Spring开发中JWT实现登录功能

ゝ一纸荒年。 2024-03-17 21:50 70阅读 0赞

(部分代码待完善)

#### 1. 自定义JwtToken拦截器 ####

1.  `JwtUtil.java` JWT工具

package com.sky.utils;
    
    import io.jsonwebtoken.Claims;
    import io.jsonwebtoken.JwtBuilder;
    import io.jsonwebtoken.Jwts;
    import io.jsonwebtoken.SignatureAlgorithm;
    import java.nio.charset.StandardCharsets;
    import java.util.Date;
    import java.util.Map;
    
    public class JwtUtil {
        
        /**
         * 生成jwt
         * 使用Hs256算法, 私匙使用固定秘钥
         *
         * @param secretKey jwt秘钥
         * @param ttlMillis jwt过期时间(毫秒)
         * @param claims    设置的信息
         * @return
         */
        public static String createJWT(String secretKey, long ttlMillis, Map<String, Object> claims) {
        
            // 指定签名的时候使用的签名算法，也就是header那部分
            SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
    
            // 生成JWT的时间
            long expMillis = System.currentTimeMillis() + ttlMillis;
            Date exp = new Date(expMillis);
    
            // 设置jwt的body
            JwtBuilder builder = Jwts.builder()
                    // 如果有私有声明，一定要先设置这个自己创建的私有的声明，这个是给builder的claim赋值，一旦写在标准的声明赋值之后，就是覆盖了那些标准的声明的
                    .setClaims(claims)
                    // 设置签名使用的签名算法和签名使用的秘钥
                    .signWith(signatureAlgorithm, secretKey.getBytes(StandardCharsets.UTF_8))
                    // 设置过期时间
                    .setExpiration(exp);
    
            return builder.compact();
        }
    
        /**
         * Token解密
         *
         * @param secretKey jwt秘钥 此秘钥一定要保留好在服务端, 不能暴露出去, 否则sign就可以被伪造, 如果对接多个客户端建议改造成多个
         * @param token     加密后的token
         * @return
         */
        public static Claims parseJWT(String secretKey, String token) {
        
            // 得到DefaultJwtParser
            Claims claims = Jwts.parser()
                    // 设置签名的秘钥
                    .setSigningKey(secretKey.getBytes(StandardCharsets.UTF_8))
                    // 设置需要解析的jwt
                    .parseClaimsJws(token).getBody();
            return claims;
        }
    
    }

1.  `JwtTokenAdminInterceptor.java` 自定义拦截器

package com.sky.interceptor;
    
    import com.sky.constant.JwtClaimsConstant;
    import com.sky.properties.JwtProperties;
    import com.sky.utils.JwtUtil;
    import io.jsonwebtoken.Claims;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Component;
    import org.springframework.web.method.HandlerMethod;
    import org.springframework.web.servlet.HandlerInterceptor;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    /**
     * jwt令牌校验的拦截器
     */
    @Component
    @Slf4j
    public class JwtTokenAdminInterceptor implements HandlerInterceptor {
        
    
        @Autowired
        private JwtProperties jwtProperties;
    
        /**
         * 校验jwt
         *
         * @param request
         * @param response
         * @param handler
         * @return
         * @throws Exception
         */
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        
            //判断当前拦截到的是Controller的方法还是其他资源
            if (!(handler instanceof HandlerMethod)) {
        
                //当前拦截到的不是动态方法，直接放行
                return true;
            }
    
            //1、从请求头中获取令牌
            String token = request.getHeader(jwtProperties.getAdminTokenName());
    
            //2、校验令牌
            try {
        
                log.info("jwt校验:{}", token);
                Claims claims = JwtUtil.parseJWT(jwtProperties.getAdminSecretKey(), token);
                Long empId = Long.valueOf(claims.get(JwtClaimsConstant.EMP_ID).toString());
                log.info("当前员工id：", empId);
                //3、通过，放行
                return true;
            } catch (Exception ex) {
        
                //4、不通过，响应401状态码
                response.setStatus(401);
                return false;
            }
        }
    }

1.  `JwtProperties.java` 配置文件

package com.sky.properties;
    
    import lombok.Data;
    import org.springframework.boot.context.properties.ConfigurationProperties;
    import org.springframework.stereotype.Component;
    
    @Component
    @ConfigurationProperties(prefix = "sky.jwt")
    @Data
    public class JwtProperties {
        
    
        /**
         * 管理端员工生成jwt令牌相关配置
         */
        private String adminSecretKey;
        private long adminTtl;
        private String adminTokenName;
    }

1.  `application.approties` 配置文件

sky.jwt.adminSecretKey = ac78t6rfhd1hsf6fhsa
    sky.jwt.adminTtl = 7200000
    sky.jwt.adminTokenName = authentication

#### 2. 注册自定义拦截器 ####

package com.sky.config;
    
    import com.sky.interceptor.JwtTokenAdminInterceptor;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport;
    
    /**
     * 配置类，注册web层相关组件
     */
    @Configuration
    @Slf4j
    public class WebMvcConfiguration extends WebMvcConfigurationSupport {
        
        @Autowired
        private JwtTokenAdminInterceptor jwtTokenAdminInterceptor;
    
        /**
         * 注册自定义拦截器
         *
         * @param registry
         */
        protected void addInterceptors(InterceptorRegistry registry) {
        
            log.info("开始注册自定义拦截器...");
            registry.addInterceptor(jwtTokenAdminInterceptor)
                    .addPathPatterns("/admin/**")
                    .excludePathPatterns("/admin/employee/login");
        }
    }

#### 3. 使用jwt进行登录认证 ####

LoginController中，校验账号密码，成功时生成jwt令牌

1.  `EmployeeController.java` 登录

package com.sky.controller.admin;
    
    import com.sky.constant.JwtClaimsConstant;
    import com.sky.dto.EmployeeLoginDTO;
    import com.sky.entity.Employee;
    import com.sky.properties.JwtProperties;
    import com.sky.result.Result;
    import com.sky.service.EmployeeService;
    import com.sky.utils.JwtUtil;
    import com.sky.vo.EmployeeLoginVO;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RequestBody;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import java.util.HashMap;
    import java.util.Map;
    
    /**
     * 员工管理
     */
    @RestController
    @RequestMapping("/admin/employee")
    @Slf4j
    public class EmployeeController {
        
    
        @Autowired
        private EmployeeService employeeService;
        @Autowired
        private JwtProperties jwtProperties;
    
        /**
         * 登录
         *
         * @param employeeLoginDTO
         * @return
         */
        @PostMapping("/login")
        public Result<EmployeeLoginVO> login(@RequestBody EmployeeLoginDTO employeeLoginDTO) {
        
            log.info("员工登录：{}", employeeLoginDTO);
    
            Employee employee = employeeService.login(employeeLoginDTO);
    
            //登录成功后，生成jwt令牌
            Map<String, Object> claims = new HashMap<>();
            claims.put(JwtClaimsConstant.EMP_ID, employee.getId());
            String token = JwtUtil.createJWT(
                    jwtProperties.getAdminSecretKey(),
                    jwtProperties.getAdminTtl(),
                    claims);
    
            EmployeeLoginVO employeeLoginVO = EmployeeLoginVO.builder()
                    .id(employee.getId())
                    .userName(employee.getUsername())
                    .name(employee.getName())
                    .token(token)
                    .build();
    
            return Result.success(employeeLoginVO);
        }
    
        /**
         * 退出
         *
         * @return
         */
        @PostMapping("/logout")
        public Result<String> logout() {
        
            return Result.success();
        }
    
    }

1.  `EmployeeServiceImpl .java` 校验密码

package com.sky.service.impl;
    
    import com.sky.constant.MessageConstant;
    import com.sky.constant.StatusConstant;
    import com.sky.dto.EmployeeLoginDTO;
    import com.sky.entity.Employee;
    import com.sky.exception.AccountLockedException;
    import com.sky.exception.AccountNotFoundException;
    import com.sky.exception.PasswordErrorException;
    import com.sky.mapper.EmployeeMapper;
    import com.sky.service.EmployeeService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Service;
    import org.springframework.util.DigestUtils;
    
    @Service
    public class EmployeeServiceImpl implements EmployeeService {
        
    
        @Autowired
        private EmployeeMapper employeeMapper;
    
        /**
         * 员工登录
         *
         * @param employeeLoginDTO
         * @return
         */
        public Employee login(EmployeeLoginDTO employeeLoginDTO) {
        
            String username = employeeLoginDTO.getUsername();
            String password = employeeLoginDTO.getPassword();
    
            //1、根据用户名查询数据库中的数据
            Employee employee = employeeMapper.getByUsername(username);
    
            //2、处理各种异常情况（用户名不存在、密码不对、账号被锁定）
            if (employee == null) {
        
                //账号不存在
                throw new AccountNotFoundException(MessageConstant.ACCOUNT_NOT_FOUND);
            }
    
            //密码比对
            // TODO 后期需要进行md5加密，然后再进行比对
            if (!password.equals(employee.getPassword())) {
        
                //密码错误
                throw new PasswordErrorException(MessageConstant.PASSWORD_ERROR);
            }
    
            if (employee.getStatus() == StatusConstant.DISABLE) {
        
                //账号被锁定
                throw new AccountLockedException(MessageConstant.ACCOUNT_LOCKED);
            }
    
            //3、返回实体对象
            return employee;
        }
    
    }

1.  `JwtClaimsConstant.java` 常量类

package com.sky.constant;
    
    public class JwtClaimsConstant {
        
    
        public static final String EMP_ID = "empId";
        public static final String USER_ID = "userId";
        public static final String PHONE = "phone";
        public static final String USERNAME = "username";
        public static final String NAME = "name";
    
    }