springboot jwt的使用

ゝ一纸荒年。 2023-01-19 12:48 4阅读 0赞

## 什么是jwt(json web token) ##

JWT的声明一般被用来在身份提供者和服务提供者间传递被认证的用户身份信息，以便于从资源服务器获取资源，也可以增加一些额外的其它业务逻辑所必须的声明信息，该token也可直接被用于认证，也可被加密*斜体样式*
    	
    	
    ==前端在登陆时,把帐号密码发送给后端,后端根据帐号密码到数据库中查询,如果登陆逻辑成功.则生成jwt,并且返回给前端,前端获取到后存放到header中,在大量的axios请求中携带header,发送给后端,后端的拦截器,拦截前端的请求.并且解析jwt如果接收到的jwt,权限够,并且在有效时间内,放行它,否则拦截==

# 如何在springboot中配置jwt #

1.  导入依赖

<dependency>
                <groupId>com.auth0</groupId>
                <artifactId>java-jwt</artifactId>
                <version>3.10.3</version>
            </dependency>
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>0.9.1</version>
            </dependency>

1.  生成jwt

JwtBuilder builder = Jwts.builder();
            String token = builder.setSubject("a")//存放用户的名字
                    .setIssuedAt(new Date())//设置token的生成时间
                    .setId("1")//设置token的id为1
                    .setClaims(map)//map可以存放用户角色
                    .setExpiration(new Date(System.currentTimeMillis() + 60*60* 1000))//有效时间一小时
                    .signWith(SignatureAlgorithm.HS256, "000000")//加密方式,解密密码
                    .compact();
    		System.out.println(token);

1.  解析jwt

package com.token.config.interceptor;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.token.config.Result;
    import io.jsonwebtoken.*;
    import org.springframework.stereotype.Component;
    import org.springframework.web.servlet.HandlerInterceptor;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.io.PrintWriter;
    
    @Component
    public class CheckTokenInterceptor implements HandlerInterceptor { 
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { 
            //校验token
            //网络的第一次握手
            String method=request.getMethod();
            if("OPTIONS".equalsIgnoreCase(method)){ 
                return true;
            }
    
            String token=request.getHeader("token");
            System.out.println("打印token:"+token);
            System.out.println("拦截器生效");
            if(token==null){ 
                Result result=new Result();
                System.out.println("token为空");
                //提示请先登陆
                doResponse(response,result.fail("请先登陆",null));
                return  false;
            }else{ 
                try { 
                    JwtParser parser= Jwts.parser();
                    parser.setSigningKey("000000");
                    Jws<Claims> claimsJws = parser.parseClaimsJws(token);
                    return true;
                }catch (ExpiredJwtException e){ 
                    doResponse(response,Result.fail("登陆过期,请重新登陆",null));
                }catch(UnsupportedJwtException e){ 
                    doResponse(response,Result.fail("Token不合法,请自重",null));
                }catch (Exception e){ 
    
                    doResponse(response,Result.fail("代码报错了",null));
                }
            }
    
            return false;
        }
    
        private void doResponse(HttpServletResponse response,Result result) throws IOException { 
            response.setContentType("application/json");
            response.setCharacterEncoding("utf-8");
            PrintWriter out=response.getWriter();
            String s = new ObjectMapper().writeValueAsString(Result.fail("请先登陆"));
            out.print(s);
            out.flush();
            out.close();
        }
    }

1.  设置拦截器

package com.token.config;
    
    import com.token.config.interceptor.CheckTokenInterceptor;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
    
    @Configuration
    public class InterceptorConfig implements WebMvcConfigurer { 
        @Autowired
        private CheckTokenInterceptor checkTokenInterceptor;
    
        @Override
        public void addInterceptors(InterceptorRegistry registry) { 
            registry.addInterceptor(checkTokenInterceptor)
                    .addPathPatterns("/**")//拦截所有请求
                    .excludePathPatterns(("/user/**"));//放行/user/**
        }
    }

JWT封装类

package com.token.util;
    
    import com.alibaba.fastjson.JSON;
    import com.alibaba.fastjson.JSONObject;
    import com.auth0.jwt.JWT;
    import com.auth0.jwt.JWTVerifier;
    import com.auth0.jwt.algorithms.Algorithm;
    import com.auth0.jwt.exceptions.JWTVerificationException;
    import com.auth0.jwt.interfaces.DecodedJWT;
    
    import java.util.Base64;
    import java.util.Date;
    import java.util.HashMap;
    
    public class JwtUtil { 
    
        /** * 过期时间为一天 * TODO 正式上线更换为15分钟 */
        private static final long EXPIRE_TIME = 12 * 60 * 60 * 1000;
    
        /** * token私钥 */
        private static final String TOKEN_SECRET = "2333";
    
        /** * 生成签名,15分钟后过期 * * @param username * @param role * @return */
        public static String sign(String username, String role) { 
            //过期时间
            Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
            //私钥及加密算法
            Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
            //设置头信息
            HashMap<String, Object> header = new HashMap<>(2);
            header.put("typ", "JWT");
            header.put("alg", "HS256");
            return JWT.create().withHeader(header).withClaim("username", username)
                    .withClaim("role", role).withExpiresAt(date).sign(algorithm);
        }
    
        //验证 token 是否有效
        public static boolean verity(String token) { 
            try { 
                Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
                JWTVerifier verifier = JWT.require(algorithm).build();
                DecodedJWT jwt = verifier.verify(token);
                return true;
            } catch (IllegalArgumentException | JWTVerificationException e) { 
                return false;
            }
    
        }
    
        //获得 token 中的载荷信息
        public JSONObject getPayload(String token) { 
            try { 
                Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
                JWTVerifier verifier = JWT.require(algorithm).build();
                DecodedJWT jwt = verifier.verify(token);
                String payload = jwt.getPayload();
    
                return (JSONObject) JSON.parse(Base64.getDecoder().decode(payload));
    
            } catch (IllegalArgumentException | JWTVerificationException e) { 
                return null;
            }
        }
    }

写一个注解,在拦截器handeler方法可以获得本次访问接口对应的controller,再拿到对应的方法,本质上是通过反射实现的,所以我们可以直接判断这个方法有没有被标记,以此来判断需不需要校验他是否拥有管理员权限,如果拥有则放行,否则提示权限不足

package com.token.config;
    
    import java.lang.annotation.ElementType;
    import java.lang.annotation.Retention;
    import java.lang.annotation.RetentionPolicy;
    import java.lang.annotation.Target;
    
    @Target(ElementType.METHOD)  //只作用于方法之上
    @Retention(RetentionPolicy.RUNTIME)  //在运行时生效
    public @interface TokenVerify { 
    }

拦截器

package com.token.config.interceptor;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import com.token.config.Result;
    import com.token.config.TokenVerify;
    import io.jsonwebtoken.*;
    import org.springframework.stereotype.Component;
    import org.springframework.web.method.HandlerMethod;
    import org.springframework.web.servlet.HandlerInterceptor;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.io.PrintWriter;
    import java.lang.reflect.Method;
    
    @Component
    public class CheckTokenInterceptor implements HandlerInterceptor { 
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { 
            //校验token网络的第一次握手
    
            String method = request.getMethod();
            if ("OPTIONS".equalsIgnoreCase(method)) { 
                return true;
            }
    
            String token = request.getHeader("token");
    
            if (token == null) { 
                Result result = new Result();
                doResponse(response, result.fail("请先登陆", null));
                return false;
            } else { 
                try { 
                    JwtParser parser = Jwts.parser();
                    parser.setSigningKey("000000");
                    Jws<Claims> claimsJws = parser.parseClaimsJws(token);
                    Claims body = claimsJws.getBody();
                    System.out.println(body);
                    HandlerMethod handlerMethod = (HandlerMethod) handler;
                    Method method1 = handlerMethod.getMethod();
                    if(method1.isAnnotationPresent(TokenVerify.class)){ //ruguo1
                        Object role = body.get("role");
                        if (role.equals("admin")){ 
                            System.out.println("欢迎管理员操作");
                        }
                        System.out.println(body.get("role"));
    
                    }else{ 
                        doResponse(response, Result.fail("角色不对", null));
                    }
                    return true;
                } catch (ExpiredJwtException e) { 
                    doResponse(response, Result.fail("登陆过期,请重新登陆", null));
                } catch (UnsupportedJwtException e) { 
                    doResponse(response, Result.fail("Token不合法,请自重", null));
                } catch (Exception e) { 
    
                    doResponse(response, Result.fail("代码报错了", null));
                }
            }
    
            return false;
        }
    
        private void doResponse(HttpServletResponse response, Result result) throws IOException { 
            response.setContentType("application/json");
            response.setCharacterEncoding("utf-8");
            PrintWriter out = response.getWriter();
            String s = new ObjectMapper().writeValueAsString(Result.fail("请先登陆没有json"));
            out.print(s);
            out.flush();
            out.close();
        }
    }