wood/Q58Connect
1
0
Fork 0
mirror of https://github.com/woodchen-ink/Q58Connect.git synced 2025-07-18 14:01:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复: 即使用户没有提前登录本系统，从第三方应用发起授权请求时也能正确完成整个认证流程

Browse Source
This commit is contained in:
wood chen 2025-02-21 17:12:53 +08:00
parent cd24fe93b7
commit 3b47daccee
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -28,7 +28,7 @@ Q58论坛网址: https://q58.club
2. 未登录本系统, 未登录q58论坛, 检查: 用户在接入应用中登录, 然后登录本系统, 然后登录q58论坛, 正常一直回调到用户应用 2. 未登录本系统, 未登录q58论坛, 检查: 用户在接入应用中登录, 然后登录本系统, 然后登录q58论坛, 正常一直回调到用户应用
3. 未登录本系统, 登录了q58论坛, 检查: 用户在接入应用中登录, 然后登录本系统, 正常回调到用户应用 3. 未登录本系统, 登录了q58论坛, 检查: 用户在接入应用中登录, 然后登录本系统, 正常回调到用户应用
## 用户接入本系统oauth2.0认证的方式: ## 用户应用接入本系统oauth2.0认证的方式:
1. 发起授权请求 1. 发起授权请求
将用户重定向到授权页面 将用户重定向到授权页面

14
src/app/api/auth/q58/route.ts
View File

@ -1,4 +1,4 @@
import { cookies } from "next/headers"; import { cookies, headers } from "next/headers";
import Hex from "crypto-js/enc-hex"; import Hex from "crypto-js/enc-hex";
import hmacSHA256 from "crypto-js/hmac-sha256"; import hmacSHA256 from "crypto-js/hmac-sha256";
import WordArray from "crypto-js/lib-typedarrays"; import WordArray from "crypto-js/lib-typedarrays";
@ -9,9 +9,17 @@ const hostUrl = process.env.NEXT_PUBLIC_HOST_URL as string;
const discourseHost = process.env.DISCOURSE_HOST as string; const discourseHost = process.env.DISCOURSE_HOST as string;
const clientSecret = process.env.DISCOURSE_SECRET as string; const clientSecret = process.env.DISCOURSE_SECRET as string;
export async function POST(_req: Request) { export async function POST(req: Request) {
const nonce = WordArray.random(16).toString(); const nonce = WordArray.random(16).toString();
const return_url = `${hostUrl}/authorize`; const referer = headers().get("referer") || "";
const url = new URL(referer);
const searchParams = url.searchParams.toString();
// 如果是从OAuth授权页面来的，保留OAuth参数
const return_url = searchParams
? `${hostUrl}/q58/callback?oauth=${btoa(searchParams)}`
: `${hostUrl}/authorize`;
const sso = btoa(`nonce=${nonce}&return_sso_url=${return_url}`); const sso = btoa(`nonce=${nonce}&return_sso_url=${return_url}`);
const sig = hmacSHA256(sso, clientSecret).toString(Hex); const sig = hmacSHA256(sso, clientSecret).toString(Hex);