huangting/th-hotel-simple
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复 SuperAgent Open API CSRF 请求头

Browse Source
This commit is contained in:
andy
2026-07-13 09:59:45 +08:00
parent 20eac61cb6
commit dec98b0632
6 changed files with 42 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
server/src/main/java/cn/nianxx/thhotel/integrations/ai/superagent/service/impl/SuperAgentOpenApiClientImpl.java
View File

@@ -11,10 +11,12 @@ import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.util.Base64;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.function.Consumer;
@@ -27,6 +29,11 @@ import org.springframework.stereotype.Service;
@Service
public class SuperAgentOpenApiClientImpl implements SuperAgentOpenApiClient {
private static final String CSRF_HEADER_NAME = "X-CSRF-Token";
private static final String CSRF_COOKIE_NAME = "csrf_token";
private static final int CSRF_TOKEN_BYTES = 32;
private static final SecureRandom CSRF_RANDOM = new SecureRandom();
private final SuperAgentOpenApiProperties properties;
private final SuperAgentOpenApiSseParser sseParser;
private final ObjectMapper objectMapper;
@@ -198,15 +205,27 @@ public class SuperAgentOpenApiClientImpl implements SuperAgentOpenApiClient {
* 构造 SuperAgent Open API 通用请求头，不记录或返回 API Key。
*/
private HttpRequest.Builder baseRequest(URI uri, String requestId) {
String csrfToken = newCsrfToken();
HttpRequest.Builder builder = HttpRequest.newBuilder(uri)
.header("Authorization", "Bearer " + properties.getApiKey())
.header("Cache-Control", "no-cache");
.header("Cache-Control", "no-cache")
.header(CSRF_HEADER_NAME, csrfToken)
.header("Cookie", CSRF_COOKIE_NAME + "=" + csrfToken);
if (!blank(requestId)) {
builder.header("X-Request-ID", requestId);
}
return builder;
}
/**
* 生成临时 CSRF double-submit token。该值只用于当前 HTTP 请求，不作为长期 Secret 保存或输出。
*/
private String newCsrfToken() {
byte[] bytes = new byte[CSRF_TOKEN_BYTES];
CSRF_RANDOM.nextBytes(bytes);
return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
}
/**
* 校验 HTTP 状态码，错误摘要不包含 Secret。
*/