Repository navigation
Feat/tap 11883 token url - #633
Merged
Merged
Conversation
Stop appending access_token to REST, download, WS, and SSO URLs. Use Authorization Bearer, blob downloads, PDK icon object URLs, SAML login_code exchange, and keepalive fetch on data-preview unload.
Match restored TM ACS redirect; still strip the token from the address bar after copying it into the session cookie.
weiliang110100
marked this pull request as draft
September 16, 2026 09:51
weiliang110100
marked this pull request as ready for review
September 29, 2026 04:02
feynmx
reviewed
Oct 8, 2026
| const [hashPath, hashQuery] = location.hash.split('?') | ||
| if (hashQuery) { | ||
| const params = new URLSearchParams(hashQuery) | ||
| params.delete('token') |
Collaborator
There was a problem hiding this comment.
[P2] SAML 回调实际携带 access_token（SsoCallback.vue 读取该参数），但这里仅删除 token，且清理分支要求 getUrlSearch('token') 命中，因此回调不会执行清理。回调随后异步初始化；若恢复 lastLocationHref，还会用 location.href 新增历史项，留下带凭证的回调 URL。请在读取 access_token 后、任何 await 之前立即清理 URL。
Contributor
Author
There was a problem hiding this comment.
已修复（2f688ddfa）。
- 新增公共函数
removeUrlParams(...names)（apps/daas/src/utils/util.ts）：用history.replaceState同时清理 query 和 hash 中的指定参数，不新增历史记录；同时同步 vue-router 的history.state.current，避免 state 里残留带 token 的路由。 SsoCallback.vue在读取access_token后、任何 await 之前立即调用removeUrlParams('access_token')，后续lastLocationHref/location.href跳转都拿不到带凭证的 URL。main.ts原有的?token=清理也改为复用该函数。
| } | ||
| } | ||
| if (config.url) { | ||
| config.url = stripUrlAccessToken(config.url) |
Collaborator
There was a problem hiding this comment.
[P1] 这里只清理 Axios 请求。SAML 登出通过 window.location.href = getSamlLogoutUrl(accessToken) 导航，packages/api/src/core/sso.ts:38 仍会生成 /logout?access_token=...，所以该凭证绕过此拦截器并进入请求 URL。请一并调整登出调用和服务端契约，确保 URL 不再携带 token。
Contributor
Author
There was a problem hiding this comment.
已修复（2f688ddfa），并同步调整了服务端契约：tapdata/tapdata#3516。
- 前端：
getSamlLogoutUrl(token)改为startSamlLogout(token)，以POST /api/sso/saml/logout+Authorization: Bearer发起登出，后端返回redirectUrl（IdP SLO 地址或登出后页面），signOut()再跳转；请求失败时回到#/login。登出 URL 不再携带 token。 - 后端（#3516）：新增
POST /logout，通过AccessTokenResolver从请求头解析 token；GET /logout保留兼容旧前端并标记 deprecated，url-token-mode=REJECT时忽略 URL token。
注意发布顺序：本 PR 依赖 #3516，需在后端合并部署后（或同时）再合并，否则 SAML 登出只会回到登录页而不会终止服务端会话 / 触发 IdP SLO。
- Strip access_token from the SSO callback URL right after reading it, before any await, so it never stays in the address bar, history or lastLocationHref; share the cleanup with the ?token= entry path. - Start SAML logout via POST /api/sso/saml/logout with a Bearer header and navigate to the returned redirectUrl instead of putting the token in the logout URL. Requires the matching TM endpoint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.