JSON Web Token的使用

JSON Web Token（JWT）是一个非常轻巧的规范。这个规范允许我们使用JWT在用户和服务器之间传递安全可靠的信息。
1、

1 <dependency>
2     <groupId>io.jsonwebtoken</groupId>
3     <artifactId>jjwt</artifactId>
4     <version>0.6.0</version>
5 </dependency>

2、创建TokenUtils类

 1 package xxxxxx;
 2 
 3 import java.security.Key;
 4 import java.util.Date;
 5 import java.util.Map;
 6 
 7 import javax.crypto.spec.SecretKeySpec;
 8 
 9 import org.apache.commons.codec.binary.Base64;
10 
11 import xxxxxx.Cst;
12 
13 import io.jsonwebtoken.Claims;
14 import io.jsonwebtoken.Jws;
15 import io.jsonwebtoken.JwtBuilder;
16 import io.jsonwebtoken.Jwts;
17 import io.jsonwebtoken.SignatureAlgorithm;
18 import io.jsonwebtoken.impl.crypto.MacProvider;
19 
20 public class TokenUtils {
21     // 版本
22     public static String TOKEN_VERSION = "1";
23     // 设置发行人
24     public static String ISSUER = "zhicall";
25     // 设置抽象主题
26     public static String SUBJECT = "subject";
27     
28     // HS256 私钥
29     public static String HS256KEY = "xxxxxx";
30     
31     public static SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
32     
33     public static Key signingKey = new SecretKeySpec(Base64.decodeBase64(HS256KEY), signatureAlgorithm.getJcaName());
34 
35     public static String getJWTString(String login, Map<String, Object> claims) {
36         
37         long nowMillis = System.currentTimeMillis();
38         claims.put(Claims.ID, TOKEN_VERSION);
39         claims.put(Claims.ISSUER, ISSUER);
40         claims.put(Claims.SUBJECT, SUBJECT);
41         claims.put(Claims.AUDIENCE, login);
42         claims.put(Claims.EXPIRATION, new Date(nowMillis + (Cst.TOKEN_TIMEOUT_MIN * 60 * 1000)));
43         claims.put(Claims.ISSUED_AT, new Date(nowMillis));
44         
45         JwtBuilder jwtBuilder = Jwts.builder().setClaims(claims);
46         //System.out.println(System.currentTimeMillis() - nowMillis);
47         jwtBuilder.signWith(signatureAlgorithm, signingKey);
48         return jwtBuilder.compact();
49     }
50 
51     public static boolean isValid(String token) {
52         try {
53             Jws<Claims> jwsClaims = Jwts.parser().setSigningKey(signingKey).parseClaimsJws(token.trim());
54             Long exp = (Long) jwsClaims.getBody().get(Claims.EXPIRATION);
55             //System.out.println(exp - System.currentTimeMillis());
56             return exp - System.currentTimeMillis() > 0;
57         } catch (Exception e) {
58             e.printStackTrace();
59             return false;
60         }
61     }
62 
63     public static Map<String, Object> parseJWTtoMap(String token) {
64         Claims claims = Jwts.parser().setSigningKey(signingKey).parseClaimsJws(token.trim()).getBody();
65         return claims;
66     }
67     
68     public static String getHS512Key() {
69         Key key = MacProvider.generateKey(SignatureAlgorithm.HS512);
70         String keyStr = Base64.encodeBase64String(key.getEncoded());
71         return keyStr;
72     }
73 }

3、调用getJWTString(String login, Map<String, Object> claims)方法可以创建token、claims是个map，可以传入其他的信息，比如权限，角色等信息、