chiyi
a414385802
The server session slides its TTL on use but the browser cookie's Max-Age was frozen at login, so it lapsed mid-session and broke cookie-only auth (private image <img>/download loads returned 401) while the SPA still looked logged in via its Bearer token. Re-issue the cookie with a fresh Max-Age whenever an authenticated request carried it.
91 lines
2.6 KiB
Go
91 lines
2.6 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"backend/internal/config"
|
|
"backend/internal/service"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
const currentUserKey = "current_user"
|
|
const currentSessionKey = "current_session"
|
|
|
|
func RequireSession(auth *service.AuthService, cfg *config.Config) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
cookieToken := readCookie(c, cfg.SessionCookieName)
|
|
user, session, err := auth.CurrentUserFromRequest(
|
|
c.Request.Context(),
|
|
c.GetHeader("Authorization"),
|
|
cookieToken,
|
|
)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"detail": "failed to validate session"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
if user == nil || session == nil {
|
|
c.JSON(http.StatusUnauthorized, gin.H{"detail": "未登录或会话已过期"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
refreshSessionCookie(c, cfg, cookieToken)
|
|
c.Set(currentUserKey, user)
|
|
c.Set(currentSessionKey, session)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
func RequireAdminSession(auth *service.AuthService, cfg *config.Config) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
cookieToken := readCookie(c, cfg.SessionCookieName)
|
|
user, session, err := auth.CurrentUserFromRequest(
|
|
c.Request.Context(),
|
|
c.GetHeader("Authorization"),
|
|
cookieToken,
|
|
)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"detail": "failed to validate session"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
if user == nil || session == nil {
|
|
c.JSON(http.StatusUnauthorized, gin.H{"detail": "未登录或会话已过期"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
if user.Role != "admin" {
|
|
c.JSON(http.StatusForbidden, gin.H{"detail": "需要管理员权限"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
refreshSessionCookie(c, cfg, cookieToken)
|
|
c.Set(currentUserKey, user)
|
|
c.Set(currentSessionKey, session)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// refreshSessionCookie rolls the browser session cookie forward on each
|
|
// authenticated request that carried it. The server-side session already slides
|
|
// its TTL on use, but the cookie's Max-Age was frozen at login — so it would
|
|
// lapse mid-session and break cookie-only auth (e.g. <img> loads of private
|
|
// images) even while the SPA still looks logged in via its Bearer token. Only
|
|
// refresh when the request actually presented the cookie (a pure Bearer/API-key
|
|
// caller has none to roll).
|
|
func refreshSessionCookie(c *gin.Context, cfg *config.Config, cookieToken string) {
|
|
if cookieToken == "" {
|
|
return
|
|
}
|
|
c.SetSameSite(http.SameSiteLaxMode)
|
|
c.SetCookie(cfg.SessionCookieName, cookieToken, int(cfg.SessionTTL.Seconds()), "/", "", cfg.CookieSecure, true)
|
|
}
|
|
|
|
func readCookie(c *gin.Context, name string) string {
|
|
v, err := c.Cookie(name)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return v
|
|
}
|