将相本无种,男儿当自强。这篇文章主要讲述精品SpringSecurity集成JWT#yyds干货盘点#相关的知识,希望能为你提供帮助。
本博客代码下载地址:
- https://gitee.com/hcitlife/springsecutiry-jwt-demo
0、准备工作创建SpringBoot中项目:
- Maven依赖:
<
dependency>
<
groupId>
org.projectlombok<
/groupId>
<
artifactId>
lombok<
/artifactId>
<
version>
1.18.22<
/version>
<
/dependency>
<
dependency>
<
groupId>
org.springframework.boot<
/groupId>
<
artifactId>
spring-boot-starter-web<
/artifactId>
<
/dependency>
<
dependency>
<
groupId>
org.springframework.boot<
/groupId>
<
artifactId>
spring-boot-starter-test<
/artifactId>
<
scope>
test<
/scope>
<
/dependency>
<
dependency>
<
groupId>
org.springframework.security<
/groupId>
<
artifactId>
spring-security-test<
/artifactId>
<
scope>
test<
/scope>
<
/dependency>
<
dependency>
<
groupId>
org.springframework.boot<
/groupId>
<
artifactId>
spring-boot-starter-security<
/artifactId>
<
/dependency>
<
dependency>
<
groupId>
io.jsonwebtoken<
/groupId>
<
artifactId>
jjwt-api<
/artifactId>
<
version>
0.11.2<
/version>
<
/dependency>
<
dependency>
<
groupId>
io.jsonwebtoken<
/groupId>
<
artifactId>
jjwt-impl<
/artifactId>
<
version>
0.11.2<
/version>
<
scope>
runtime<
/scope>
<
/dependency>
<
dependency>
<
groupId>
io.jsonwebtoken<
/groupId>
<
artifactId>
jjwt-jackson<
/artifactId>
<
version>
0.11.2<
/version>
<
scope>
runtime<
/scope>
<
/dependency>
- application.yml
jwt:
# 为JWT基础信息加密和解密的密钥,长度需要大于等于43
# 在实际生产中通常不直接写在配置文件里面。而是通过应用的启动参数传递,并且需要定期修改
secret: oQZSeguYloAPAmKwvKqqnifiQatxMEPNOvtwPsCLasd
# JWT令牌的有效时间,单位秒,默认2周
expiration: 1209600
header: Authorization
spring:
main:
allow-circular-references: true# 允许循环注入
项目使用SpringBoot版本为2.6.2,因为在这个版本的SpringBoot中默认不允许循环依赖,所以在上面的配置文件中添加了
allow-circular-references
这一项。1、创建Jwt工具类
- 工具类
@Slf4j
@Component
//@ConfigurationProperties(prefix = "jwt")
public class JwtUtil
/**
* 携带JWT令牌的HTTP的Header的名称,在实际生产中可读性越差越安全
*/
@Getter
@Value("$jwt.header")
private String header;
/**
* 为JWT基础信息加密和解密的密钥
* 在实际生产中通常不直接写在配置文件里面。而是通过应用的启动参数传递,并且需要定期修改。
*/
@Value("$jwt.secret")
private String secret;
/**
* JWT令牌的有效时间,单位秒
* - 默认2周
*/
@Value("$jwt.expiration")
private Long expiration;
/**
* SecretKey 根据 SECRET 的编码方式解码后得到:
* Base64 编码:SecretKey key = Keys.hmacShaKeyFor(Decoders.BASE64.decode(secretString));
* Base64URL 编码:SecretKey key = Keys.hmacShaKeyFor(Decoders.BASE64URL.decode(secretString));
* 未编码:SecretKey key = Keys.hmacShaKeyFor(secretString.getBytes(StandardCharsets.UTF_8));
*/
private static SecretKey getSecretKey(String secret)
byte[] encodeKey = Decoders.BASE64.decode(secret);
return Keys.hmacShaKeyFor(encodeKey);
/**
* 用claims生成token
*
* @param claims 数据声明,用来创建payload的私有声明
* @return token 令牌
*/
private String generateToken(Map<
String, Object>
claims)
SecretKey key = getSecretKey(secret);
//SecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256);
//两种方式等价// 添加payload声明
JwtBuilder jwtBuilder = Jwts.builder()
// 如果有私有声明,一定要先设置这个自己创建的私有的声明,这个是给builder的claim赋值,一旦写在标准的声明赋值之后,就是覆盖了那些标准的声明的
.setClaims(claims)
// 设置jti(JWT ID):是JWT的唯一标识,根据业务需要,这个可以设置为一个不重复的值,主要用来作为一次性token,从而回避重放攻击。
.setId(UUID.randomUUID().toString())
// iat: jwt的签发时间
.setIssuedAt(new Date())// 你也可以改用你喜欢的算法,支持的算法详见:https://github.com/jwtk/jjwt#features
// SignatureAlgorithm.HS256:指定签名的时候使用的签名算法,也就是header那部分
.signWith(key, SignatureAlgorithm.HS256)
.setExpiration(new Date(System.currentTimeMillis() + this.expiration * 1000));
String token = jwtBuilder.compact();
return token;
/**
* 生成Token令牌
*
* @param userDetails 用户
* @return 令牌Token
*/
public String generateToken(UserDetails userDetails)
Map<
String, Object>
claims = new HashMap<
>
();
claims.put("sub", userDetails.getUsername());
claims.put("created", new Date());
return generateToken(claims);
/**
* 从token中获取数据声明claim
*
* @param token 令牌token
* @return 数据声明claim
*/
public Claims getClaimsFromToken(String token)
try
SecretKey key = getSecretKey(secret);
Claims claims = Jwts.parser()
.setSigningKey(key)
.parseClaimsJws(token)
.getBody();
return claims;
catch (ExpiredJwtException | UnsupportedJwtException | MalformedJwtException | IllegalArgumentException e)
log.error("token解析错误", e);
throw new IllegalArgumentException("Token invalided.");
public String getUserRole(String token)
return (String) getClaimsFromToken(token).get("role");
/**
* 从token中获取登录用户名
*
* @param token 令牌
* @return 用户名
*/
public String getSubjectFromToken(String token)
String subject;
try
Claims claims = getClaimsFromToken(token);
subject = claims.getSubject();
catch (Exception e)
subject = null;
return subject;
/**
* 获取token的过期时间
*
* @param token token
* @return 过期时间
*/
public Date getExpirationFromToken(String token)
return getClaimsFromToken(token).getExpiration();
/**
* 判断token是否过期
*
* @param token 令牌
* @return 是否过期:已过期返回true,未过期返回false
*/
public Boolean isTokenExpired(String token)
Date expiration = getExpirationFromToken(token);
return expiration.before(new Date());
/**
* 验证令牌:判断token是否非法
*
* @param token令牌
* @param userDetails 用户
* @return 如果token未过期且合法,返回true,否则返回false
*/
public Boolean validateToken(String token, UserDetails userDetails)
//如果已经过期返回false
if (isTokenExpired(token))
return false;
String usernameFromToken = getSubjectFromToken(token);
String username = userDetails.getUsername();
return username.equals(usernameFromToken);
- 测试代码
@SpringBootTest
public class JwtUtilTest @Resource
private JwtUtil jwtUtil;
@Resource
private PasswordEncoder passwordEncoder;
@Test
void fun()
System.out.println(passwordEncoder);
SecretKey secretKey = Keys.secretKeyFor(SignatureAlgorithm.HS256);
System.out.println(secretKey);
//生成token
@Test
void generateToken()
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
String token = jwtUtil.generateToken(user);
System.out.println(token);
@Test
void getClaimsFromToken()
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
String token = jwtUtil.generateToken(user);
System.out.println(token);
Claims claims = jwtUtil.getClaimsFromToken(token);
System.out.println(claims);
@Test
void getSubjectFromToken()
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
String token = jwtUtil.generateToken(user);
System.out.println(token);
String username = jwtUtil.getSubjectFromToken(token);
System.out.println(username);
@Test
void getExpirationFromToken()
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
String token = jwtUtil.generateToken(user);
System.out.println(token);
Date date = jwtUtil.getExpirationFromToken(token);
System.out.println(new SimpleDateFormat("YYYY-MM-dd HH:mm:ss").format(date));
@Test
void isTokenExpired()
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
String token = jwtUtil.generateToken(user);
System.out.println(token);
Boolean res = jwtUtil.isTokenExpired(token);
System.out.println(res);
@Test
void validateToken()
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
String token = jwtUtil.generateToken(user);
System.out.println(token);
User user2 = new User("zhangsan", "", AuthorityUtils.createAuthorityList());
Boolean res = jwtUtil.validateToken(token, user2);
System.out.println(res);
//模拟篡改
@Test
void fake()
// 将我改成你生成的token的第一段(以.为边界)
String encodedHeader = "eyJhbGciOiJIUzI1NiJ9";
// 测试4: 解密Header
byte[] header = Base64.decodeBase64(encodedHeader.getBytes());
System.out.println(new String(header));
// 将我改成你生成的token的第二段(以.为边界)
String encodedPayload = "eyJpZCI6IjEiLCJpYXQiOjE1NjU1ODk1NDEsImV4cCI6MTU2Njc5OTE0MX0";
// 测试5: 解密Payload
byte[] payload = Base64.decodeBase64(encodedPayload.getBytes());
System.out.println(new String(payload));
//用户信息
String encode = passwordEncoder.encode("1234");
User user = new User("zhangsan", encode, AuthorityUtils.createAuthorityList());
// 测试6: 这是一个被篡改的token,因此会报异常,说明JWT是安全的
jwtUtil.validateToken("eyJhbGciOiJIUzI1NiJ9.eyJpZCI6IjEiLCJpYXQiOjE1NjU1ODk3MzIsImV4cCI6MTU2Njc5OTMzMn0.nDv25ex7XuTlmXgNzGX46LqMZItVFyNHQpmL9UQf-aUx", user);
2、创建没有权限时,Jwt拒绝访问的处理器
/**
* 当用户在没有授权的时候,返回的指定信息
*/
@Slf4j
@Component
public class jwtAccessDeniedHandler implements AccessDeniedHandler
@Override
public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException e) throws ServletException
log.info("用户访问没有授权资源:",e.getMessage());
response.setContentType("application/json;
charset=utf-8");
response.setCharacterEncoding("utf-8");
try(PrintWriter out = response.getWriter();
)
Result result = ResultUtil.fail("用户访问未授权资源").setCode(HttpServletResponse.SC_UNAUTHORIZED);
out.write(JsonUtil.obj2String(result));
out.flush();
catch (IOException exception)
3、创建没有token时,Jwt的EntryPoint
/**
*用户访问资源没有携带正确的token,时返回的信息
*/
@Slf4j
@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws ServletException, IOException
log.info("用户访问资源没有携带正确的token:",e.getMessage());
response.setContentType("application/json;
charset=utf-8");
response.setCharacterEncoding("utf-8");
try(PrintWriter out = response.getWriter();
)
Result result = ResultUtil.fail("用户访问资源没有携带正确的token").setCode(HttpServletResponse.SC_UNAUTHORIZED);
out.write(JsonUtil.obj2String(result));
out.flush();
catch (IOException exception)
4、创建UserDetailsService
@Service
public class UserDetailsServiceImpl implements UserDetailsService
@Resource
private PasswordEncoder passwordEncoder;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException
//直接写死数据信息,可以在这里获取数据库的信息并进行验证
//UserDetails user = User.withUsername(username)
//.password(passwordEncoder.encode("1234"))
//.authorities("Role_vip,user:list,user:update")
//.build();
User user = new User(username, passwordEncoder.encode("1234"),
AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_vip,user:list,user:update"));
return user;
5、创建Jwt认证过滤器
@Slf4j
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter
@Resource
private JwtUtil jwtUtil;
@Resource
private UserDetailsServiceImpl userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain chain) throws ServletException, IOException
String token = request.getHeader(jwtUtil.getHeader());
log.info("header token:", token);
//如果请求头中有token,则进行解析,并且设置认证信息
if (token != null &
&
token.trim().length() >
0)
//根据token获取用户名
String username = jwtUtil.getSubjectFromToken(token);
// 验证username,如果验证合法则保存到SecurityContextHolder
if (username != null &
&
SecurityContextHolder.getContext().getAuthentication() == null)
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
// JWT验证通过,使用Spring Security 管理
if (jwtUtil.validateToken(token, userDetails))
//加载用户、角色、权限信息
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(username, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
//如果请求头中没有Authorization信息则直接放行
chain.doFilter(request, response);
6、配置SpringSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SpringSecurityJwtConfig extends WebSecurityConfigurerAdapter
@Bean
public PasswordEncoder passwordEncoder()
return new BCryptPasswordEncoder();
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception
return super.authenticationManagerBean();
@Resource
private com.hc.jwt.jwtAccessDeniedHandler jwtAccessDeniedHandler;
@Resource
private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
@Resource
private JwtAuthenticationFilter jwtAuthenticationFilter;
@Override
protected void configure(HttpSecurity http) throws Exception
http.csrf().disable();
// 禁用session
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.authorizeRequests()
//login 不拦截
.antMatchers("/login").permitAll()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.antMatchers("/").permitAll()
.anyRequest().authenticated();
//用户访问没有授权资源
http.exceptionHandling().accessDeniedHandler(jwtAccessDeniedHandler);
//授权错误信息处理
//用户访问资源没有携带正确的token
http.exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint);
// 使用自己定义的拦截机制验证请求是否正确,拦截jwt
http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
7、创建控制器
@RestController
public class UserController @Resource
private JwtUtil jwtUtil;
@Resource
private UserDetailsServiceImpl userDetailsService;
@PostMapping("/login")
public String login(@RequestBody UserVO userVO)
//生成token,返回给客户端
UserDetails userDetails = userDetailsService.loadUserByUsername(userVO.getUsername());
String token = jwtUtil.generateToken(userDetails);
return token;
@GetMapping("/fun1")
@PreAuthorize("hasRole(\\"vip\\")")
public Result fun1()
return ResultUtil.success("fun1");
@GetMapping("/fun2")
@PreAuthorize("hasRole(\\"admin\\")")
public Result fun2()
return ResultUtil.success("fun1");
@GetMapping("/fun3")
@PreAuthorize("hasAuthority(\\"user:list\\")")
public Result fun3()
return ResultUtil.success("fun1");
@GetMapping("/fun4")
@PreAuthorize("hasAuthority(\\"user:delete\\")")
public Result fun4()
return ResultUtil.success("fun1");
结果
- 用户登录
文章图片
- 【精品SpringSecurity集成JWT#yyds干货盘点#】角色
文章图片
- 权限
文章图片
- UserVO
@Getter
@Setter
public class UserVO
private String username;
private String password;
推荐阅读
- Nginx 网站服务
- 单页模板不适用于自定义帖子类型
- 列出特定类别的帖子标题的短代码
- 短代码在WordPress自定义主题中不起作用
- 在Woocommerce商店页面上将所有产品分开分类
- 在PHP echo中运行PHP()
- 在WordPress中激活主题激活函数
- 在WordPress中使用MySQL查询检索小部件数据
- 解决WordPress子主题上与父主题的javascript冲突