From 2524b60d9a2c0098e4d17bf1176ef102a7fd9d9b Mon Sep 17 00:00:00 2001 From: Wenjie Zhang Date: Fri, 2 Jan 2026 22:15:50 +0800 Subject: [PATCH] =?UTF-8?q?fix(security-53):=20=E4=BC=98=E5=8C=96=E7=94=A8?= =?UTF-8?q?=E6=88=B7=E8=AE=A4=E8=AF=81=E6=B5=81=E7=A8=8B=E5=92=8C=E6=9C=AC?= =?UTF-8?q?=E5=9C=B0=E5=AD=98=E5=82=A8=E7=AD=96=E7=95=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 重构用户存储模块，不再将用户信息保存在本地存储中，仅保留token 在路由守卫中添加获取用户信息的逻辑，确保token有效时能获取最新用户信息 --- web/src/components/QuerySection.vue | 2 +- web/src/router/index.js | 12 ++++++++ web/src/stores/user.js | 47 ++++++----------------------- 3 files changed, 23 insertions(+), 38 deletions(-) diff --git a/web/src/components/QuerySection.vue b/web/src/components/QuerySection.vue index 0ba4b173..816eafda 100644 --- a/web/src/components/QuerySection.vue +++ b/web/src/components/QuerySection.vue @@ -22,7 +22,7 @@ class="examples-label-btn" @click="() => generateSampleQuestions(false)" > - 示例: + 示例: diff --git a/web/src/router/index.js b/web/src/router/index.js index 58828ab0..b03ea8fc 100644 --- a/web/src/router/index.js +++ b/web/src/router/index.js @@ -106,6 +106,18 @@ router.beforeEach(async (to, from, next) => { const requiresAdmin = to.matched.some(record => record.meta.requiresAdmin); const userStore = useUserStore(); + + // 如果有 token 但用户信息未加载，先获取用户信息 + if (userStore.token && !userStore.userId) { + try { + await userStore.getCurrentUser(); + } catch (error) { + // 如果获取用户信息失败（如 token 过期），清除 token + console.error('获取用户信息失败:', error); + userStore.logout(); + } + } + const isLoggedIn = userStore.isLoggedIn; const isAdmin = userStore.isAdmin; diff --git a/web/src/stores/user.js b/web/src/stores/user.js index 4f91e249..d135c1da 100644 --- a/web/src/stores/user.js +++ b/web/src/stores/user.js @@ -4,12 +4,12 @@ import { ref, computed } from 'vue' export const useUserStore = defineStore('user', () => { // 状态 const token = ref(localStorage.getItem('user_token') || '') - const userId = ref(parseInt(localStorage.getItem('user_id') || '0') || null) - const username = ref(localStorage.getItem('username') || '') - const userIdLogin = ref(localStorage.getItem('user_id_login') || '') // 用于登录的user_id - const phoneNumber = ref(localStorage.getItem('phone_number') || '') - const avatar = ref(localStorage.getItem('avatar') || '') - const userRole = ref(localStorage.getItem('user_role') || '') + const userId = ref(null) + const username = ref('') + const userIdLogin = ref('') + const phoneNumber = ref('') + const avatar = ref('') + const userRole = ref('') // 计算属性 const isLoggedIn = computed(() => !!token.value) @@ -54,14 +54,8 @@ export const useUserStore = defineStore('user', () => { avatar.value = data.avatar || '' userRole.value = data.role - // 保存到本地存储 + // 只保存 token 到本地存储 localStorage.setItem('user_token', data.access_token) - localStorage.setItem('user_id', data.user_id) - localStorage.setItem('username', data.username) - localStorage.setItem('user_id_login', data.user_id_login) - localStorage.setItem('phone_number', data.phone_number || '') - localStorage.setItem('avatar', data.avatar || '') - localStorage.setItem('user_role', data.role) return true } catch (error) { @@ -80,14 +74,8 @@ export const useUserStore = defineStore('user', () => { avatar.value = '' userRole.value = '' - // 清除本地存储 + // 只清除 token localStorage.removeItem('user_token') - localStorage.removeItem('user_id') - localStorage.removeItem('username') - localStorage.removeItem('user_id_login') - localStorage.removeItem('phone_number') - localStorage.removeItem('avatar') - localStorage.removeItem('user_role') } async function initialize(admin) { @@ -116,14 +104,8 @@ export const useUserStore = defineStore('user', () => { avatar.value = data.avatar || '' userRole.value = data.role - // 保存到本地存储 + // 只保存 token 到本地存储 localStorage.setItem('user_token', data.access_token) - localStorage.setItem('user_id', data.user_id) - localStorage.setItem('username', data.username) - localStorage.setItem('user_id_login', data.user_id_login) - localStorage.setItem('phone_number', data.phone_number || '') - localStorage.setItem('avatar', data.avatar || '') - localStorage.setItem('user_role', data.role) return true } catch (error) { @@ -284,7 +266,6 @@ export const useUserStore = defineStore('user', () => { // 更新本地头像状态 avatar.value = data.avatar_url - localStorage.setItem('avatar', data.avatar_url) return data } catch (error) { @@ -309,19 +290,13 @@ export const useUserStore = defineStore('user', () => { const userData = await response.json() // 更新本地状态 + userId.value = userData.id username.value = userData.username userIdLogin.value = userData.user_id phoneNumber.value = userData.phone_number || '' avatar.value = userData.avatar || '' userRole.value = userData.role - // 更新本地存储 - localStorage.setItem('username', userData.username) - localStorage.setItem('user_id_login', userData.user_id) - localStorage.setItem('phone_number', userData.phone_number || '') - localStorage.setItem('avatar', userData.avatar || '') - localStorage.setItem('user_role', userData.role) - return userData } catch (error) { console.error('获取用户信息错误:', error) @@ -351,11 +326,9 @@ export const useUserStore = defineStore('user', () => { // 更新本地状态 if (typeof userData.username === 'string') { username.value = userData.username - localStorage.setItem('username', userData.username) } if (typeof userData.phone_number !== 'undefined') { phoneNumber.value = userData.phone_number || '' - localStorage.setItem('phone_number', userData.phone_number || '') } return userData