[#1092] optimize security authentication verification logic (#1094)

huaweicloud · Nov 8, 2023 · 05aa237 · 05aa237
1 parent 69f0f07
commit 05aa237
Showing 1 changed file with 4 additions and 5 deletions.
diff --git a/...ance/src/main/java/com/huaweicloud/governance/authentication/RSAProviderTokenManager.java b/...ance/src/main/java/com/huaweicloud/governance/authentication/RSAProviderTokenManager.java
@@ -21,6 +21,7 @@
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.core.env.Environment;
@@ -43,12 +44,10 @@ public RSAProviderTokenManager(List<AccessController> accessControllers, Environ
 
   public void valid(HttpServletRequest request) throws Exception {
     try {
-      RsaAuthenticationToken rsaToken = null;
-      if (environment.getProperty(Const.AUTH_TOKEN_CHECK_ENABLED, boolean.class, true)) {
-        rsaToken = RSATokenCheckUtils.checkTokenInfo(request, authenticationAdapter);
-      }
       AuthRequestExtractor extractor;
-      if (rsaToken != null) {
+      if (environment.getProperty(Const.AUTH_TOKEN_CHECK_ENABLED, boolean.class, true)
+          || StringUtils.isEmpty(request.getHeader(Const.AUTH_SERVICE_NAME))) {
+        RsaAuthenticationToken rsaToken = RSATokenCheckUtils.checkTokenInfo(request, authenticationAdapter);
         extractor = AuthRequestExtractorUtils.createAuthRequestExtractor(request, rsaToken.getServiceId(),
             rsaToken.getInstanceId());
       } else {