rxthinkcmf/rxthinkcmf-wiki
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d0bb340dbc95661af174c2d1fb59fd9dfc752224
rxthinkcmf-wiki/RXThinkCMF_ThinkPhp8_EleVue/.vitepress/dist/assets/zh_architecture_security.md.Iqt-Ebwd.js
T
gitadmin d0bb340dbc 签入版本
2026-10-25 18:52:36 +08:00

232 lines
78 KiB
JavaScript
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import{_ as i,o as a,c as n,a2 as t}from"./chunks/framework.B-QBKwc1.js";const g=JSON.parse('{"title":"安全架构设计","description":"本章详细阐述系统的安全架构设计，围绕认证、授权、防护、审计四大安全领域展开，旨在帮助开发者全面理解系统的安全保障体系。","frontmatter":{},"headers":[],"relativePath":"zh/architecture/security.md","filePath":"zh/architecture/security.md"}'),p={name:"zh/architecture/security.md"};function l(h,s,e,k,d,r){return a(),n("div",null,[...s[0]||(s[0]=[t(`<h1 id="_4-10-安全架构设计" tabindex="-1">4.10 安全架构设计 <a class="header-anchor" href="#_4-10-安全架构设计" aria-label="Permalink to &quot;4.10 安全架构设计&quot;">​</a></h1><div class="tip custom-block"><p class="custom-block-title">概述</p><p>本章详细阐述系统的安全架构设计，围绕认证、授权、防护、审计四大安全领域展开，旨在帮助开发者全面理解系统的安全保障体系。</p></div><p><strong>认证（Authentication）</strong>：系统采用基于 JWT 的无状态认证机制，用户通过用户名密码登录后获取 Token，后续请求通过 <code>Authorization: Bearer &lt;token&gt;</code> 头传递，由 <code>AuthMiddleware</code> 统一拦截并验证 Token 的有效性（签名校验、有效期检查）。</p><p><strong>授权（Authorization）</strong>：基于 RBAC 模型设计，权限控制粒度细化至接口级。用户通过角色继承权限节点（如 <code>sys:user:add</code>），由 <code>#[Permission]</code> 注解在控制器层声明，<code>AuthMiddleware</code> 统一校验。管理员（<code>uid=1</code>）自动放行。</p><p><strong>防护（Protection）</strong>：系统从多维度构建安全防护体系。参数校验通过 Validate 自动拦截非法输入；敏感密码采用 bcrypt 双重加盐哈希存储；演示模式下 <code>DemoMiddleware</code> 统一拦截写操作；跨域配置精确控制可信域名。</p><p><strong>审计（Audit）</strong>：系统提供完备的操作审计能力。<code>LogMiddleware</code> 自动记录所有写操作的请求路径、参数、操作人、IP 地址及执行结果；登录日志独立记录每次登录尝试，便于安全事件追溯。</p><div class="tip custom-block"><p class="custom-block-title">安全设计原则</p><ul><li><strong>纵深防御</strong>：认证、授权、参数校验多层防护，单一防线失效时仍有其他机制兜底</li><li><strong>最小权限</strong>：用户仅能访问已授权接口，角色权限按需分配</li><li><strong>数据不落地</strong>：敏感信息（Token、密码）不在日志中明文记录，密码哈希不可逆。<strong>注意</strong>：当前 LogMiddleware 会记录完整请求参数，敏感字段（如密码）建议在业务层脱敏后再传入</li><li><strong>安全默认</strong>：框架默认配置为安全模式（DEBUG 关闭、错误信息隐藏）</li></ul></div><h2 id="安全架构总览" tabindex="-1">安全架构总览 <a class="header-anchor" href="#安全架构总览" aria-label="Permalink to &quot;安全架构总览&quot;">​</a></h2><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span>┌─────────────────────────────────────────────────────────────────┐</span></span>
<span class="line"><span>│ 安全防御层次 │</span></span>
<span class="line"><span>│ │</span></span>
<span class="line"><span>│ ┌───────────────────────────────────────────────────────────┐ │</span></span>
<span class="line"><span>│ │ 网络层防护 │ │</span></span>
<span class="line"><span>│ │ ┌──────────┐ ┌──────────────┐ │ │</span></span>
<span class="line"><span>│ │ │ CORS │ │ 上传体积限制 │ │ │</span></span>
<span class="line"><span>│ │ │ 跨域控制 │ │ DoS 防御 │ │ │</span></span>
<span class="line"><span>│ │ └──────────┘ └──────────────┘ │ │</span></span>
<span class="line"><span>│ └───────────────────────────────────────────────────────────┘ │</span></span>
<span class="line"><span>│ │</span></span>
<span class="line"><span>│ ┌───────────────────────────────────────────────────────────┐ │</span></span>
<span class="line"><span>│ │ 认证层 │ │</span></span>
<span class="line"><span>│ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │</span></span>
<span class="line"><span>│ │ │ JWT 认证 │ │ 验证码 │ │ 双令牌 │ │ │</span></span>
<span class="line"><span>│ │ │ Bearer │ │ 图形验证 │ │ access+ │ │ │</span></span>
<span class="line"><span>│ │ │ │ │ │ │ refresh │ │ │</span></span>
<span class="line"><span>│ │ └──────────┘ └──────────┘ └──────────┘ │ │</span></span>
<span class="line"><span>│ └───────────────────────────────────────────────────────────┘ │</span></span>
<span class="line"><span>│ │</span></span>
<span class="line"><span>│ ┌───────────────────────────────────────────────────────────┐ │</span></span>
<span class="line"><span>│ │ 授权层 │ │</span></span>
<span class="line"><span>│ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐ │ │</span></span>
<span class="line"><span>│ │ │ RBAC 权限 │ │ 演示模式保护 │ │ 超级管理员跳过 │ │ │</span></span>
<span class="line"><span>│ │ │ #[Permission]│ │ DemoMiddleware│ │ uid=1 bypass │ │ │</span></span>
<span class="line"><span>│ │ └──────────────┘ └──────────────┘ └──────────────────┘ │ │</span></span>
<span class="line"><span>│ └───────────────────────────────────────────────────────────┘ │</span></span>
<span class="line"><span>│ │</span></span>
<span class="line"><span>│ ┌───────────────────────────────────────────────────────────┐ │</span></span>
<span class="line"><span>│ │ 数据层 │ │</span></span>
<span class="line"><span>│ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────────┐ │ │</span></span>
<span class="line"><span>│ │ │ 密码加密 │ │ 参数校验 │ │ SQL 注入 │ │ 操作日志 │ │ │</span></span>
<span class="line"><span>│ │ │ bcrypt │ │ Validate │ │ ORM 防护 │ │ 审计追踪 │ │ │</span></span>
<span class="line"><span>│ │ └──────────┘ └──────────┘ └──────────┘ └──────────────┘ │ │</span></span>
<span class="line"><span>│ └───────────────────────────────────────────────────────────┘ │</span></span>
<span class="line"><span>└─────────────────────────────────────────────────────────────────┘</span></span></code></pre></div><h2 id="一、认证机制" tabindex="-1">一、认证机制 <a class="header-anchor" href="#一、认证机制" aria-label="Permalink to &quot;一、认证机制&quot;">​</a></h2><h3 id="登录流程" tabindex="-1">登录流程 <a class="header-anchor" href="#登录流程" aria-label="Permalink to &quot;登录流程&quot;">​</a></h3><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span>1. 前端提交 { username, password, code, key }</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼</span></span>
<span class="line"><span>2. CaptchaService::check(code, key) ← 验证码校验</span></span>
<span class="line"><span> │ 失败 → 返回&quot;验证码错误&quot;</span></span>
<span class="line"><span> ▼</span></span>
<span class="line"><span>3. User::where(&#39;username&#39;, $username) ← 查询用户</span></span>
<span class="line"><span> │ 不存在 → 统一提示&quot;用户名或密码错误&quot;</span></span>
<span class="line"><span> ▼</span></span>
<span class="line"><span>4. password_verify($password . $salt, $hashed) ← bcrypt 校验</span></span>
<span class="line"><span> │ 不匹配 → 统一提示&quot;用户名或密码错误&quot;</span></span>
<span class="line"><span> ▼</span></span>
<span class="line"><span>5. 检查 user.status == 1 ← 账号状态</span></span>
<span class="line"><span> │ 非启用 → 返回&quot;账号已被禁用&quot;</span></span>
<span class="line"><span> ▼</span></span>
<span class="line"><span>6. JwtService::createTokenPair($uid) ← 签发双令牌</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼</span></span>
<span class="line"><span>7. 返回 { access_token, refresh_token, expires_in }</span></span></code></pre></div><h3 id="JWT-双令牌认证" tabindex="-1">JWT 双令牌认证 <a class="header-anchor" href="#JWT-双令牌认证" aria-label="Permalink to &quot;JWT 双令牌认证&quot;">​</a></h3><div class="language-html vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">html</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">[前端] [后端]</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │── POST /api/login ────→│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ {username, password} │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 验证码校验</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 密码校验（bcrypt）</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 签发 access_token + refresh_token</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │←─ {access_token, ───────│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ refresh_token} │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │── GET /api/xxx ────────→│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ Authorization: │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ Bearer </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">&lt;</span><span style="--shiki-dark:#EE6666;--shiki-dark-font-style:italic;--shiki-dark-text-decoration:underline;--shiki-light:#B31D28;--shiki-light-font-style:inherit;--shiki-light-text-decoration:inherit;">access_token</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 解析 JWT</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 校验签名 + 有效期</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 注入 userInfo</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │←─ {data} ──────────────│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │── Token 过期 ──────────→│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │── POST /api/oauth2/ ──→│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ token │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ {refresh_token} │── 验证 refresh 类型</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │── 签发新令牌对</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │←─ {new_access_token, ──│</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ new_refresh_token} │</span></span></code></pre></div><h3 id="Token-设计" tabindex="-1">Token 设计 <a class="header-anchor" href="#Token-设计" aria-label="Permalink to &quot;Token 设计&quot;">​</a></h3><table tabindex="0"><thead><tr><th>Token 类型</th><th>有效期</th><th>用途</th><th>payload.type</th></tr></thead><tbody><tr><td>access_token</td><td>2 小时</td><td>接口认证</td><td><code>access</code></td></tr><tr><td>refresh_token</td><td>7 天</td><td>刷新令牌</td><td><code>refresh</code></td></tr></tbody></table><h3 id="安全要点" tabindex="-1">安全要点 <a class="header-anchor" href="#安全要点" aria-label="Permalink to &quot;安全要点&quot;">​</a></h3><ol><li><strong>密码错误统一提示</strong>：无论用户不存在还是密码错误，统一提示&quot;用户名或密码错误&quot;，避免暴露账号是否存在</li><li><strong>账号状态校验</strong>：<code>status != 1</code> 时禁止登录</li><li><strong>Token 类型校验</strong>：access_token 和 refresh_token 通过 <code>type</code> 字段区分，不可混用</li><li><strong>密钥安全</strong>：JWT 密钥通过 <code>.env</code> 配置，生产环境务必修改为强随机字符串</li></ol><h2 id="二、授权机制" tabindex="-1">二、授权机制 <a class="header-anchor" href="#二、授权机制" aria-label="Permalink to &quot;二、授权机制&quot;">​</a></h2><h3 id="RBAC-权限模型" tabindex="-1">RBAC 权限模型 <a class="header-anchor" href="#RBAC-权限模型" aria-label="Permalink to &quot;RBAC 权限模型&quot;">​</a></h3><div class="language-typescript vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">typescript</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">┌─────────┐ ┌────────────┐ ┌─────────┐ ┌────────────┐ ┌─────────┐</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">User</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │───►│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">UserRole</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │───►│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">Role</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │───►│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">RoleMenu</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │───►│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">Menu</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">│ │ │ │ │ │ │ │ │ │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">user_id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">role_id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">│ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">username</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">│ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">role_id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">name</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">menu_id</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">perm</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">└─────────┘ └────────────┘ │</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">data_scope</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">│ └────────────┘ │ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">type</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> │</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> └─────────┘ └─────────┘</span></span></code></pre></div><h3 id="权限校验流程" tabindex="-1">权限校验流程 <a class="header-anchor" href="#权限校验流程" aria-label="Permalink to &quot;权限校验流程&quot;">​</a></h3><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// AuthMiddleware::checkPermission()</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">protected</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> function</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> checkPermission</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">int</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">uid</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> string</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">permissionCode</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">:</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> bool</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">{</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 1. 超级管理员（uid=1）跳过校验</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> if</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> ($</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">uid</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> ===</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 1</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> {</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> return</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;"> true</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> }</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 2. 查询用户角色</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">roleIds</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;"> UserRole</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">where</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">user_id</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">uid</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">-&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">column</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">role_id</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">);</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> if</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> (</span><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;">empty</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">($</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">roleIds</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">))</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> {</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> return</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;"> false</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> }</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 3. 通过角色关联获取权限节点</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">permissions</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;"> RoleMenu</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">alias</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">rm</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> -&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">join</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">think_menu m</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">rm.menu_id = m.id</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> -&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">whereIn</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">rm.role_id</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">roleIds</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> -&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">where</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">m.is_delete</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 0</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> -&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">where</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">m.type</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 1</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // type=1 为权限节点</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> -&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">column</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">m.permission</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">);</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 4. 判断是否包含目标权限</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> return</span><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> in_array</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">($</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">permissionCode</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">permissions</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">);</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">}</span></span></code></pre></div><h3 id="数据权限" tabindex="-1">数据权限 <a class="header-anchor" href="#数据权限" aria-label="Permalink to &quot;数据权限&quot;">​</a></h3><table tabindex="0"><thead><tr><th>data_scope</th><th>范围</th><th>实现</th></tr></thead><tbody><tr><td>1</td><td>全部数据</td><td>不过滤</td></tr><tr><td>2</td><td>本部门数据</td><td>WHERE dept_id = 用户部门ID</td></tr><tr><td>3</td><td>仅本人数据</td><td>WHERE create_user = 用户名</td></tr></tbody></table><h2 id="三、防护机制" tabindex="-1">三、防护机制 <a class="header-anchor" href="#三、防护机制" aria-label="Permalink to &quot;三、防护机制&quot;">​</a></h2><h3 id="密码加密-bcrypt-双重加盐-" tabindex="-1">密码加密（bcrypt 双重加盐） <a class="header-anchor" href="#密码加密-bcrypt-双重加盐-" aria-label="Permalink to &quot;密码加密（bcrypt 双重加盐）&quot;">​</a></h3><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span>密码存储流程：</span></span>
<span class="line"><span> 原始密码 + 外部 salt（10位随机字符串）</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ password_hash($combined, PASSWORD_BCRYPT, [&#39;cost&#39; =&gt; 12])</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ bcrypt 内部自动生成 salt 并嵌入哈希</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ 存储：password 字段（60字符）+ salt 字段（10字符）</span></span>
<span class="line"><span></span></span>
<span class="line"><span>密码校验流程：</span></span>
<span class="line"><span> 用户输入密码 + 数据库 salt</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ password_verify($input . $salt, $hashed)</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ true/false</span></span></code></pre></div><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 加密</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">password</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">123456</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">salt</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">xK7pMn3qRt</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 外部盐（10位随机）</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">combined</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">password</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> .</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">salt</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 拼接</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">hashed</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> password_hash</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">($</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">combined</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> PASSWORD_BCRYPT</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">cost</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 12</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">]);</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 结果：$2y$12$...（60字符）</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 校验</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">inputCombined</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">userInput</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> .</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">dbSalt</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">isValid</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> password_verify</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">($</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">inputCombined</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">dbHashed</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">);</span></span></code></pre></div><div class="tip custom-block"><p class="custom-block-title">为什么双重加盐？</p><p>外部 salt 存储在独立字段，即使数据库泄露，攻击者也需要同时获取 salt 才能进行暴力破解。bcrypt 内部 salt 进一步增加彩虹表攻击难度。</p></div><h3 id="参数校验-自动拦截-" tabindex="-1">参数校验（自动拦截） <a class="header-anchor" href="#参数校验-自动拦截-" aria-label="Permalink to &quot;参数校验（自动拦截）&quot;">​</a></h3><p>通过 Logic 层 <code>$validateClass</code> 配置，add/update 时自动校验参数格式：</p><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">class</span><span style="--shiki-dark:#97E1F1;--shiki-light:#2E8F82;"> UserValidate</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> extends</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#59873A;--shiki-light-font-style:inherit;"> Validate</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">{</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> protected</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">rule</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">username</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">require|unique:user</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">realname</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">require</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">mobile</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">mobile</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">email</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">email</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> ];</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> protected</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">scene</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">add</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">username</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">realname</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">mobile</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">email</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">],</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">update</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">realname</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">mobile</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">email</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">],</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> ];</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">}</span></span></code></pre></div><p>校验失败直接返回 422，不进入业务逻辑层。</p><h3 id="SQL-注入防护" tabindex="-1">SQL 注入防护 <a class="header-anchor" href="#SQL-注入防护" aria-label="Permalink to &quot;SQL 注入防护&quot;">​</a></h3><p>ThinkPHP ORM 使用参数绑定，自动防止 SQL 注入：</p><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// ✅ ORM 查询（安全，自动参数绑定）</span></span>
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;">User</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">where</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">username</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">username</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">-&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">find</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">();</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 生成：SELECT * FROM think_user WHERE username = ? [$username]</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// ✅ 原生查询（手动绑定参数）</span></span>
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;">Db</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">query</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&quot;</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">SELECT</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> *</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> FROM</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> think_user </span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">WHERE</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> username </span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">=</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> ?</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&quot;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">username</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">]);</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// ❌ 危险！字符串拼接（禁止）</span></span>
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;">Db</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">query</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&quot;</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">SELECT</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> *</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> FROM</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> think_user </span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">WHERE</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> username </span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">=</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> &#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B56959;">username</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">&#39;</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&quot;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">);</span></span></code></pre></div><div class="warning custom-block"><p class="custom-block-title">安全红线</p><p>永远不要将用户输入直接拼接到 SQL 字符串中。即使使用原生 SQL，也必须使用参数绑定（<code>?</code> 占位符）。</p></div><h3 id="文件上传安全" tabindex="-1">文件上传安全 <a class="header-anchor" href="#文件上传安全" aria-label="Permalink to &quot;文件上传安全&quot;">​</a></h3><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span>上传文件安全检查链：</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ 1. 文件大小限制（config/file.php → max_size，默认 10MB）</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ 2. 文件扩展名白名单（config/file.php → allow_ext）</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ 3. MIME 类型检查（fileinfo 扩展）</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ 4. 生成随机文件名（防止路径遍历攻击）</span></span>
<span class="line"><span> │</span></span>
<span class="line"><span> ▼ 5. 存储到 Web 根目录之外（或 Nginx 禁止执行 PHP）</span></span></code></pre></div><div class="language-ini vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">ini</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># Nginx 配置：上传目录禁止执行 PHP</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">location ~* /uploads/.*\\.php$ {</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> deny all</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">}</span></span></code></pre></div><h3 id="XSS-防护" tabindex="-1">XSS 防护 <a class="header-anchor" href="#XSS-防护" aria-label="Permalink to &quot;XSS 防护&quot;">​</a></h3><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span>防护措施：</span></span>
<span class="line"><span> 1. 前端：用户输入转义显示（Vue 默认转义 {{ }} 插值）</span></span>
<span class="line"><span> 2. 后端：富文本内容通过 save_content() 处理，过滤危险标签</span></span>
<span class="line"><span> 3. 响应头：Content-Type: application/json（非 text/html）</span></span></code></pre></div><h3 id="演示模式保护" tabindex="-1">演示模式保护 <a class="header-anchor" href="#演示模式保护" aria-label="Permalink to &quot;演示模式保护&quot;">​</a></h3><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// DemoMiddleware 拦截写操作</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// .env: [APP] DEMO = true</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 受保护：POST/PUT/DELETE 请求 → 返回 403</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 放行：GET 请求 + 标注 #[DemoAllow] 的方法</span></span></code></pre></div><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 标注 #[DemoAllow] 的方法在演示模式下仍可执行</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">#[</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;">DemoAllow</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">]</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">public</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> function</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> login</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">()</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">:</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;"> Json</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> {</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> ...</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> }</span></span></code></pre></div><h3 id="CORS-跨域控制" tabindex="-1">CORS 跨域控制 <a class="header-anchor" href="#CORS-跨域控制" aria-label="Permalink to &quot;CORS 跨域控制&quot;">​</a></h3><div class="language-ini vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">ini</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; .env</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 生产环境：限制具体域名</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">[</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#59873A;">CORS</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">]</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">ALLOW_ORIGIN</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> https://admin.example.com</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 开发环境：允许所有（仅限开发）</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">[</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#59873A;">CORS</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">]</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">ALLOW_ORIGIN</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> *</span></span></code></pre></div><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// CorsMiddleware 处理逻辑：</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 1. OPTIONS 预检请求 → 直接返回 204 + CORS 头</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 2. 普通请求 → 校验 Origin 是否在白名单</span></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// 3. 设置 Access-Control-Allow-Origin / Allow-Methods / Allow-Headers</span></span></code></pre></div><h2 id="四、审计机制" tabindex="-1">四、审计机制 <a class="header-anchor" href="#四、审计机制" aria-label="Permalink to &quot;四、审计机制&quot;">​</a></h2><h3 id="操作日志-think-operation-log-" tabindex="-1">操作日志（think_operation_log） <a class="header-anchor" href="#操作日志-think-operation-log-" aria-label="Permalink to &quot;操作日志（think_operation_log）&quot;">​</a></h3><p><code>LogMiddleware</code> 基于 <code>#[Log]</code> 注解自动记录所有写操作：</p><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">#[</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;">Log</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">用户管理-新增记录</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;"> Log</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;">TYPE_ADD</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">新增用户：{username}</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">]</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">public</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> function</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> add</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">()</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">:</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;"> Json</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> {</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> ...</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> }</span></span></code></pre></div><p><strong>记录字段：</strong></p><table tabindex="0"><thead><tr><th>字段</th><th>说明</th><th>示例</th></tr></thead><tbody><tr><td><code>title</code></td><td>操作标题（来自注解）</td><td>用户管理-新增记录</td></tr><tr><td><code>type</code></td><td>操作类型（常量）</td><td>1=新增 2=修改 3=删除 4=查询 5=导入 6=导出</td></tr><tr><td><code>method</code></td><td>HTTP 方法</td><td>POST</td></tr><tr><td><code>url</code></td><td>请求路径</td><td>/api/user/add</td></tr><tr><td><code>params</code></td><td>请求参数（JSON）</td><td>{&quot;username&quot;:&quot;admin&quot;}</td></tr><tr><td><code>ip</code></td><td>客户端 IP</td><td>192.168.1.100</td></tr><tr><td><code>location</code></td><td>IP 归属地</td><td>江苏省南京市</td></tr><tr><td><code>os</code></td><td>操作系统</td><td>Windows 10</td></tr><tr><td><code>browser</code></td><td>浏览器</td><td>Chrome 120</td></tr><tr><td><code>username</code></td><td>操作人</td><td>admin</td></tr><tr><td><code>status</code></td><td>执行状态</td><td>0=成功 1=失败</td></tr><tr><td><code>error_msg</code></td><td>错误信息（失败时）</td><td>用户名已存在</td></tr><tr><td><code>duration</code></td><td>执行耗时（ms）</td><td>125</td></tr><tr><td><code>create_time</code></td><td>操作时间</td><td>2026-09-22 10:30:00</td></tr></tbody></table><p><strong>记录规则：</strong></p><ul><li>写操作（POST/PUT/DELETE）始终记录</li><li>GET 查询操作仅在 <code>#[Log]</code> 指定 <code>TYPE_QUERY</code> 时记录</li><li>排除列表：<code>config/middleware.php</code> → <code>log_except</code> 中的路径不记录</li></ul><h3 id="登录日志-think-login-log-" tabindex="-1">登录日志（think_login_log） <a class="header-anchor" href="#登录日志-think-login-log-" aria-label="Permalink to &quot;登录日志（think_login_log）&quot;">​</a></h3><div class="language-php vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">php</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">// LoginLogic 中独立记录</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">requestInfo</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;"> RequestInfoService</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">create</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">request</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">());</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-dark-font-style:italic;--shiki-light:#998418;--shiki-light-font-style:inherit;">LoginLog</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">::</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">create</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">([</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">username</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">username</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">type</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 1</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 1=登录 2=登出</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">status</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">success</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> ?</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 0</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> :</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 1</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> // 0=成功 1=失败</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">message</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">msg</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">,</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">ip</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">requestInfo</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">-&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">getIp</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(),</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">location</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">requestInfo</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">-&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">getIpLocation</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(),</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">os</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">requestInfo</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">-&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">getOs</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(),</span></span>
<span class="line"><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> &#39;</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">browser</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">&#39;</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =&gt;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> $</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#B07D48;">requestInfo</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">-&gt;</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">getBrowser</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">(),</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">]);</span></span></code></pre></div><p><strong>记录字段：</strong></p><table tabindex="0"><thead><tr><th>字段</th><th>说明</th></tr></thead><tbody><tr><td><code>username</code></td><td>登录用户名（无论成功失败都记录）</td></tr><tr><td><code>type</code></td><td>1=登录 2=登出</td></tr><tr><td><code>status</code></td><td>0=成功 1=失败</td></tr><tr><td><code>message</code></td><td>结果消息（如&quot;登录成功&quot;、&quot;密码错误&quot;）</td></tr><tr><td><code>ip</code></td><td>客户端 IP</td></tr><tr><td><code>location</code></td><td>IP 归属地</td></tr><tr><td><code>os</code></td><td>操作系统</td></tr><tr><td><code>browser</code></td><td>浏览器</td></tr></tbody></table><h3 id="日志安全要点" tabindex="-1">日志安全要点 <a class="header-anchor" href="#日志安全要点" aria-label="Permalink to &quot;日志安全要点&quot;">​</a></h3><table tabindex="0"><thead><tr><th>要点</th><th>说明</th></tr></thead><tbody><tr><td>密码不记录</td><td>登录日志不记录密码字段</td></tr><tr><td>参数可脱敏</td><td>敏感字段建议在 Controller 层处理后再传入 Logic</td></tr><tr><td>独立存储</td><td>操作日志和登录日志分别存储在不同表</td></tr><tr><td>不可篡改</td><td>日志仅 INSERT，无 UPDATE/DELETE 接口</td></tr></tbody></table><h2 id="五、安全配置清单" tabindex="-1">五、安全配置清单 <a class="header-anchor" href="#五、安全配置清单" aria-label="Permalink to &quot;五、安全配置清单&quot;">​</a></h2><h3 id="环境变量-env-" tabindex="-1">环境变量（.env） <a class="header-anchor" href="#环境变量-env-" aria-label="Permalink to &quot;环境变量（.env）&quot;">​</a></h3><table tabindex="0"><thead><tr><th>配置项</th><th>开发环境</th><th>生产环境</th><th>说明</th></tr></thead><tbody><tr><td><code>APP_DEBUG</code></td><td><code>true</code></td><td><strong><code>false</code></strong></td><td>关闭调试模式，隐藏详细错误</td></tr><tr><td><code>SHOW_ERROR_MSG</code></td><td><code>true</code></td><td><strong><code>false</code></strong></td><td>隐藏原始错误信息</td></tr><tr><td><code>JWT.SECRET</code></td><td>默认值</td><td><strong>强随机密钥</strong></td><td>32 字节以上随机字符串</td></tr><tr><td><code>CORS.ALLOW_ORIGIN</code></td><td><code>*</code></td><td><strong>指定域名</strong></td><td>如 <code>https://admin.example.com</code></td></tr><tr><td><code>APP.DEMO</code></td><td><code>false</code></td><td><code>false</code></td><td>演示环境按需开启</td></tr><tr><td><code>FILE.MAX_SIZE</code></td><td>10MB</td><td>合理限制</td><td>防止大文件 DoS</td></tr><tr><td><code>API.CAMEL_SNAKE_CONVERT</code></td><td><code>true</code></td><td><code>true</code></td><td>驼峰转换开关</td></tr></tbody></table><h3 id="Nginx-配置" tabindex="-1">Nginx 配置 <a class="header-anchor" href="#Nginx-配置" aria-label="Permalink to &quot;Nginx 配置&quot;">​</a></h3><div class="language-nginx vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">nginx</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 1. 启用 HTTPS</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">server</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> {</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> listen </span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;">443</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> ssl</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> ssl_certificate </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> /etc/ssl/cert.pem</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> ssl_certificate_key </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">/etc/ssl/key.pem</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">}</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 2. 上传目录禁止执行 PHP</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">location</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> ~*</span><span style="--shiki-dark:#E7EE98;--shiki-light:#AB5E3F;"> /uploads/.*\\.php$ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">{</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> deny </span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;">all</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">}</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 3. 禁止访问隐藏文件</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">location</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> ~</span><span style="--shiki-dark:#E7EE98;--shiki-light:#AB5E3F;"> /\\. </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">{</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> deny </span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;">all</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">}</span></span>
<span class="line"></span>
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 4. 安全响应头</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">X-Content-Type-Options nosniff</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">X-Frame-Options DENY</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">X-XSS-Protection </span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">&quot;1; mode=block&quot;</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">Referrer-Policy strict-origin-when-cross-origin</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span></code></pre></div><h3 id="安全检查清单" tabindex="-1">安全检查清单 <a class="header-anchor" href="#安全检查清单" aria-label="Permalink to &quot;安全检查清单&quot;">​</a></h3><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span>上线前逐项检查：</span></span>
<span class="line"><span></span></span>
<span class="line"><span>□ .env 中 APP_DEBUG = false</span></span>
<span class="line"><span>□ .env 中 SHOW_ERROR_MSG = false</span></span>
<span class="line"><span>□ .env 中 JWT.SECRET 已更换为强随机密钥</span></span>
<span class="line"><span>□ .env 中 CORS.ALLOW_ORIGIN 指定具体域名</span></span>
<span class="line"><span>□ Nginx 已配置 HTTPS</span></span>
<span class="line"><span>□ Nginx 上传目录已禁止执行 PHP</span></span>
<span class="line"><span>□ 数据库密码为强密码</span></span>
<span class="line"><span>□ Redis 已设置密码（如使用）</span></span>
<span class="line"><span>□ 默认管理员密码已修改</span></span>
<span class="line"><span>□ 演示模式已关闭（除非需要）</span></span>
<span class="line"><span>□ 日志中不包含密码等敏感信息</span></span></code></pre></div><h2 id="总结" tabindex="-1">总结 <a class="header-anchor" href="#总结" aria-label="Permalink to &quot;总结&quot;">​</a></h2><p>系统通过认证、授权、防护、审计四层安全架构，实现了从网络层到数据层的纵深防御。JWT 双令牌认证保证无状态安全，RBAC 权限控制细化到按钮级，bcrypt 双重加盐保护密码安全，操作日志实现全链路审计。各层安全机制相互独立又协同配合，确保系统在企业级应用场景下的安全可靠性。</p>`,72)])])}const c=i(p,[["render",l]]);export{g as __pageData,c as default};
Reference in New Issue View Git Blame Copy Permalink