diff --git a/package-lock.json b/package-lock.json index 1a64f4a..2dbd2de 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13,7 +13,6 @@ "axios": "^1.6.2", "dotenv": "^16.3.1", "express": "^4.18.2", - "express-basic-auth": "^1.2.1", "node-pdu": "^2.1.2", "nodemailer": "^6.9.7", "serialport": "^12.0.0", @@ -2045,4 +2044,4 @@ } } } -} +} \ No newline at end of file diff --git a/package.json b/package.json index ec76498..23bbcf2 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,6 @@ "@serialport/parser-readline": "^12.0.0", "node-pdu": "^2.1.2", "express": "^4.18.2", - "express-basic-auth": "^1.2.1", "nodemailer": "^6.9.7", "axios": "^1.6.2", "winston": "^3.11.0", @@ -32,4 +31,4 @@ "devDependencies": { "nodemon": "^3.0.2" } -} +} \ No newline at end of file diff --git a/public/admin.html b/public/admin.html index 861eb71..17d769a 100644 --- a/public/admin.html +++ b/public/admin.html @@ -411,7 +411,7 @@ SMS Gateway - © 2026 · Basic Auth protected · Built on Node.js + + © 2026 · Token protected · Built on Node.js + ML307A diff --git a/src/api.js b/src/api.js index c56f0eb..853dfbd 100644 --- a/src/api.js +++ b/src/api.js @@ -50,7 +50,7 @@ class APIServer { // JSON解析 this.app.use(express.json()); - // Web Token认证，API保留Basic Auth兼容 + // Web Token认证 this.app.use((req, res, next) => { this.authenticateRequest(req, res, next); }); @@ -75,22 +75,23 @@ class APIServer { return next(); } - if (this.isWebRoute(req) && this.getConfiguredWebToken()) { - return this.sendTokenGate(res); - } + if (this.isWebRoute(req)) { + const webToken = this.getConfiguredWebToken(); + if (webToken) { + return this.sendTokenGate(res); + } - if (this.hasValidBasicAuth(req)) { - return next(); + return res.status(401).send('未配置 webToken'); } if (req.path.startsWith('/api/')) { return res.status(401).json({ success: false, - error: this.getConfiguredWebToken() ? '需要有效token或Basic Auth' : '需要Basic Auth' + error: this.getConfiguredWebToken() ? '需要有效token' : '未配置webToken' }); } - return this.sendBasicAuthChallenge(res); + return res.status(401).send(this.getConfiguredWebToken() ? '需要有效token' : '未配置 webToken'); } getConfiguredWebToken() { @@ -143,24 +144,6 @@ class APIServer { return `${url.pathname}${url.search}`; } - hasValidBasicAuth(req) { - const auth = req.get('authorization') || ''; - if (!auth.startsWith('Basic ')) { - return false; - } - - const decoded = Buffer.from(auth.slice(6), 'base64').toString('utf8'); - const separatorIndex = decoded.indexOf(':'); - if (separatorIndex === -1) { - return false; - } - - const username = decoded.slice(0, separatorIndex); - const password = decoded.slice(separatorIndex + 1); - return this.safeEqual(username, this.config.api.auth.username) && - this.safeEqual(password, this.config.api.auth.password); - } - safeEqual(actual, expected) { const actualBuffer = Buffer.from(String(actual)); const expectedBuffer = Buffer.from(String(expected)); @@ -176,11 +159,6 @@ class APIServer { return req.path === '/' || req.path === '/admin' || req.path.startsWith('/assets/'); } - sendBasicAuthChallenge(res) { - res.set('WWW-Authenticate', 'Basic realm="SMS Gateway"'); - return res.status(401).send('Authentication required'); - } - sendTokenGate(res) { res.set('Cache-Control', 'no-store'); return res.status(401).type('html').send(`