ruby-on-rails 带门卫授权的安全行动电缆

xqkwcwgp 于 2023-01-14 发布在 Ruby

关注(0)|答案(1)|浏览(172)

我正在处理ActionCable，并在我的rails应用程序中实现了Doorkeeper授权。
我想使用Doorkeeper::AccessToken和ActionCable来实现authenticate我的客户端
下面是我现在的认证方式：

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user
    identified_by :room_id

    def connect
      self.current_user = find_verified_user
      self.room_id = @user.ac_channel_room
    end

    def disconnect
      # When user will disconnect action cable, this method call will be executed.
    end

    private

    def find_verified_user 
      check_access_token
      @user = User.find_by_id(@resource_owner_id) if @resource_owner_id
      reject_unauthorized_connection unless @user
    end

    def check_access_token
      # Check provided token is valid or not
      params = request.query_parameters
      @access_token ||= Doorkeeper::AccessToken.by_token(params[:access_token])
      @resource_owner_id = @access_token&.resource_owner_id
    end
  end
end

问题是这也允许体验访问令牌。
救命啊!

ruby-on-rails

来源：https://stackoverflow.com/questions/75095577/secure-action-cable-with-doorkeeper-authorisation

1条答案

按热度按时间

oiopk7p51#

您的问题将允许与过期的Doorkeeper::AccessToken对象进行操作电缆连接。
解决方案如下：

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = authenticate!
    end

    protected

    def authenticate!
      reject_unauthorized_connection unless doorkeeper_token&.acceptable?(@_doorkeeper_scopes)

      # this will still allow expired tokens
      # you will need to check if token is valid with something like
      # doorkeeper_token&.acceptable?(@_doorkeeper_scopes)

      user = User.find_by(id: doorkeeper_token.try(:resource_owner_id))

      user || reject_unauthorized_connection
    end

    def doorkeeper_token
      ::Doorkeeper.authenticate(request)
    end
  end
end

# ...

class SomeChannel < ApplicationCable::Channel
  def subscribed
     reject unless current_user
     stream_from 'some'
  end
end

赞(0）回复(0）举报 2023-01-14

我来回答

ruby-on-rails 带门卫授权的安全行动电缆

1条答案

相关问题

热门标签

最新问答