Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[改进/重构] 群组绑定机制的安全性改进 #55

Open
Itsusinn opened this issue Apr 27, 2022 · 0 comments
Open

[改进/重构] 群组绑定机制的安全性改进 #55

Itsusinn opened this issue Apr 27, 2022 · 0 comments

Comments

@Itsusinn
Copy link
Member

解决现有隐患的改进。

用一个字符串来绑定频道并不合适。
权限部分:操作等级上升,部分操作仅允许群主/Owner执行。

绑定机制为

  1. 在A端群聊内发送绑定请求(权限等级:管理员)
  2. A端生成六位十进制随机数,并仅发送给群主/owner,将群聊id与随机数作为kv存于数据库,存活时间十分钟(绑定完成后即刻失效)
  3. B端群聊内发送携带随机数的绑定指令,(权限等级:群主),B端Bot拼接随机数为群聊绑定请求事件,并发往事件总线。在数据库记录随机数和群聊ID
  4. A端接收到事件并查询数据库,若匹配,则生成UUID,作为群聊的nats地址,为其创建订阅,并立刻使随机数失效
  5. A端将nats地址,随机数拼接为群聊绑定回应事件,并发往事件总线。
  6. B端接收到事件,查询数据库,如匹配则确认绑定,并创建订阅。
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant