fix: improve login authentication against digest replay and stale timestamps (#24)

Add a ±180s timestamp window and in-process digest replay cache; warn when auth.token is empty
2026-09-22 00:01:31 +00:00 · 2026-09-17 01:46:48 +08:00
parent 983c6a9b1e
commit 01284e0cd5
7 changed files with 153 additions and 18 deletions
@@ -58,6 +58,9 @@ public final class OrbienClient implements AutoCloseable {
            started.set(false);
            throw new IllegalStateException("tcpMux is not supported; set tcpMux=false on client and server");
        }
+        if (config.getToken() == null || config.getToken().isEmpty()) {
+            log.warn("auth.token is empty; authentication is disabled");
+        }

        group = new NioEventLoopGroup();
        CompletableFuture<String> loginFuture = new CompletableFuture<>();