Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

本地编译测试Filter顺序问题,引起绕过认证问题 #9861

Closed
qhyjoe opened this issue Jan 17, 2023 · 0 comments · Fixed by #9871
Closed

本地编译测试Filter顺序问题,引起绕过认证问题 #9861

qhyjoe opened this issue Jan 17, 2023 · 0 comments · Fixed by #9871
Labels
kind/bug Category issues or prs related to bug. plugin
Milestone

Comments

@qhyjoe
Copy link

qhyjoe commented Jan 17, 2023

服务端版本:2.1.2
客户端版本:1.4.2
服务端配置如下:
nacos.core.auth.enable.userAgentAuthWhite=false
nacos.core.auth.server.identity.key=nacosKey
nacos.core.auth.server.identity.value=******
nacos.core.auth.enabled=true
本地测试发现,配置开启认证后,客户端不配置账号密码任然可以注册服务实例,发现是由于过滤器顺序问题引起。
com.alibaba.nacos.naming.web.DistroFilter和com.alibaba.nacos.core.auth.AuthFilter顺序配置的都是6,如果AuthFilter在DistroFilter之前执行是没有问题的,反过来就是有问题,DistroFilter代码中会转发请求并携带认证header,这样请求就会通过。

@KomachiSion KomachiSion added kind/bug Category issues or prs related to bug. plugin labels Jan 28, 2023
@KomachiSion KomachiSion added this to the 2.2.1 milestone Jan 28, 2023
KomachiSion added a commit to KomachiSion/nacos that referenced this issue Jan 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Category issues or prs related to bug. plugin
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants