From a97deb3dca674b63cb17709460dd0501c705365e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=98=AD?= <81747598+lan-yonghui@users.noreply.github.com>
Date: Thu, 20 Feb 2025 13:29:26 +0800
Subject: [PATCH] feat: API timestamp verification (#7927)

* feat: API timestamp verification

* feat: API timestamp verification
---
 backend/middleware/session.go | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/backend/middleware/session.go b/backend/middleware/session.go
index 51d535edc..c56ce5327 100644
--- a/backend/middleware/session.go
+++ b/backend/middleware/session.go
@@ -71,18 +71,25 @@ func SessionAuth() gin.HandlerFunc {
 func isValid1PanelTimestamp(panelTimestamp string) bool {
 	apiKeyValidityTime := global.CONF.System.ApiKeyValidityTime
 	apiTime, err := strconv.Atoi(apiKeyValidityTime)
-	if err != nil {
+	if err != nil || apiTime < 0 {
+		global.LOG.Errorf("apiTime %d, err: %v", apiTime, err)
 		return false
 	}
+	if apiTime == 0 {
+		return true
+	}
 	panelTime, err := strconv.ParseInt(panelTimestamp, 10, 64)
 	if err != nil {
+		global.LOG.Errorf("panelTimestamp %s, panelTime %d, apiTime %d, err: %v", panelTimestamp, apiTime, panelTime, err)
 		return false
 	}
 	nowTime := time.Now().Unix()
-	if panelTime > nowTime {
+	tolerance := int64(60)
+	if panelTime > nowTime+tolerance {
+		global.LOG.Errorf("Valid Panel Timestamp, apiTime %d, panelTime %d, nowTime %d, err: %v", apiTime, panelTime, nowTime, err)
 		return false
 	}
-	return apiTime == 0 || nowTime-panelTime <= int64(apiTime*60)
+	return nowTime-panelTime <= int64(apiTime)*60+tolerance
 }
 
 func isValid1PanelToken(panelToken string, panelTimestamp string) bool {