fix(auth): move admin session to HttpOnly cookies

yshop-drink-boot3/yshop-framework/yshop-spring-boot-starter-security/pom.xml

@@ -60,6 +60,12 @@
             <artifactId>bizlog-sdk</artifactId>
         </dependency>
 
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+
         <!-- 业务组件 -->
         <dependency>
             <groupId>co.yixiang.boot</groupId>

yshop-drink-boot3/yshop-framework/yshop-spring-boot-starter-security/src/main/java/co/yixiang/yshop/framework/security/config/SecurityProperties.java

@@ -48,4 +48,10 @@ public class SecurityProperties {
      * PasswordEncoder 加密复杂度，越高开销越大
      */
     private Integer passwordEncoderLength = 4;
+
+    /**
+     * 管理端认证 Cookie 是否仅通过 HTTPS 发送
+     */
+    @NotNull(message = "Cookie Secure 开关不能为空")
+    private Boolean cookieSecure = true;
 }

yshop-drink-boot3/yshop-framework/yshop-spring-boot-starter-security/src/main/java/co/yixiang/yshop/framework/security/core/util/SecurityFrameworkUtils.java

@@ -11,6 +11,7 @@ import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
 import org.springframework.util.StringUtils;
+import org.springframework.web.util.WebUtils;
 
 import jakarta.servlet.http.HttpServletRequest;
 import java.util.Collections;
@@ -22,6 +23,9 @@ import java.util.Collections;
  */
 public class SecurityFrameworkUtils {
 
+    public static final String ACCESS_TOKEN_COOKIE = "yshop_admin_access_token";
+    public static final String REFRESH_TOKEN_COOKIE = "yshop_admin_refresh_token";
+
     /**
      * HEADER 认证头 value 的前缀
      */
@@ -39,11 +43,14 @@ public class SecurityFrameworkUtils {
      */
     public static String obtainAuthorization(HttpServletRequest request,
                                              String headerName, String parameterName) {
-        // 1. 获得 Token。优先级：Header > Parameter
+        // 1. 获得 Token。优先级：Header > Parameter > HttpOnly Cookie
         String token = request.getHeader(headerName);
         if (StrUtil.isEmpty(token)) {
             token = request.getParameter(parameterName);
         }
+        if (StrUtil.isEmpty(token) && WebUtils.getCookie(request, ACCESS_TOKEN_COOKIE) != null) {
+            token = WebUtils.getCookie(request, ACCESS_TOKEN_COOKIE).getValue();
+        }
         if (!StringUtils.hasText(token)) {
             return null;
         }

yshop-drink-boot3/yshop-framework/yshop-spring-boot-starter-security/src/test/java/co/yixiang/yshop/framework/security/core/util/SecurityFrameworkUtilsTest.java

@@ -0,0 +1,21 @@
+package co.yixiang.yshop.framework.security.core.util;
+
+import jakarta.servlet.http.Cookie;
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class SecurityFrameworkUtilsTest {
+
+    @Test
+    void obtainAuthorizationUsesCookieWhenHeaderIsMissing() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setCookies(new Cookie(SecurityFrameworkUtils.ACCESS_TOKEN_COOKIE, "cookie-token"));
+
+        assertEquals("cookie-token", SecurityFrameworkUtils.obtainAuthorization(request, "Authorization", "token"));
+
+        request.addHeader("Authorization", "Bearer header-token");
+        assertEquals("header-token", SecurityFrameworkUtils.obtainAuthorization(request, "Authorization", "token"));
+    }
+}