fix: api请求验证

src/service/middleware.js

@@ -1,11 +1,23 @@
 const { inject } = require('../common/Provider');
 const { verifyToken, createToken } = require('../utils/jwt');
+const crypto = require('../utils/crypto');
+
 const ignoreToken = ['/sign/check', '/sign/in', '/sign/up', '/sign/upwi', '/sign/forget', '/sign/send', '/sign/changePwd', '/sign/code'];
 module.exports = {
     auth: inject(function (SysConfig) {
         const { JWT_SECRET } = SysConfig;
+        if (!SysConfig.LIMITSALT) mylog.error('缺少限流密钥');
         return async (req, res, next) => {
             const token = req.headers.token;
+            if (ignoreToken.includes(req.path)) {
+                const { sig, ts } = req.headers;
+                const salt = SysConfig.LIMITSALT;
+                const my = crypto.hash(ts + req.path + salt, { hasher: 'md5' });
+                const invalid = sig !== my || Date.now() - ts > 60000;
+                if (invalid) {
+                    return res.status(403).send('unauthorized');
+                }
+            }
             if(!ignoreToken.includes(req.path)) {
                 if (token) {
                     const deToken = await verifyToken(token, JWT_SECRET);