ahdoawhfo/netdisk-fast-download
1
0
Fork 0
mirror of https://github.com/qaiu/netdisk-fast-download.git synced 2026-06-11 07:57:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

修复JWT签名验证时序攻击：使用MessageDigest.isEqual()替代String.equals()进行签名比较

Browse Source
This commit is contained in:
yukaidi
2026-05-29 02:18:43 +08:00
parent b77c8a80e9
commit 36b38421e5
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
web-service/src/main/java/cn/qaiu/lz/common/util/JwtUtil.java
View File

@@ -7,6 +7,7 @@ import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec; import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException; import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException; import java.security.NoSuchAlgorithmException;
import java.time.Instant; import java.time.Instant;
import java.time.LocalDateTime; import java.time.LocalDateTime;
@@ -93,9 +94,10 @@ public class JwtUtil {
String encodedPayload = parts[1]; String encodedPayload = parts[1];
String signature = parts[2]; String signature = parts[2];
// 验证签名 // 验证签名（使用常量时间比较防止时序攻击）
String expectedSignature = hmacSha256(encodedHeader + "." + encodedPayload, SECRET_KEY); String expectedSignature = hmacSha256(encodedHeader + "." + encodedPayload, SECRET_KEY);
if (!expectedSignature.equals(signature)) { if (!MessageDigest.isEqual(expectedSignature.getBytes(StandardCharsets.UTF_8),
signature.getBytes(StandardCharsets.UTF_8))) {
return false; return false;
} }