springboot如何使用jwt进行token的验证

冷不防 2022-11-21 09:46 188阅读 0赞

1.  `引入pom依赖`

2.`编写JWTUtils工具类`

package com.ran.utils;
    
    import com.auth0.jwt.JWT;
    import com.auth0.jwt.JWTCreator;
    import com.auth0.jwt.algorithms.Algorithm;
    import com.auth0.jwt.interfaces.DecodedJWT;
    
    import java.util.Calendar;
    import java.util.Map;
    
    public class JWTUtils { 
        private static final String signature = "xxxxxxxxxxx";
    
        /** * 生成token header.payload.signature */
        public static String getToken(Map<String, String> map) { 
            Calendar instance = Calendar.getInstance();
            instance.add(Calendar.DATE, 30);
            //创建JWT builder
            JWTCreator.Builder builder = JWT.create();
            //payload
            map.forEach(builder::withClaim);
            String token = builder.withExpiresAt(instance.getTime()).sign(Algorithm.HMAC256(signature));
            return token;
        }
        /** * 验证token 合法性 * 验证失败则会抛出异常 验证成功则不抛出异常 * AlgorithmMismatchException 算法不匹配 * TokenExpiredException token过期 * SignatureVerificationException 签名验证失败异常 * Exception token无效 */
        public static void verify(String token){ 
            JWT.require(Algorithm.HMAC256(signature)).build().verify(token);
        }
        /** * 获取token方法 */
        public static DecodedJWT getTokenInfo(String token){ 
            DecodedJWT verify = JWT.require(Algorithm.HMAC256(signature)).build().verify(token);
            return verify;
        }
    }

3.`为了减少代码冗余在springboot中添加拦截器`

package com.ran.interceptor;
    
    import com.auth0.jwt.exceptions.AlgorithmMismatchException;
    import com.auth0.jwt.exceptions.SignatureVerificationException;
    import com.auth0.jwt.exceptions.TokenExpiredException;
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.ran.utils.JWTUtils;
    import org.springframework.web.servlet.HandlerInterceptor;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.util.HashMap;
    
    public class JWTInterceptor implements HandlerInterceptor { 
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { 
            HashMap<String, Object> map = new HashMap<>();
            //获取请求头中的token令牌
            String token = request.getHeader("Authorization");
            try { 
                JWTUtils.verify(token);
                return true;
            }catch (AlgorithmMismatchException e){ 
                e.printStackTrace();
                map.put("msg","算法不匹配");
            }catch (TokenExpiredException e){ 
                e.printStackTrace();
                map.put("msg","token过期");
            }catch (SignatureVerificationException e){ 
                e.printStackTrace();
                map.put("msg","签名验证失败异常");
            } catch (Exception e) { 
                e.printStackTrace();
                map.put("msg","token无效");
            }
            map.put("state",false);//设置状态
    // 将map转为json Jackson
            String json = new ObjectMapper().writeValueAsString(map);
            response.setContentType("application/json;charset=utf-8");
    // response.getWriter().write(json);
            response.getWriter().println(json);
            return false;
        }
    }

4.`配置InterceptorConfig`

package com.ran.config;
    
    import com.ran.interceptor.JWTInterceptor;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
    
    @Configuration
    public class InterceptorConfig implements WebMvcConfigurer { 
        @Override
        public void addInterceptors(InterceptorRegistry registry) { 
            registry.addInterceptor(new JWTInterceptor())
                .addPathPatterns("/**")//其他接口进行保护拦截验证
                .excludePathPatterns("/user/**");//关于用户的接口放行
        }
    }

5.`现在就可以完美使用JWTtoken验证了`