro.realm.UserRealm;
import com.ruoyi.framework.shiro.session.OnlineSessionDAO;
@ -104,12 +104,6 @@ public class ShiroConfig
@Value("${shiro.cookie.maxAge}")
private int maxAge;
/**
* 设置cipherKey密钥
*/
@Value("${shiro.cookie.cipherKey}")
private String cipherKey;
/**
* 登录地址
*/
@ -357,7 +351,7 @@ public class ShiroConfig
{
CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
cookieRememberMeManager.setCookie(rememberMeCookie());
cookieRememberMeManager.setCipherKey(Base64.decode(cipherKey));
cookieRememberMeManager.setCipherKey(CipherUtils.generateNewKey(128, "AES").getEncoded());
return cookieRememberMeManager;
}