后端架构token授权认证机制：spring security JSON Web Token（JWT）简例（2）

约定不等于承诺〃 2023-10-01 18:41 5阅读 0赞

这里有一个简单例子实现token认证授权访问：

[后端架构token授权认证机制：spring security JSON Web Token（JWT）简例\_Zhang Phil-CSDN博客][token_spring security JSON Web Token_JWT_Zhang Phil-CSDN]

再写一个例子，该例中，假设

/api需要登录且具有有效token才能访问的接口。

/home是公开的接口，无须登录授权均可访问。

/login是登录接口，用户通过/login提交用户名和密码进行鉴权验证。

import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.web.bind.annotation.*;
    
    import javax.servlet.http.HttpServletResponse;
    import java.util.Map;
    
    
    @RestController
    public class MyController {
        @Autowired
        private AuthenticationManager authenticationManager;
    
        //@Autowired
        //private MyUserDetailsService userDetailsService;
    
        @RequestMapping("/api")
        private String api(@RequestHeader Map<String, String> headers) {
            System.out.println("headers: " + headers);
    
            String token_header = headers.get("authorization");
            System.out.println("token: " + token_header);
    
            // token一般又称之为"Bearer token"，以Bearer开头
            // 截取纯粹的token
            String BEARER = "Bearer ";
            String token = token_header.substring(BEARER.length());//从Bearer 之后开始截取
    
            String username = JwtTokenUtil.getUsername(token);
            String role = JwtTokenUtil.getUserRole(token);
            return username + " - " + role + " @api";
        }
    
        /**
         * 这里的MyRequest封装了用户登录需要填写上报的信息。也可以通过把用户名和密码写入http中的header实现上报。
         *
         * @param request
         * @param response
         */
        @RequestMapping(value = "/login", method = RequestMethod.POST)
        private
        //ResponseEntity<?>
        void login(@RequestBody MyRequest request, HttpServletResponse response) {
            System.out.println("/login");
    
            String username = request.getUsername();
            String password = request.getPassword();
            System.out.println("用户名:" + username);
            System.out.println("密码:" + password);
    
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(username, password);
            authenticationManager.authenticate(authentication);
    
            //UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            String token = JwtTokenUtil.createToken(username, "ADMIN");
            //return ResponseEntity.ok(token);
    
            // 设置编码
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/json; charset=utf-8");
            // 请求头里返回token
            // "Bearer "前缀token
            response.setHeader("token", JwtTokenUtil.TOKEN_PREFIX + token);
            response.setContentType("text/json;charset=utf-8");
    
            try {
                response.getWriter().write("登录成功");
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    
        @RequestMapping(value = "/home")
        private String home() {
            return "home";
        }
    }

token工具类：

import io.jsonwebtoken.Claims;
    import io.jsonwebtoken.Jwts;
    import io.jsonwebtoken.SignatureAlgorithm;
    import org.springframework.stereotype.Component;
    
    import java.util.Date;
    import java.util.HashMap;
    import java.util.Map;
    
    @Component
    public class JwtTokenUtil {
        private static final String USER_NAME = "username";
    
        // Token头
        public static final String TOKEN_HEADER = "Authorization";
    
        // Token前缀
        public static final String TOKEN_PREFIX = "Bearer ";
    
        // 签名主题
        public static final String SUBJECT = "zhangphil";
    
        // 过期时间
        public static final long EXPIRITION = 3 * 60 * 1000;
    
        // 应用密钥
        public static final String APPSECRET_KEY = "zhangphil_secret";
    
        // 角色权限声明
        private static final String ROLE_CLAIMS = "role";
    
        /**
         * 生成Token
         */
        public static String createToken(String username, String role) {
            Map<String, Object> map = new HashMap<>();
            map.put(ROLE_CLAIMS, role);
    
            String token = Jwts
                    .builder()
                    .setSubject(SUBJECT)
                    .setClaims(map)
                    .claim(USER_NAME, username)
                    .setIssuedAt(new Date())
                    .setExpiration(new Date(System.currentTimeMillis() + EXPIRITION))
                    .signWith(SignatureAlgorithm.HS256, APPSECRET_KEY)
                    .compact();
    
            return token;
        }
    
        /**
         * 校验Token
         */
        public static Claims checkJWT(String token) {
            Claims claims = null;
            try {
                claims = Jwts.parser()
                        .setSigningKey(APPSECRET_KEY)
                        .parseClaimsJws(token)
                        .getBody();
    
                return claims;
            } catch (Exception e) {
                e.printStackTrace();
            }
    
            return claims;
        }
    
        /**
         * 从Token中提取username
         */
        public static String getUsername(String token) {
            Claims claims = Jwts.parser().setSigningKey(APPSECRET_KEY).parseClaimsJws(token).getBody();
            return claims.get(USER_NAME).toString();
        }
    
        /**
         * 从Token中获取用户角色
         */
        public static String getUserRole(String token) {
            Claims claims = Jwts.parser().setSigningKey(APPSECRET_KEY).parseClaimsJws(token).getBody();
            return claims.get("role").toString();
        }
    
        /**
         * 校验Token是否过期
         */
        public static boolean isExpiration(String token) {
            Claims claims = Jwts.parser().setSigningKey(APPSECRET_KEY).parseClaimsJws(token).getBody();
            return claims.getExpiration().before(new Date());
        }
    }

token工具类中使用的类需要在pom.xml添加引用：

<dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>0.9.1</version>
            </dependency>

权限异常处理：

import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.AuthenticationEntryPoint;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {
        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
            response.setCharacterEncoding("utf-8");
            response.setContentType("text/javascript;charset=utf-8");
            response.getWriter().print("没有访问权限");
        }
    }

用户登录鉴权过滤类：

import org.apache.commons.lang3.StringUtils;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.util.ArrayList;
    import java.util.Collection;
    
    public class MyBasicAuthenticationFilter extends BasicAuthenticationFilter {
        public MyBasicAuthenticationFilter(AuthenticationManager authenticationManager) {
            super(authenticationManager);
        }
    
        /**
         * 过滤http请求
         */
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
            System.out.println(getClass().getSimpleName() + " doFilterInternal");
    
            String tokenHeader = request.getHeader(JwtTokenUtil.TOKEN_HEADER);
    
            // 请求头中没Authorization或是Authorization不以Bearer开头
            if (tokenHeader == null || !tokenHeader.startsWith(JwtTokenUtil.TOKEN_PREFIX)) {
                chain.doFilter(request, response);
                System.out.println("token为空，或者token头部不是以Bearer 开头");
                return;
            }
    
            // 若请求头中有token
            // 设置认证信息
            SecurityContextHolder.getContext().setAuthentication(getAuthentication(tokenHeader));
    
            super.doFilterInternal(request, response, chain);
        }
    
        /**
         * 从token中获取用户信息并新建一个token。
         *
         * @param tokenHeader 字符串形式的Token请求头
         * @return 带用户名和密码以及权限的Authentication
         */
        private UsernamePasswordAuthenticationToken getAuthentication(String tokenHeader) {
            // 去掉前缀，获取Token字
            String token = tokenHeader.replace(JwtTokenUtil.TOKEN_PREFIX, "");
    
            // 从Token中获取用户名
            String username = JwtTokenUtil.getUsername(token);
    
            // 从Token中解密获取用户角色
            String role = JwtTokenUtil.getUserRole(token);
    
            // 将[ROLE_XXX,ROLE_YYY]格式角色字符串转换为数组
            String[] roles = StringUtils.strip(role, "[]").split(", ");
    
            Collection<SimpleGrantedAuthority> authorities = new ArrayList<>();
    
            for (String s : roles) {
                authorities.add(new SimpleGrantedAuthority(s));
            }
    
            if (username != null) {
                return new UsernamePasswordAuthenticationToken(username, null, authorities);
            }
    
            return null;
        }
    }

用于用户登录密码编解码处理的类：

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.stereotype.Component;
    
    
    /**
     * 注意，此处是明文，实际场景时候要加密
     */
    @Component
    public class MyPasswordEncoder extends BCryptPasswordEncoder {
        @Override
        public String encode(CharSequence rawPassword) {
            return rawPassword.toString();
        }
    
        @Override
        public boolean matches(CharSequence rawPassword, String encodedPassword) {
            if (rawPassword == null) {
                throw new IllegalArgumentException("rawPassword为空！");
            }
    
            if (encodedPassword == null || encodedPassword.length() == 0) {
                throw new IllegalArgumentException("encodedPassword为空");
            }
    
            return encodedPassword.equals(rawPassword);
        }
    }

封装了用户（浏览器或客户端）发送请求的数据：

import java.io.Serializable;
    
    public class MyRequest implements Serializable {
        private String username;
        private String password;
    
        //JSON Parsing
        public MyRequest() {
    
        }
    
        public MyRequest(String username, String password) {
            this.setUsername(username);
            this.setPassword(password);
        }
    
        public String getUsername() {
            return this.username;
        }
    
        public void setUsername(String username) {
            this.username = username;
        }
    
        public String getPassword() {
            return this.password;
        }
    
        public void setPassword(String password) {
            this.password = password;
        }
    }

用户数据获取类，该类通常用于后端从后台的数据库根据用户名获取该用户的信息，供上层程序逻辑使用：

import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.stereotype.Service;
    
    import java.util.ArrayList;
    
    
    @Service
    public class MyUserDetailsService implements UserDetailsService {
        //假设已经知道用户名和密码，硬编码写死了用户名和密码
        //省去从数据库读取用户信息的过程
        public static final String USER_NAME = "zhangphil";
        public static final String USER_PASSWORD = "12345678";//正常情况密码应该加密，而不是明文。此处仅做演示。
    
        //数据库读写
        //@Autowired
        //private UserMapper userMapper;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            System.out.println(username + " 加载信息");
    
            if (USER_NAME.equals(username)) {
                //正常情况下，这里应该从数据库中，根据传入的用户名把用户信息读出来，然后返回User
                //从数据库中查用户
                //User user = userMapper.findUserByUsername(username);
                //简单演示期间，这里省略读数据库过程。
                return new User(USER_NAME, USER_PASSWORD, new ArrayList<>());
            } else {
                throw new UsernameNotFoundException("用户不存在:" + username);
            }
        }
    }

这里将为登录成功的用户返回正确的token:

import org.springframework.security.authentication.*;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.util.Collection;
    
    /**
     * 验证用户名和密码
     * 验证通过后，生成token返回给客户端
     */
    
    public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    
        private AuthenticationManager authenticationManager;
    
        public MyUsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
            this.authenticationManager = authenticationManager;
        }
    
        /**
         * 验证
         */
        @Override
        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) {
            System.out.println("attemptAuthentication");
    
            // 从输入流中获取登录信息
            // 创建token调用authenticationManager.authenticate() 后，
            // 让Spring security框架内部验证
            return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(
                    request.getParameter("username"),
                    request.getParameter("password")));
        }
    
        /**
         * 验证成功，生成token返回给客户端
         */
        @Override
        public void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException {
            System.out.println("successfulAuthentication ...");
    
            User user = (User) authResult.getPrincipal();
    
            // 从User中获取权限信息
            Collection<? extends GrantedAuthority> authorities = user.getAuthorities();
    
            // 创建Token
            String token = JwtTokenUtil.createToken(user.getUsername(), authorities.toString());
    
            // 防乱码
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/json; charset=utf-8");
    
            // 在请求头返回token
            // 请求头带有"Bearer "前缀的token
            response.setHeader("token", JwtTokenUtil.TOKEN_PREFIX + token);
    
            // 防乱码
            response.setContentType("text/json;charset=utf-8");
            response.getWriter().write("登录成功");
    
            System.out.println("登录成功");
        }
    
        /**
         * 验证失败
         */
        @Override
        public void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException {
            String retData;
    
            if (failed instanceof AccountExpiredException) {
                retData = "账号过期";
            } else if (failed instanceof BadCredentialsException) {
                retData = "密码错误";
            } else if (failed instanceof CredentialsExpiredException) {
                retData = "密码过期";
            } else if (failed instanceof DisabledException) {
                retData = "账号不可用";
            } else if (failed instanceof LockedException) {
                retData = "账号锁定";
            } else if (failed instanceof InternalAuthenticationServiceException) {
                retData = "内部授权服务异常";
            } else {
                retData = "未知异常";
            }
    
            response.setContentType("text/json;charset=utf-8");
            response.getWriter().write(retData);
        }
    }

以上各个组件、工具类的“总装车间”，组合上面的组件，形成一台能够运行的token认证鉴权系统：

import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.builders.WebSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.config.http.SessionCreationPolicy;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class MyWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    
        @Autowired
        private MyUserDetailsService userDetailsService;
    
        @Override
        public void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService)
                    .passwordEncoder(new MyPasswordEncoder());
        }
    
        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.csrf().disable()
                    .authorizeRequests()
                    //login为鉴权登录，排除授权拦截
                    .antMatchers("/login").permitAll()
                    .anyRequest().authenticated()
                    .and()
                    // 登录拦截
                    .addFilter(new MyBasicAuthenticationFilter(authenticationManagerBean()))
                    // JWT鉴权拦截
                    .addFilter(new MyUsernamePasswordAuthenticationFilter(authenticationManagerBean()))
                    .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .exceptionHandling()
                    // 用户访问无权限资源异常处理
                    .authenticationEntryPoint(new MyAuthenticationEntryPoint());
        }
    
        @Bean
        @Override
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    
        /**
         * 假设这一部分接口是公开开放的，不需要token即可访问。
         * 这部分客户端http请求不拦截
         * 排除。
         */
        @Override
        public void configure(WebSecurity web) {
            web.ignoring()
                    .antMatchers(
                            "/login**",
                            "/home**");
        }
    }

最后是一个很常规、简单的application启动加载器（入口Main“函数”）：

import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    
    @SpringBootApplication
    public class SpringTokenApplication {
    
        public static void main(String[] args) {
            SpringApplication.run(SpringTokenApplication.class, args);
        }
    
    }

启动SpringTokenApplication,/home无需鉴权认证可以直接访问：

![1057248a3d4c4e5aaea970c2531db12c.png][]

/login提交用户名和密码：

![watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_20_color_FFFFFF_t_70_g_se_x_16][]

登录成功后，后台系统返回token:

![watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_20_color_FFFFFF_t_70_g_se_x_16 1][]

在/api接口的header里面填入token，获取接口数据：

![watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_17_color_FFFFFF_t_70_g_se_x_16][]

后端系统正确返回/api接口数据：

![watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_20_color_FFFFFF_t_70_g_se_x_16 2][]

[token_spring security JSON Web Token_JWT_Zhang Phil-CSDN]: https://blog.csdn.net/zhangphil/article/details/122841422
[1057248a3d4c4e5aaea970c2531db12c.png]: https://img-blog.csdnimg.cn/1057248a3d4c4e5aaea970c2531db12c.png
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/c31571f8a0b84cb4af8ed7142017f524.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAemhhbmdwaGls,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_20_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/0148e8bfc6e540949654483416a31267.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAemhhbmdwaGls,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_17_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/184943fff39147a0b340f7d5a9f7fd77.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAemhhbmdwaGls,size_17,color_FFFFFF,t_70,g_se,x_16
[watermark_type_d3F5LXplbmhlaQ_shadow_50_text_Q1NETiBAemhhbmdwaGls_size_20_color_FFFFFF_t_70_g_se_x_16 2]: https://img-blog.csdnimg.cn/fb90ec96e0d5457da21b43bee5ca2811.png?x-oss-process=image/watermark,type_d3F5LXplbmhlaQ,shadow_50,text_Q1NETiBAemhhbmdwaGls,size_20,color_FFFFFF,t_70,g_se,x_16