SpringCloud利用网关拦截做Token验证（JWT方式）

左手的ㄟ右手 2023-06-20 06:54 21阅读 0赞

关于JWT的内容，请看以下链接，主要看它的原理，以及缺点！

[https://blog.csdn.net/memmsc/article/details/78122931][https_blog.csdn.net_memmsc_article_details_78122931]

步骤1：前端传userName+password到后端，后端为springcloud架构，经过网关的拦截器拦截请求，拦截器在项目启动的时候@Component进行加载。

步骤2：如果是第一次登陆，放行，进入JWT的加密生成Token阶段（还可以写入登陆用户的其他信息放在JWTmap中，之后可以利用Token来获取该用户信息），加密token需要一个随机数作为加密字段，将token的失效时间设置为一天，并且放到reids里面，设置该redis里面的token过期时间为30分钟，最后将Token返回给前端。

步骤3：以后任何的请求都带Token到后端去请求。

步骤4：拦截到非登陆请求，进行解密，鉴权，如果鉴权通过，更新redis里面token字段的失效时间，如果还有5分钟失效，再设置还有30分钟，目的就是让密码的过期时间变的活跃。

大致就是以上的过程，核心代码主要在网关拦截器解密鉴权和登陆接口的加密两部分

0，controller层的将得到的token做保存redis和设置过期时间的操作

1.  compactJws = authService.generateJwt(username, password, userBean);
2.  //将token存在redis里
3.  stringRedisTemplate.opsForValue().set("token", compactJws);
4.  //设置redis里面的数据失效时间为半小时
5.  stringRedisTemplate.expire("token",1800,TimeUnit.SECONDS);

1，登陆接口的加密：

1.  package com.movitech.user.service.imp;
2.   
3.  import com.movitech.commons.entity.UserBean;
4.  import com.movitech.commons.utils.CommonConstants;
5.  import com.movitech.user.service.AuthService;
6.  import io.jsonwebtoken.Jwts;
7.  import io.jsonwebtoken.SignatureAlgorithm;
8.  import org.joda.time.DateTime;
9.  import org.springframework.stereotype.Service;
10.  
11. import java.util.Base64;
12. import java.util.HashMap;
13. import java.util.Map;
14.  
15. /\*\*
16. \* 用户身份验证Service
17. \*/
18. @Service(value = "authService")
19. public class AuthServiceImpl implements AuthService \{
20. @Override
21. public String generateJwt(String userName, String userPassword, UserBean userBean) \{
22. // Base64编码后的secretKey
23. byte\[\] secretKey = Base64.getEncoder().encode(CommonConstants.SECURITY\_KEY.getBytes());
24. // 设置失效时间
25. DateTime expirationDate = new DateTime().plusDays(1);
26. //DateTime expirationDate = new DateTime().plusMinutes(30);
27. // Claims是需要保存到token中的信息，可以自定义，需要存什么就放什么，会保存到token的payload中
28. Map<String, Object> claims = new HashMap<>();
29. // 用户角色
30. claims.put("role", "user");
31. // 用户名
32. claims.put("userName", userName);
33. claims.put(CommonConstants.USER\_ID, userBean.getId());
34. claims.put("uuid",UUID.randomUUID().toString());
35. String compactJws = Jwts.builder()
36. // 设置subject，一般是用户的唯一标识，比如用户对象的ID，用户名等，目前设置的是userCode
37. .setSubject(userName)
38. // 设置失效时间
39. .setExpiration(expirationDate.toDate())
40. .addClaims(claims)
41. // 加密算法是HS512，加密解密统一就可以
42. .signWith(SignatureAlgorithm.HS512, secretKey)
43. .compact();
44. return compactJws;
45. \}
46.  
47. \}

*  1

以上常量类和pojo此处省略。。。。

2，网关拦截器解密鉴权：

1.  package com.movitech.gateway.filter;
2.   
3.  import com.movitech.commons.dto.ErrorResponseMap;
4.  import com.movitech.commons.enums.ErrorCode;
5.  import com.movitech.commons.utils.CommonConstants;
6.  import com.movitech.commons.utils.JsonUtil;
7.  import com.movitech.commons.utils.ResponseUtil;
8.  import com.netflix.zuul.ZuulFilter;
9.  import com.netflix.zuul.context.RequestContext;
10. import io.jsonwebtoken.\*;
11. import org.springframework.cloud.netflix.zuul.filters.support.FilterConstants;
12. import org.springframework.http.HttpHeaders;
13. import org.springframework.http.HttpMethod;
14. import org.springframework.stereotype.Component;
15. import org.springframework.util.StringUtils;
16.  
17. import javax.servlet.http.HttpServletRequest;
18. import java.util.Base64;
19.  
20. @Component
21. public class SecurityFilter extends ZuulFilter \{
22. @Override
23. public String filterType() \{
24. return FilterConstants.PRE\_TYPE;
25. \}
26.  
27. @Override
28. public int filterOrder() \{
29. return FilterConstants.PRE\_DECORATION\_FILTER\_ORDER - 1;
30. \}
31.  
32. @Override
33. public boolean shouldFilter() \{
34. RequestContext ctx = RequestContext.getCurrentContext();
35. HttpServletRequest request = ctx.getRequest();
36. if (request.getRequestURL().toString().contains("loginInfo") || request.getRequestURL().toString().contains("info")) \{
37. return false;
38. \}
39. // TODO
40. return true;
41. \}
42.  
43. @Override
44. public Object run() \{
45. RequestContext ctx = RequestContext.getCurrentContext();
46. HttpServletRequest request = ctx.getRequest();
47. final String authorizationHeader = request.getHeader(HttpHeaders.AUTHORIZATION);
48.  
49. if (HttpMethod.OPTIONS.name().equals(request.getMethod())) \{
50. return null;
51. \} else \{
52. if (StringUtils.isEmpty(authorizationHeader) || !authorizationHeader.startsWith(CommonConstants.BEARER)) \{
53. // Missing or invalid Authorization header
54. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Missing or invalid Authorization header!",
55. ErrorCode.INVALID\_AUTHORIZATION\_HEADER, request, null);
56. denyAccess(ctx,errorResponseMap);
57. return JsonUtil.serializeToString(errorResponseMap);
58. \}
59. final String token = authorizationHeader.substring(7);
60. try \{
61. byte\[\] secretKey = Base64.getEncoder().encode(CommonConstants.SECURITY\_KEY.getBytes());
62. Claims claims = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token).getBody();
63. if (claims != null) \{
64. //获取redis里面数据的存活时间
65. Long expirationDate = stringRedisTemplate.getExpire("token",TimeUnit.SECONDS);
66. //如果还剩余5分钟，重置redis里面数据的存活时间
67. if(expirationDate > 300)\{
68. stringRedisTemplate.expire("token",1800,TimeUnit.SECONDS);
69. \}else \{
70. ErrorResponseMap errorResponseMap = new ErrorResponseMap();
71. Error error = new Error(null, "Token expired!", "", 1003,"");
72. errorResponseMap.setSuccess(false);
73. errorResponseMap.setMessage(null);
74. errorResponseMap.setError(error);
75. denyAccess(ctx,errorResponseMap);
76. return JsonUtil.serializeToString(errorResponseMap);
77. \}
78. String userName = (String) claims.get(CommonConstants.USER\_CODE);
79. Integer userId = (Integer) claims.get(CommonConstants.USER\_ID);
80. ctx.addZuulRequestHeader(CommonConstants.USER\_CODE, userName);
81. ctx.addZuulRequestHeader(CommonConstants.USER\_ID, String.valueOf(userId));
82. \}
83. \} catch (MalformedJwtException ex) \{
84. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Invalid token!",
85. ErrorCode.INVALID\_AUTHORIZATION\_HEADER, request, ex);
86. denyAccess(ctx,errorResponseMap);
87. return JsonUtil.serializeToString(errorResponseMap);
88. \} catch (SignatureException ex) \{
89. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Token Signature error!",
90. ErrorCode.SIGNATURE\_EXCEPTION, request, ex);
91. denyAccess(ctx,errorResponseMap);
92. return JsonUtil.serializeToString(errorResponseMap);
93. \} catch (ExpiredJwtException ex) \{
94. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Token expired!",
95. ErrorCode.EXPIRED\_JWT\_EXCEPTION, request, ex);
96. denyAccess(ctx,errorResponseMap);
97. return JsonUtil.serializeToString(errorResponseMap);
98. \}
99. \}
100. return null;
101. \}
102.  
103. private void denyAccess(RequestContext ctx, ErrorResponseMap authResult) \{
104. String result = JsonUtil.serializeToString(authResult);
105. ctx.setSendZuulResponse(false);
106. ctx.setResponseStatusCode(401);
107. try \{
108. ctx.getResponse().getWriter().write(result);
109. \}catch (Exception e)\{\}
110. \}
111. \}

*  1

以上代码是核心代码，下面是自己项目中涉及到的异常包装类，以及util类，可以不管下面的，直接去封装

以上涉及到的类：

（1）ErrorResponseMap

1.  package com.movitech.commons.dto;
2.   
3.  import com.fasterxml.jackson.annotation.JsonProperty;
4.  import com.movitech.commons.exception.Error;
5.  import lombok.Getter;
6.  import lombok.Setter;
7.   
8.  @Getter
9.  @Setter
10. public class ErrorResponseMap extends ResponseMap \{
11. @JsonProperty(value = "error")
12. private Error error;
13. @JsonProperty(value = "stackTrace")
14. private String stackTrace;
15. \}

*  1

（1.1）Error

1.  package com.movitech.commons.exception;
2.   
3.  import lombok.AllArgsConstructor;
4.  import lombok.Getter;
5.  import lombok.NoArgsConstructor;
6.  import lombok.Setter;
7.   
8.  @Getter
9.  @Setter
10. @NoArgsConstructor
11. @AllArgsConstructor
12. public class Error \{
13. // 标准的 Http status code
14. private Integer httpStatusCode;
15. // 自定义的错误说明
16. private String errorMsg;
17. // 异常信息
18. private String exceptionMsg;
19. // 自定义的错误代码
20. private Integer errorCode;
21. // 异常的类名
22. private String exceptionClassName;
23. \}

*  1

（2）ErrorCode

1.  package com.movitech.commons.enums;
2.   
3.  /\*\*
4.  \* 自定义的错误代码的枚举
5.  \*/
6.  public enum ErrorCode \{
7.  // Token 签名错误
8.  SIGNATURE\_EXCEPTION(1000),
9.  // Token 过期
10. EXPIRED\_JWT\_EXCEPTION(1001),
11. // 无效的Authorization header
12. INVALID\_AUTHORIZATION\_HEADER(1002);
13. private Integer errorCode;
14. ErrorCode(Integer errorCode) \{
15. this.errorCode = errorCode;
16. \}
17.  
18. @Override
19. public String toString() \{
20. return errorCode.toString();
21. \}
22.  
23. public Integer value() \{
24. return errorCode;
25. \}
26. \}

*  1

（3）JsonUtil

1.  package com.movitech.commons.utils;
2.   
3.  import com.fasterxml.jackson.core.JsonProcessingException;
4.  import com.fasterxml.jackson.databind.\*;
5.  import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
6.  import org.springframework.stereotype.Component;
7.  import org.springframework.util.StringUtils;
8.   
9.  import java.io.IOException;
10.  
11. /\*\*
12. \* Json序列化和反序列化
13. \*/
14. @Component
15. public class JsonUtil
16. \{
17. public static ObjectMapper mapper;
18. /\* static \{
19. dao = new ObjectMapper();
20. dao.configure(SerializationFeature.WRAP\_ROOT\_VALUE,true);
21. dao.configure(DeserializationFeature.UNWRAP\_ROOT\_VALUE, true);
22. \}\*/
23.  
24. public JsonUtil(Jackson2ObjectMapperBuilder jackson2ObjectMapperBuilder) \{
25. mapper = jackson2ObjectMapperBuilder.build();
26. \}
27.  
28. public static String serializeToString(Object object) \{
29. return serializeToString(object,false);
30. \}
31.  
32. public static String serializeToString(Object object,Boolean rootValueState) \{
33. SerializationConfig serializationConfig = mapper.getSerializationConfig();
34. mapper.configure(SerializationFeature.WRAP\_ROOT\_VALUE,rootValueState);
35. if (object != null) \{
36. try \{
37. return mapper.writeValueAsString(object);
38. \} catch (JsonProcessingException e) \{
39. e.printStackTrace();
40. \} finally \{
41. mapper.setConfig(serializationConfig);
42. \}
43. \}
44. return "";
45. \}
46.  
47. public static byte\[\] serializeToBytes(Object object) \{
48. if (object != null) \{
49. try \{
50. return mapper.writeValueAsBytes(object);
51. \} catch (JsonProcessingException e) \{
52. e.printStackTrace();
53. \}
54. \}
55. return null;
56. \}
57.  
58. /\*\*
59. \* 反序列化Json数据
60. \* @param jsonData Json数据字符串
61. \* @param valueType 反序列化的类型
62. \* @param rootValueState 是否解析Json root name
63. \* @param <T>
64. \* @return 反序列化后的POJO
65. \*/
66. public static <T> T deserialize(String jsonData,Class<T> valueType,Boolean rootValueState) \{
67. if (StringUtils.isEmpty(jsonData) || rootValueState == null) \{
68. return null;
69. \}
70. DeserializationConfig deserializationConfig = mapper.getDeserializationConfig();
71. mapper.configure(DeserializationFeature.UNWRAP\_ROOT\_VALUE,rootValueState);
72. try \{
73. return mapper.readValue(jsonData, valueType);
74. \} catch (IOException e) \{
75. e.printStackTrace();
76. \} finally \{
77. mapper.setConfig(deserializationConfig);
78. \}
79. return null;
80. \}
81.  
82. /\*\*
83. \* 反序列化Json数据,默认解析Json root name
84. \* @param jsonData Json数据字符串
85. \* @param valueType 反序列化的类型
86. \* @param <T>
87. \* @return 反序列化后的POJO
88. \*/
89. public static <T> T deserialize(String jsonData,Class<T> valueType) \{
90. return deserialize(jsonData, valueType, true);
91. \}
92.  
93. public static JavaType getCollectionType(Class<?> collectionClass, Class<?>... elementClasses) \{
94. return mapper.getTypeFactory().constructParametricType(collectionClass, elementClasses);
95. \}
96.  
97. /\*\*
98. \* 用Json数据中的key获取对应的value
99. \* @param jsonString json数据字符串
100. \* @param field 需要取值的字段
101. \* @param rootValueState 是否解析Json root name
102. \* @return 字段对应的值
103. \*/
104. public static String getValue(String jsonString,String field,Boolean rootValueState) \{
105. JsonNode node = getJsonNode(jsonString,field,rootValueState);
106. return node == null ? "" : node.toString();
107. \}
108.  
109. /\*\*
110. \* 用Json数据中的key获取对应的value, 默认解析Json root name
111. \* @param jsonString json数据字符串
112. \* @param field 需要取值的字段
113. \* @return 字段对应的值
114. \*/
115. public static String getValue(String jsonString,String field) \{
116. return getValue(jsonString,field,true);
117. \}
118.  
119. /\*\*
120. \* 用Json数据中的key获取对应的value
121. \* @param jsonString json数据字符串
122. \* @param field 需要取值的字段
123. \* @param rootValueState 是否解析Json root name
124. \* @return 字段对应的值
125. \*/
126. public static JsonNode getJsonNode(String jsonString, String field, Boolean rootValueState) \{
127. if (StringUtils.isEmpty(jsonString) || StringUtils.isEmpty(field) || rootValueState == null) \{
128. return null;
129. \}
130. // 准备工作 传入vo请参照第一篇里面的实体。此处不再重新贴上代码 浪费大家时间
131. JsonNode node = null;// 这里的JsonNode和XML里面的Node很像
132. // 默认的反序列化配置
133. DeserializationConfig deserializationConfig = mapper.getDeserializationConfig();
134. mapper.configure(DeserializationFeature.UNWRAP\_ROOT\_VALUE,rootValueState);
135. try \{
136. node = mapper.readTree(jsonString);
137. \} catch (IOException e) \{
138. e.printStackTrace();
139. return null;
140. \} finally \{
141. mapper.setConfig(deserializationConfig);
142. \}
143. return node.get(field) == null ? null : node.get(field);
144. \}
145. \}

*  1

（4）ResponseUtil

1.  package com.movitech.commons.utils;
2.   
3.  import com.movitech.commons.dto.ErrorResponseMap;
4.  import com.movitech.commons.enums.ErrorCode;
5.  import com.movitech.commons.exception.Error;
6.  import org.springframework.http.HttpStatus;
7.  import org.springframework.http.ResponseEntity;
8.   
9.  import javax.servlet.http.HttpServletRequest;
10.  
11. public class ResponseUtil \{
12. public static ResponseEntity createResponseEntity(String errorMsg, ErrorCode errorCode, HttpServletRequest request, Throwable ex) \{
13. HttpStatus status = getStatus(request);
14. ErrorResponseMap errorResponseMap = createErrorResponse(status, errorMsg, errorCode, request, ex);
15. return new ResponseEntity<>(errorResponseMap, status);
16. \}
17.  
18. public static ErrorResponseMap createErrorResponse(HttpStatus status, String errorMsg, ErrorCode errorCode, HttpServletRequest request, Throwable ex) \{
19. if (status == null) \{
20. status = getStatus(request);
21. \}
22. ErrorResponseMap errorResponseMap = new ErrorResponseMap();
23. Error error = new Error(status.value(), errorMsg, ex == null ? "" : ex.getMessage(),
24. errorCode == null ? HttpStatus.INTERNAL\_SERVER\_ERROR.value() : errorCode.value(), ex == null ? "" : ex.getClass().getCanonicalName());
25. errorResponseMap.setSuccess(false);
26. errorResponseMap.setMessage(ex.getMessage());
27. errorResponseMap.setError(error);
28. // String stackTrace = StringUtils.arrayToDelimitedString(ex.getStackTrace(), "hahaha");
29. // errorResponseMap.setStackTrace(stackTrace);
30. return errorResponseMap;
31. \}
32.  
33. public static HttpStatus getStatus(HttpServletRequest request) \{
34. Integer statusCode = (Integer) request.getAttribute("javax.servlet.error.status\_code");
35. if (statusCode == null) \{
36. return HttpStatus.INTERNAL\_SERVER\_ERROR;
37. \}
38. return HttpStatus.valueOf(statusCode);
39. \}
40. \}

*  1

[https_blog.csdn.net_memmsc_article_details_78122931]: https://blog.csdn.net/memmsc/article/details/78122931