项目总结67：Springboot中使用JWT+Token鉴权示例
START
代码示例
pom文件
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.7.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.4.0</version>
</dependency>
JwtUtils类：创建JWT，解析JWT
import io.jsonwebtoken.*; import javax.crypto.SecretKey; import javax.crypto.spec.SecretKeySpec; import java.util.Base64; import java.util.Date; public class JwtUtils { public final static String JWT_KEY = "aaabbcccdd"; //1-创建JWT public static String createJWT(String id, String subject, Long ttlMillis){ Date now = new Date(); Date expireDate = new Date(now.getTime()+ttlMillis); SecretKey secretKey = generateKey(); JwtBuilder jwtBuilder = Jwts.builder() .setHeaderParam("typ", "JWT")// .setId(id) .setSubject(subject) .setIssuer("tangyujie") .setIssuedAt(now) .setExpiration(expireDate) .signWith(SignatureAlgorithm.HS256, secretKey); //jwtBuilder.compact() = base64UrlEncodedHeader + '.' + base64UrlEncodedBody + '.' + base64UrlSignature; return jwtBuilder.compact(); } //生成key private static SecretKey generateKey(){ byte[] encodeKey = Base64.getDecoder().decode(JWT_KEY); return new SecretKeySpec(encodeKey,0,encodeKey.length,"AES"); } //获取token中注册信息 public static Claims getTokenClaim(String token){ SecretKey secretKey = generateKey(); try { return Jwts.parser() .setSigningKey(secretKey) .parseClaimsJws(token) .getBody(); } catch (Exception e) { return null; } } //验证token是否过期 public static boolean isTokenExpired(Date expirationTime){ return expirationTime.before(new Date()); } }
WebAppConfig： 实现WebMvcConfigurer接口，作拦截请求
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.InterceptorRegistry; import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; //WebMvcConfigurer是一个接口，提供很多自定义的拦截器，例如跨域设置、类型转化器等等 @Configuration public class WebAppConfig implements WebMvcConfigurer { @Autowired private TokenInterceptor tokenInterceptor; //静态资源处理(这里是开放了Swagger组件的鉴权，因项目而异) @Override public void addResourceHandlers(ResourceHandlerRegistry registry) { registry.addResourceHandler("swagger-ui.html") .addResourceLocations("classpath:/META-INF/resources/"); registry.addResourceHandler("doc.html") .addResourceLocations("classpath:/META-INF/resources/"); registry.addResourceHandler("/webjars/**") .addResourceLocations("classpath:/META-INF/resources/webjars/"); registry.addResourceHandler("/swagger-resources/**") .addResourceLocations("classpath:/META-INF/resources/swagger-resources/**"); registry.addResourceHandler("/swagger/**") .addResourceLocations("classpath:/META-INF/resources/swagger*"); registry.addResourceHandler("/v2/**") .addResourceLocations("classpath:/META-INF/resources/v2/**"); } //拦截器:拦截或允许请求 @Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(tokenInterceptor) .addPathPatterns("/**") .excludePathPatterns("/login") .excludePathPatterns("/doc.html","/swagger-resources/**","/webjars/**","/v2/**","/swagger-ui.html","/","/error","/csrf","/favico*","/api-docs","swagger.json"); } }
TokenInterceptor类：拦截器
import io.jsonwebtoken.Claims; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.lang.Nullable; import org.springframework.stereotype.Component; import org.springframework.util.StringUtils; import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.handler.HandlerInterceptorAdapter; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.security.SignatureException; @Component public class TokenInterceptor extends HandlerInterceptorAdapter { private final Logger logger = LoggerFactory.getLogger(TokenInterceptor.class); //在方法被调用前执行。 @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { logger.info("request start urL:{}",request.getRequestURL()); String token = request.getHeader("Authorization");//从header中获取Authorization //重新登陆判断 if(StringUtils.isEmpty(token)){ throw new SignatureException("登陆信息为空，或者失效，请重新登陆"); } Claims claims = JwtUtils.getTokenClaim(token);//从token中解析出Claims if(claims == null){ throw new SignatureException("登陆信息为空，或者失效，请重新登陆"); } if(JwtUtils.isTokenExpired(claims.getExpiration())){ throw new SignatureException("登陆信息过期，请重新登陆"); } String account = claims.getSubject();//从claims中获取subject request.setAttribute("account",account);//将数据放在request中 return true; } //在方法执行后调用 @Override public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable ModelAndView modelAndView) throws Exception { logger.info("request over uri:{}",request.getRequestURI()); } }
controller类：模拟接口请求
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.RestController; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.util.UUID; /*** *@description *@author viruser *@date 2020/9/8 20:04 */ @RestController @RequestMapping("") public class LoginController { //1-登陆(认证+生成token) @GetMapping("/login") public Object login( @RequestParam String account, @RequestParam String password, HttpServletResponse response){ //1- 根据帐号密码请求数据库，获取用户信息 //......模拟用户,将account放进accessToken中 //2- 生成jwt String accessToken = JwtUtils.createJWT(UUID.randomUUID().toString(), account, 7200000L); //3-在header中返回accessToken response.setHeader("accessToken",accessToken); return "success and accessToken: " + accessToken; } //2-查询(示例如何获取请求域中的数据) @GetMapping("/user") public String getUserInfo(HttpServletRequest request){ String account = String.valueOf(request.getAttribute("account"));////从request中取出数据 return "account: " + account; } }
END