springBoot jwt 登录token验证

深碍√TFBOYSˉ_ 2023-10-12 07:24 5阅读 0赞

1、pom

<dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>0.9.1</version>
            </dependency>
    
            <dependency>
                <groupId>com.auth0</groupId>
                <artifactId>java-jwt</artifactId>
                <version>3.4.0</version>
            </dependency>
    
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>1.2.47</version>
            </dependency>
    
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <optional>true</optional>
            </dependency>

2、个人配置

jwt:
      # 超时时间
      timeOut: 180000
      # 加密秘钥
      secret: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9

3、实体类

@Data
    public class User {
    
        String id;
        String username;
        String password;
    }

4、url拦截

@Configuration
    public class WebFilter implements WebMvcConfigurer {
        @Override
        public void addInterceptors(InterceptorRegistry registry) {
            registry.addInterceptor(authenticationInterceptor())
                    .addPathPatterns("/**");    // 拦截所有请求，通过判断是否有 @LoginRequired 注解 决定是否需要登录
        }
        @Bean
        public LoginTokenFilter authenticationInterceptor() {
            return new LoginTokenFilter();
        }
    }

注解拦截判断

public class LoginTokenFilter implements HandlerInterceptor {
    
        @Autowired
        UserRepository userService;
    
        @Autowired
        private JwtConfig jwtConfig ;
    
        @Override
        public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object object) throws Exception {
            String token = httpServletRequest.getHeader("token");// 从 http 请求头中取出 token
            // 如果不是映射到方法直接通过
            if (!(object instanceof HandlerMethod)) {
                return true;
            }
            HandlerMethod handlerMethod = (HandlerMethod) object;
            Method method = handlerMethod.getMethod();
            //检查是否有passtoken注释，有则跳过认证
            if (method.isAnnotationPresent(PassToken.class)) {
                PassToken passToken = method.getAnnotation(PassToken.class);
                if (passToken.required()) {
                    return true;
                }
            }
            //检查有没有需要用户权限的注解
            if (method.isAnnotationPresent(UserLoginToken.class)) {
                UserLoginToken userLoginToken = method.getAnnotation(UserLoginToken.class);
                if (userLoginToken.required()) {
                    // 执行认证
                    if (token == null) {
                        throw new RuntimeException("无token，请重新登录");
                    }
                    // 获取 token 中的 user id
                    String userId;
                    try {
                        userId = JWT.decode(token).getAudience().get(0);
                    } catch (JWTDecodeException j) {
                        throw new RuntimeException("token不合法id，请重新登录");
                    }
                    User user = userService.findUserById(userId);
                    if (user == null) {
                        throw new RuntimeException("用户不存在，请重新登录");
                    }
                    // 验证 token
                    JWTVerifier jwtVerifier = JWT.require(Algorithm.HMAC256(user.getPassword() + jwtConfig.getSecret())).build();
                    try {
                        jwtVerifier.verify(token);
                    } catch (JWTVerificationException e) {
                        throw new RuntimeException("token不合法password，请重新登录");
                    }
                    return true;
                }
            }
            return true;
        }
    
        @Override
        public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {
    
        }
    
        @Override
        public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {
    
        }
    }

token 获取工具类

@Service
    public class TokenService {
    
        @Autowired
        private JwtConfig jwtConfig ;
    
        public String getToken(User user) {
            Date date = new Date(System.currentTimeMillis() + jwtConfig.getTimeOut());
            String token = JWT.create().withAudience(user.getId())// 将 user id 保存到 token 里面
                    .withExpiresAt(date)
                    .sign(Algorithm.HMAC256(user.getPassword() + jwtConfig.getSecret()));// 以 password 作为 token 的密钥
            return token;
        }
    }

5、测试类

@RestController
    public class LoginController {
    
        @Autowired
        UserRepository userRepository;
    
        @Autowired
        TokenService tokenService;
    
        @PostMapping("/login")
        public Object login(@RequestBody User user){
            JSONObject jsonObject=new JSONObject();
            User userForBase = userRepository.findByUsername(user);
            if(userForBase==null){
                jsonObject.put("message","登录失败,用户不存在");
                return jsonObject;
            }else {
                if (!userForBase.getPassword().equals(user.getPassword())){
                    jsonObject.put("message","登录失败,密码错误");
                    return jsonObject;
                }else {
                    String token = tokenService.getToken(userForBase);
                    jsonObject.put("token", token);
                    jsonObject.put("user", userForBase);
                    return jsonObject;
                }
            }
        }
    }

@RestController
    public class UserController {
    
        @Autowired
        UserRepository userRepository;
    
        @UserLoginToken
        @GetMapping("/getAll")
        public List<User> findUserAll(){
            return userRepository.findAll();
        }
    }

先同过localhost:8080/login 发送post   user信息登录

然后通过localhost:8080/getAll 发送get 消息头带上token 获取信息

码云源码

[https://gitee.com/graycat/Server-setup/tree/master/jjwt][https_gitee.com_graycat_Server-setup_tree_master_jjwt]

spring security其他人博客

[https://blog.csdn.net/qq\_22172133/category\_8615344.html][https_blog.csdn.net_qq_22172133_category_8615344.html]

[https_gitee.com_graycat_Server-setup_tree_master_jjwt]: https://gitee.com/graycat/Server-setup/tree/master/jjwt
[https_blog.csdn.net_qq_22172133_category_8615344.html]: https://blog.csdn.net/qq_22172133/category_8615344.html