kevin
61189a53ec
- JWT 密钥改为环境变量/配置文件/随机生成注入，移除硬编码 - AuthMiddleware 用数据库 role 覆盖 claims，降级/禁用即时生效 - 改 role/status 时主动失效目标用户会话 - /ws 支持 JWT 认证（?token=），兼容密码认证，CheckOrigin 改同源校验 - 默认管理员改用随机密码，stdout 与文件双交付 - 登录与 WS 密码认证加限流（5次/分钟） - role 字段白名单校验（仅 admin/user） - socket/目录权限可配置（sock_mode/sock_group/sock_dir_mode），默认兼容现状 - 配置文件权限收紧 0644→0600，目录 0755→0700 - 静态文件改用 http.Dir.Open + NoRoute，移除手动路径拼接 - 隧道加 SetReadLimit(1MB) 与单用户连接数上限(3) - README 补充安全配置与生产部署说明
77 lines
1.8 KiB
Go
77 lines
1.8 KiB
Go
package vpn
|
|
|
|
import (
|
|
"encoding/json"
|
|
"time"
|
|
|
|
"lmvpn/internal/middleware"
|
|
"lmvpn/internal/model"
|
|
|
|
"github.com/gorilla/websocket"
|
|
"golang.org/x/crypto/bcrypt"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
var authLimiter = middleware.NewRateLimiter(5, time.Minute)
|
|
|
|
type authMessage struct {
|
|
Type string `json:"type"`
|
|
Username string `json:"username"`
|
|
Password string `json:"password"`
|
|
}
|
|
|
|
type authResponse struct {
|
|
Type string `json:"type"`
|
|
Message string `json:"message,omitempty"`
|
|
}
|
|
|
|
func authenticate(conn *websocket.Conn, db *gorm.DB, clientIP string) (*model.User, error) {
|
|
_, msgBytes, err := conn.ReadMessage()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var msg authMessage
|
|
if err := json.Unmarshal(msgBytes, &msg); err != nil || msg.Type != "auth" {
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "消息格式错误"})
|
|
conn.Close()
|
|
return nil, nil
|
|
}
|
|
|
|
key := clientIP + ":" + msg.Username
|
|
if !authLimiter.Allow(key) {
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "认证尝试过于频繁，请稍后再试"})
|
|
conn.Close()
|
|
return nil, nil
|
|
}
|
|
|
|
var user model.User
|
|
if err := db.Where("username = ? AND status = 1", msg.Username).First(&user).Error; err != nil {
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "用户名或密码错误"})
|
|
conn.Close()
|
|
return nil, nil
|
|
}
|
|
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(msg.Password)); err != nil {
|
|
sendJSON(conn, authResponse{Type: "auth_err", Message: "用户名或密码错误"})
|
|
conn.Close()
|
|
return nil, nil
|
|
}
|
|
|
|
resp := authResponse{Type: "auth_ok"}
|
|
if err := sendJSON(conn, resp); err != nil {
|
|
conn.Close()
|
|
return nil, nil
|
|
}
|
|
|
|
return &user, nil
|
|
}
|
|
|
|
func sendJSON(conn *websocket.Conn, v interface{}) error {
|
|
data, err := json.Marshal(v)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return conn.WriteMessage(websocket.TextMessage, data)
|
|
}
|