29 lines
845 B
Go
29 lines
845 B
Go
package common
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gogf/gf/v2/errors/gcode"
|
|
"github.com/gogf/gf/v2/frame/g"
|
|
"github.com/gogf/gf/v2/net/ghttp"
|
|
)
|
|
|
|
// AdminAuth 管理端静态 token 鉴权中间件：请求头 X-Admin-Token 须与 config.yml
|
|
// admin.token 一致；token 未配置（空）时管理接口全部拒绝。
|
|
// 图片等 <img>/<video> 标签无法携带自定义请求头，允许 query 参数 token 兜底。
|
|
func AdminAuth(r *ghttp.Request) {
|
|
want := g.Cfg().MustGet(r.GetCtx(), "admin.token", "").String()
|
|
token := r.Header.Get("X-Admin-Token")
|
|
if token == "" {
|
|
token = r.Get("token").String()
|
|
}
|
|
if want == "" || token != want {
|
|
r.Response.WriteStatusExit(http.StatusUnauthorized, g.Map{
|
|
"code": gcode.CodeNotAuthorized.Code(),
|
|
"message": "管理端未授权",
|
|
"data": nil,
|
|
})
|
|
}
|
|
r.Middleware.Next()
|
|
}
|