scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-12 23:01:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(auth): avoid extra session rotation after oauth success

Browse source
This commit is contained in:
dongmucat 2026-04-07 15:22:29 +08:00
parent 8cb783406d
commit 0fd59feca7
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginSuccessHandler.java
View file

@ -35,7 +35,7 @@ public class OAuth2LoginSuccessHandler extends SavedRequestAwareAuthenticationSu
if (authentication.getPrincipal() instanceof OAuth2User oAuth2User) {
PlatformPrincipal principal = (PlatformPrincipal) oAuth2User.getAttributes().get("platformPrincipal");
if (principal != null) {
platformSessionService.attachToAuthenticatedSession(principal, authentication, request, true);
platformSessionService.attachToAuthenticatedSession(principal, authentication, request);
}
}
String returnTo = oauthLoginFlowService.consumeReturnTo(request.getSession(false));

9
server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/oauth/OAuth2LoginHandlersTest.java
View file

@ -6,6 +6,7 @@ import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
import org.springframework.security.oauth2.core.OAuth2Error;
import org.springframework.security.oauth2.core.user.DefaultOAuth2User;
@ -52,11 +53,15 @@ class OAuth2LoginHandlersTest {
handler.onAuthenticationSuccess(request, response, authentication);
SecurityContext securityContext = (SecurityContext) session.getAttribute(
HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY
);
assertThat(response.getRedirectedUrl()).isEqualTo("/dashboard/publish");
assertThat(request.getSession(false).getId()).isNotEqualTo(originalSessionId);
assertThat(request.getSession(false).getId()).isEqualTo(originalSessionId);
assertThat(session.getAttribute(OAuthLoginRedirectSupport.SESSION_RETURN_TO_ATTRIBUTE)).isNull();
assertThat(session.getAttribute("platformPrincipal")).isEqualTo(principal);
assertThat(session.getAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY)).isNotNull();
assertThat(securityContext).isNotNull();
assertThat(securityContext.getAuthentication()).isSameAs(authentication);
}
@Test