Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

客户端拦截器XxlSsoFilter中的sessionId检查逻辑的探讨 #19

Closed
JackLijm opened this issue Oct 8, 2018 · 3 comments
Closed

客户端拦截器XxlSsoFilter中的sessionId检查逻辑的探讨 #19

JackLijm opened this issue Oct 8, 2018 · 3 comments

Comments

@JackLijm
Copy link

JackLijm commented Oct 8, 2018

XxlSsoFilter的SsoLoginHelper.loginCheck(cookieSessionId);应该是需要到服务端去验证sessionId吧
可以封装个http请求去做验证，这样才真正的客户端与服务端分离，目前代码实现是直接在本地的redis缓存获取了，实际生产上客户端不知道服务端的redis的
@DoubleLuXu
Copy link

如果直接依赖redis，对sso_server的依赖会比较小一点吧，但是安全性就暴露了，也是难取舍

@JackLijm
Copy link
Author

JackLijm commented Oct 8, 2018

确实需要取舍。
如果客户端跟服务端都在同一环境下部署，可以直接用redis
如果是其他项目需要嵌套咱服务端的单点登陆，拦截器实现应该需要依赖sso_server的logincheck端点

@JackLijm JackLijm closed this as completed Oct 8, 2018
@852675742
Copy link

确实需要取舍。
如果客户端跟服务端都在同一环境下部署，可以直接用redis
如果是其他项目需要嵌套咱服务端的单点登陆，拦截器实现应该需要依赖sso_server的logincheck端点

如果依赖sso_server的logincheck端点验证会不会对性能有很大的影响啊？

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@DoubleLuXu @852675742 @JackLijm