feature & fix: 正式发布0.0.6版本, 增加header-secret校验.

src/main/java/cn/quantgroup/tech/security/SecurityUtil.java

@@ -12,6 +12,12 @@ public class SecurityUtil {
 
 
     public static ZUser extractHeader(HttpServletRequest request) {
+        // valid secret.
+        String secret = request.getHeader(ZUser.HEADER_SECRET_KEY_FROM_GATEWAY);
+        if (StringUtils.isEmpty(secret) || !secret.equals(ZUser.HEADER_SECRET_VAL_FROM_GATEWAY)) {
+            return null;
+        }
+
         String uuid = request.getHeader(ZUser.HEADER_UUID);
         if (StringUtils.isNotEmpty(uuid)) {
             String userIdStr = request.getHeader(ZUser.HEADER_USER_ID);

src/main/java/cn/quantgroup/tech/security/ZUser.java

@@ -23,6 +23,8 @@ public class ZUser implements UserDetails {
     public static final String HEADER_USER_ID = "z-user-id";
     public static final String HEADER_UUID = "z-user-uuid";
     public static final String HEADER_PHONE_NO = "z-user-phone-no";
+    public static final String HEADER_SECRET_KEY_FROM_GATEWAY = "z-user-secret";
+    public static final String HEADER_SECRET_VAL_FROM_GATEWAY = "z.h,w44RXMu4XL#dq_%@ZX,u*gd]zVhmdks@H8krq*Gn-CC:6>YTHX_Kh=_#D7LR";
 
     private String uuid;
     private Long userId;