github
/
halo
mirror of https://github.com/halo-dev/halo
1
0
Fork 0
Code Issues Releases Wiki Activity

Fix the problem of accessing logout page without authentication (#6812) 

#### What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

#### What this PR does / why we need it:

Currently, logout page is always visible for anyone whether the user is authenticated. This PR restricts the visibility of logout page to authenticated users but anonymous users.

#### Special notes for your reviewer:

```bash
> http http://localhost:8090/logout

HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: 0
Location: /login?authentication_required
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-length: 0
```

#### Does this PR introduce a user-facing change?

```release-note
修复未登录情况下依然能够访问登出页面的问题
```
pull/6813/head^2
John Niang 2024-10-10 13:43:00 +08:00 committed by GitHub
parent 9e3f77baf3
commit cae871f9e6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
application/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
View File

@ -59,8 +59,7 @@ class AuthorizationExchangeConfigurers {
"/login/**", "/login/**",
"/challenges/**", "/challenges/**",
"/password-reset/**", "/password-reset/**",
"/signup", "/signup"
"/logout"
).permitAll()); ).permitAll());
} }
@ -69,7 +68,11 @@ class AuthorizationExchangeConfigurers {
SecurityConfigurer authenticatedAuthorizationConfigurer() { SecurityConfigurer authenticatedAuthorizationConfigurer() {
// Anonymous user is not allowed // Anonymous user is not allowed
return http -> http.authorizeExchange( return http -> http.authorizeExchange(
spec -> spec.pathMatchers("/console/**", "/uc/**").authenticated() spec -> spec.pathMatchers(
"/console/**",
"/uc/**",
"/logout"
).authenticated()
); );
} }