From 20a339612877e579749c89b9b5f88eec15707c3f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=96=AF=E7=8B=82=E7=9A=84=E7=8B=AE=E5=AD=90Li?=
 <15040126243@163.com>
Date: Mon, 17 Jun 2024 10:43:28 +0800
Subject: [PATCH] =?UTF-8?q?fix=20=E4=BF=AE=E5=A4=8D=20websocket=20clientid?=
 =?UTF-8?q?=20=E5=8F=82=E6=95=B0=E4=B8=8D=E8=B5=B0mvc=E6=8B=A6=E6=88=AA?=
 =?UTF-8?q?=E5=99=A8=20=E6=97=A0=E6=B3=95=E7=94=9F=E6=95=88=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../interceptor/PlusWebSocketInterceptor.java  | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/ruoyi-common/ruoyi-common-websocket/src/main/java/org/dromara/common/websocket/interceptor/PlusWebSocketInterceptor.java b/ruoyi-common/ruoyi-common-websocket/src/main/java/org/dromara/common/websocket/interceptor/PlusWebSocketInterceptor.java
index 0abbbd3c9..1ad8ad665 100644
--- a/ruoyi-common/ruoyi-common-websocket/src/main/java/org/dromara/common/websocket/interceptor/PlusWebSocketInterceptor.java
+++ b/ruoyi-common/ruoyi-common-websocket/src/main/java/org/dromara/common/websocket/interceptor/PlusWebSocketInterceptor.java
@@ -1,7 +1,11 @@
 package org.dromara.common.websocket.interceptor;
 
+import cn.dev33.satoken.exception.NotLoginException;
+import cn.dev33.satoken.stp.StpUtil;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.domain.model.LoginUser;
+import org.dromara.common.core.utils.ServletUtils;
+import org.dromara.common.core.utils.StringUtils;
 import org.dromara.common.satoken.utils.LoginHelper;
 import org.springframework.http.server.ServerHttpRequest;
 import org.springframework.http.server.ServerHttpResponse;
@@ -31,7 +35,21 @@ public class PlusWebSocketInterceptor implements HandshakeInterceptor {
      */
     @Override
     public boolean beforeHandshake(ServerHttpRequest request, ServerHttpResponse response, WebSocketHandler wsHandler, Map<String, Object> attributes) {
+        // 检查是否登录 是否有token
         LoginUser loginUser = LoginHelper.getLoginUser();
+
+        // 解决 ws 不走 mvc 拦截器问题(cloud 版本不受影响)
+        // 检查 header 与 param 里的 clientid 与 token 里的是否一致
+        String headerCid = ServletUtils.getRequest().getHeader(LoginHelper.CLIENT_KEY);
+        String paramCid = ServletUtils.getParameter(LoginHelper.CLIENT_KEY);
+        String clientId = StpUtil.getExtra(LoginHelper.CLIENT_KEY).toString();
+        if (!StringUtils.equalsAny(clientId, headerCid, paramCid)) {
+            // token 无效
+            throw NotLoginException.newInstance(StpUtil.getLoginType(),
+                "-100", "客户端ID与Token不匹配",
+                StpUtil.getTokenValue());
+        }
+
         attributes.put(LOGIN_USER_KEY, loginUser);
         return true;
     }