[dubbo-8601] Support Dynamic Token And add BroadCastTest#9520
[dubbo-8601] Support Dynamic Token And add BroadCastTest#9520kaori-seasons wants to merge 2 commits intoapache:3.0from
Conversation
Codecov Report
@@ Coverage Diff @@
## 3.0 #9520 +/- ##
============================================
- Coverage 65.67% 65.64% -0.03%
Complexity 297 297
============================================
Files 1180 1180
Lines 51584 51585 +1
Branches 7796 7797 +1
============================================
- Hits 33877 33865 -12
- Misses 14046 14054 +8
- Partials 3661 3666 +5
Continue to review full report at Codecov.
|
| @Test | ||
| public void testFailoverInvokerSelect(){ | ||
| given(dic.list(invocation)).willReturn(Arrays.asList(invoker1, invoker2, invoker3, invoker4)); | ||
| //取得当前调用链的所有invoker，逐个判断调用是否成功 |
| } | ||
|
|
||
|
|
||
| //设置一个注册中心地址，便于consumer本地进行远程调用测试 |
| throw new RpcException("Invalid token! Forbid invoke remote service " + serviceType + " method " + inv.getMethodName() + | ||
| "() from consumer " + RpcContext.getServiceContext().getRemoteHost() + " to provider " + | ||
| RpcContext.getServiceContext().getLocalHost()+ ", consumer incorrect token is " + remoteToken); | ||
| if (ConfigUtils.isDefault(token)){ |
There was a problem hiding this comment.
This means that as long as the token=default is configured, the request can be executed arbitrarily, right?
There was a problem hiding this comment.
yes as described in the question
| if (ConfigUtils.isDefault(token)){ | ||
| inv.setAttachment(TOKEN_KEY,token); | ||
| } | ||
| if (!token.equals(remoteToken) && !ConfigUtils.isDefault(token)) { |
There was a problem hiding this comment.
This may cause token downgrade attack. If provider use default token, TokenFilter in provider side may not work.
There was a problem hiding this comment.
This may cause token downgrade attack. If provider use default token, TokenFilter in provider side may not work.
@AlbumenJ You mean that when the token is passed in the thread context it should fake a value, or expose a configuration. Is it used to guarantee idempotency when downgrading?
4 participants
What is the purpose of the change
When the user uses the broadcast address, an exception is thrown after the dynamic token is updated. And add related unit tests
Related to dubbo-8601
Brief changelog
Verifying this change
BroacastCluster2Test
TokenFilterTest#testInvokeWithoutDynamicToken
Checklist