fix(auth): move admin session to HttpOnly cookies

yshop-drink-vue3/src/config/axios/service.ts

@@ -9,11 +9,10 @@ import axios, {
 import { ElMessage, ElMessageBox, ElNotification } from 'element-plus'
 import qs from 'qs'
 import { config } from '@/config/axios/config'
-import { getAccessToken, getRefreshToken, getTenantId, removeToken, setToken } from '@/utils/auth'
+import { getTenantId, removeAuthenticated } from '@/utils/auth'
 import errorCode from './errorCode'
 
 import { resetRouter } from '@/router'
-import { deleteUserCache } from '@/hooks/web/useCache'
 
 const tenantEnable = import.meta.env.VITE_APP_TENANT_ENABLE
 const { result_code, base_url, request_timeout } = config
@@ -30,30 +29,16 @@ export const isRelogin = { show: false }
 let requestList: any[] = []
 // 是否正在刷新中
 let isRefreshToken = false
-// 请求白名单，无须token的接口
-const whiteList: string[] = ['/login', '/refresh-token']
-
 // 创建axios实例
 const service: AxiosInstance = axios.create({
   baseURL: base_url, // api 的 base_url
   timeout: request_timeout, // 请求超时时间
-  withCredentials: false // 禁用 Cookie 等信息
+  withCredentials: true
 })
 
 // request拦截器
 service.interceptors.request.use(
   (config: InternalAxiosRequestConfig) => {
-    // 是否需要设置 token
-    let isToken = (config!.headers || {}).isToken === false
-    whiteList.some((v) => {
-      if (config.url) {
-        config.url.indexOf(v) > -1
-        return (isToken = false)
-      }
-    })
-    if (getAccessToken() && !isToken) {
-      ;(config as Recordable).headers.Authorization = 'Bearer ' + getAccessToken() // 让每个请求携带自定义token
-    }
     // 设置租户
     if (tenantEnable && tenantEnable === 'true') {
       const tenantId = getTenantId()
@@ -117,16 +102,10 @@ service.interceptors.response.use(
       // 如果未认证，并且未进行刷新令牌，说明可能是访问令牌过期了
       if (!isRefreshToken) {
         isRefreshToken = true
-        // 1. 如果获取不到刷新令牌，则只能执行登出操作
-        if (!getRefreshToken()) {
-          return handleAuthorized()
-        }
-        // 2. 进行刷新访问令牌
+        // 使用 HttpOnly Cookie 刷新访问令牌
         try {
-          const refreshTokenRes = await refreshToken()
+          await refreshToken()
           // 2.1 刷新成功，则回放队列的请求 + 当前请求
-          setToken((await refreshTokenRes).data.data)
-          config.headers!.Authorization = 'Bearer ' + getAccessToken()
           requestList.forEach((cb: any) => {
             cb()
           })
@@ -148,7 +127,6 @@ service.interceptors.response.use(
         // 添加到队列，等待刷新获取到新的令牌
         return new Promise((resolve) => {
           requestList.push(() => {
-            config.headers!.Authorization = 'Bearer ' + getAccessToken() // 让每个请求携带自定义token 请根据实际情况自行修改
             resolve(service(config))
           })
         })
@@ -200,7 +178,12 @@ service.interceptors.response.use(
 
 const refreshToken = async () => {
   axios.defaults.headers.common['tenant-id'] = getTenantId()
-  return await axios.post(base_url + '/system/auth/refresh-token?refreshToken=' + getRefreshToken())
+  const response = await axios.post(base_url + '/system/auth/refresh-token-cookie', null, {
+    withCredentials: true
+  })
+  if (response.data?.code !== result_code) {
+    throw new Error(response.data?.msg)
+  }
 }
 const handleAuthorized = () => {
   const { t } = useI18n()
@@ -218,8 +201,7 @@ const handleAuthorized = () => {
       type: 'warning'
     }).then(() => {
       resetRouter() // 重置静态路由表
-      deleteUserCache() // 删除用户缓存
-      removeToken()
+      removeAuthenticated()
       isRelogin.show = false
       // 干掉token后再走一次路由让它过router.beforeEach的校验
       window.location.href = window.location.href