devbox
IT小白
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

springmvc结合jwt的使用，实现前后端分离token验证_springmvc token验证

作者：IT小白 | 2024-03-02 20:46:00

赞

踩

springmvc token验证

1.首先需要导入maven依赖

  1. 		<dependency>
  2. 			<groupId>com.fasterxml.jackson.core</groupId>
  3. 			<artifactId>jackson-core</artifactId>
  4. 			<version>2.9.4</version>
  5. 		</dependency>
  6. 		<dependency>
  7. 			<groupId>com.fasterxml.jackson.core</groupId>
  8. 			<artifactId>jackson-databind</artifactId>
  9. 			<version>2.9.4</version>
  10. 		</dependency>
  11. 		<dependency>
  12. 			<groupId>com.fasterxml.jackson.core</groupId>
  13. 			<artifactId>jackson-annotations</artifactId>
  14. 			<version>2.9.4</version>
  15. 		</dependency>
  16. 		<dependency>
  17. 			<groupId>com.alibaba</groupId>
  18. 			<artifactId>fastjson</artifactId>
  19. 			<version>1.2.41</version>
  20. 		</dependency>
  21. 		<dependency>
  22. 			<groupId>io.jsonwebtoken</groupId>
  23. 			<artifactId>jjwt</artifactId>
  24. 			<version>0.7.0</version>
  25. 		</dependency>
  26. 		<dependency>
  27. 			<groupId>com.auth0</groupId>
  28. 			<artifactId>java-jwt</artifactId>
  29. 			<version>3.2.0</version>
  30. 		</dependency>
  31. 		<dependency>
  32. 			<groupId>org.springframework</groupId>
  33. 			<artifactId>spring-context</artifactId>
  34. 			<version>5.1.3.RELEASE</version>
  35. 		</dependency>
  36.  
  37. 		<dependency>
  38. 			<groupId>org.springframework</groupId>
  39. 			<artifactId>spring-tx</artifactId>
  40. 			<version>5.1.3.RELEASE</version>
  41. 		</dependency>
  42.  
  43. 		<dependency>
  44. 			<groupId>org.quartz-scheduler</groupId>
  45. 			<artifactId>quartz</artifactId>
  46. 			<version>2.3.0</version>
  47. 		</dependency>
  48.  
  49. 		<dependency>
  50. 			<groupId>org.springframework</groupId>
  51. 			<artifactId>spring-context-support</artifactId>
  52. 			<version>5.1.3.RELEASE</version>
  53. 		</dependency>
  54. 		<dependency>
  55. 			<groupId>org.springframework</groupId>
  56. 			<artifactId>spring-test</artifactId>
  57. 			<version>5.1.3.RELEASE</version>
  58. 		</dependency>
  59.  
  60. 		<dependency>
  61. 			<groupId>org.springframework</groupId>
  62. 			<artifactId>spring-web</artifactId>
  63. 			<version>5.1.3.RELEASE</version>
  64. 		</dependency>
  65. 		<dependency>
  66. 			<groupId>org.springframework</groupId>
  67. 			<artifactId>spring-webmvc</artifactId>
  68. 			<version>5.1.3.RELEASE</version>
  69. 		</dependency>
  70. 		<dependency>
  71. 			<groupId>org.slf4j</groupId>
  72. 			<artifactId>slf4j-log4j12</artifactId>
  73. 			<version>1.7.16</version>
  74. 		</dependency>

2.编写jwt工具类

  1. package com.dqw.util;
  2.  
  3. import java.security.Key;
  4. import java.util.Date;
  5.  
  6. import javax.crypto.spec.SecretKeySpec;
  7. import javax.xml.bind.DatatypeConverter;
  8.  
  9. import io.jsonwebtoken.Claims;
  10. import io.jsonwebtoken.JwtBuilder;
  11. import io.jsonwebtoken.Jwts;
  12. import io.jsonwebtoken.SignatureAlgorithm;
  13. /**
  14.  * jwt工具类
  15.  * @ClassName:  JWTUtil   
  16.  * @Description:TODO
  17.  * @author: 丁乾文
  18.  * @date:   2019年5月13日 下午7:48:21
  19.  */
  20. public class JWTUtil {
  21. 	/**
  22. 	 * token加密时使用的密钥
  23. 	 * 一旦得到该密钥也就可以伪造token了
  24. 	 */
  25. 	public static String sercetKey = "InMySchoolOnline";
  26. 	/**
  27. 	 * 代表token的有效时间
  28. 	 */
  29. 	public final static long keeptime = 1800000;
  30. 	
  31. 	/**
  32. 	 * JWT由3个部分组成,分别是 头部Header,载荷Payload一般是用户信息和声明,签证Signature一般是密钥和签名
  33. 	 * 当头部用base64进行编码后一般都会呈现eyJ...形式,而载荷为非强制使用,签证则包含了哈希算法加密后的数据,包括转码后的header,payload和sercetKey
  34. 	 * 而payload又包含几个部分,issuer签发者,subject面向用户,iat签发时间,exp过期时间,aud接收方。
  35. 	 * @Title: generToken   
  36. 	 * @Description: TODO
  37. 	 * @param: @param id 用户id
  38. 	 * @param: @param issuer 签发者
  39. 	 * @param: @param subject 一般用户名 
  40. 	 * @param: @return      
  41. 	 * @return: String      
  42. 	 * @throws
  43. 	 */
  44. 	public static String generToken(String id, String issuer, String subject) {
  45. 		long ttlMillis = keeptime;
  46. 		SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
  47. 		//使用Hash256算法进行加密
  48. 		long nowMillis = System.currentTimeMillis();
  49. 		Date now = new Date(nowMillis);
  50. 		//获取系统时间以便设置token有效时间
  51. 		byte[] apiKeySecretBytes = DatatypeConverter.parseBase64Binary(sercetKey);
  52. 		//将密钥转码为base64形式,再转为字节码
  53. 		Key signingKey = new SecretKeySpec(apiKeySecretBytes, signatureAlgorithm.getJcaName());
  54. 		//对其使用Hash256进行加密
  55. 		JwtBuilder builder = Jwts.builder().setId(id).setIssuedAt(now);
  56. 		//JWT生成类,此时设置iat,以及根据传入的id设置token
  57. 		if (subject != null) {
  58. 			builder.setSubject(subject);
  59. 		}
  60. 		if (issuer != null) {
  61. 			builder.setIssuer(issuer);
  62. 		}
  63. 		//由于Payload是非必须加入的,所以这时候要加入检测
  64. 		builder.signWith(signatureAlgorithm, signingKey);
  65. 		//进行签名,生成Signature
  66. 		if (ttlMillis >= 0) {
  67. 			long expMillis = nowMillis + ttlMillis;
  68. 			Date exp = new Date(expMillis);
  69. 			builder.setExpiration(exp);
  70. 		}
  71. 		//返回最终的token结果
  72. 		return builder.compact();
  73. 	}
  74. 	/**
  75. 	 * 该函数用于更新token
  76. 	 * @Title: updateToken   
  77. 	 * @Description: TODO
  78. 	 * @param: @param token
  79. 	 * @param: @return      
  80. 	 * @return: String      
  81. 	 * @throws
  82. 	 */
  83. 	public static String updateToken(String token) {
  84. 		//Claims就是包含了我们的Payload信息类
  85. 		Claims claims = verifyToken(token);
  86. 		String id = claims.getId();
  87. 		String subject = claims.getSubject();
  88. 		String issuer = claims.getIssuer();
  89. 		//生成新的token,根据现在的时间
  90. 		return generToken(id, issuer, subject);
  91. 	}
  92. 	/**
  93. 	 * 将token解密出来,将payload信息包装成Claims类返回
  94. 	 * @Title: verifyToken   
  95. 	 * @Description: TODO
  96. 	 * @param: @param token
  97. 	 * @param: @return      
  98. 	 * @return: Claims      
  99. 	 * @throws
  100. 	 */
  101. 	private static Claims verifyToken(String token) {
  102. 		Claims claims = Jwts.parser().setSigningKey(DatatypeConverter.parseBase64Binary(sercetKey))
  103. 				.parseClaimsJws(token).getBody();
  104. 		return claims;
  105. 	}
  106. }
  107.

3.编辑token鉴定spring拦截器

  1. package com.dqw.interceptor;
  2.  
  3. import javax.servlet.http.HttpServletRequest;
  4. import javax.servlet.http.HttpServletResponse;
  5.  
  6. import org.apache.log4j.Logger;
  7. import org.springframework.web.servlet.HandlerInterceptor;
  8. import org.springframework.web.servlet.ModelAndView;
  9.  
  10. import com.alibaba.fastjson.JSON;
  11. import com.dqw.util.JWTUtil;
  12. import com.dqw.util.ResponseData;
  13. /**
  14.  * token鉴定
  15.  * @ClassName:  HeaderTokenInterceptor   
  16.  * @Description:TODO
  17.  * @author: 丁乾文
  18.  * @date:   2019年5月13日 下午8:52:40
  19.  */
  20. public class HeaderTokenInterceptor implements HandlerInterceptor {
  21. 	private static final Logger LOG = Logger.getLogger(HeaderTokenInterceptor.class);
  22. 	public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse,
  23. 			Object handler) throws Exception {
  24. 		ResponseData responseData = null;
  25. 		// 获取我们请求头中的token验证字符
  26. 		String headerToken = httpServletRequest.getHeader("token");
  27. 		// 检测当前页面,我们设置当页面不是登录页面时对其进行拦截
  28. 		// 具体方法就是检测URL中有没有login字符串
  29. 		if (!httpServletRequest.getRequestURI().contains("login")) {
  30. 			if (headerToken == null) {
  31. 				// 如果token不存在的话,返回错误信息。
  32. 				responseData=ResponseData.customerError();
  33. 			}
  34. 			try {
  35. 				// 对token进行更新与验证
  36. 				headerToken = JWTUtil.updateToken(headerToken);
  37. 				LOG.debug("token验证通过,并续期了");
  38. 			} catch (Exception e) {
  39. 				LOG.debug("token验证出现异常!");
  40. 				// 当token验证出现异常返回错误信息,token不匹配
  41. 				responseData=ResponseData.customerError();
  42. 			}
  43. 		}
  44. 		if(responseData!=null) {//如果有错误信息
  45. 			httpServletResponse.getWriter().write(JSON.toJSONString(responseData));
  46. 			return false;
  47. 		}else {
  48. 			// 将token加入返回页面的header
  49. 			httpServletResponse.setHeader("token", headerToken);
  50. 			return true;
  51. 		}
  52. 	}
  53. 	public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o,
  54. 			ModelAndView modelAndView) throws Exception {
  55. 	}
  56. 	public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse,
  57. 			Object o, Exception e) throws Exception {
  58. 	}
  59. }
  60.

4.项目中用到的其他类

  1. package com.dqw.util;
  2.  
  3. import java.util.HashMap;
  4. import java.util.Map;
  5. /**
  6.  * 响应实体
  7.  * @ClassName:  ResponseData   
  8.  * @Description:TODO
  9.  * @author: 丁乾文
  10.  * @date:   2019年5月13日 下午8:53:10
  11.  */
  12. public class ResponseData {
  13. 	private final String message;
  14.     private final int code;
  15.     private final Map<String, Object> data = new HashMap<String, Object>();
  16.  
  17.     public String getMessage() {
  18.         return message;
  19.     }
  20.  
  21.     public int getCode() {
  22.         return code;
  23.     }
  24.  
  25.     public Map<String, Object> getData() {
  26.         return data;
  27.     }
  28.  
  29.     public ResponseData putDataValue(String key, Object value) {
  30.         data.put(key, value);
  31.         return this;
  32.     }
  33.  
  34.     private ResponseData(int code, String message) {
  35.         this.code = code;
  36.         this.message = message;
  37.     }
  38.  
  39.     public static ResponseData ok() {
  40.         return new ResponseData(200, "Ok");
  41.     }
  42.  
  43.     public static ResponseData notFound() {
  44.         return new ResponseData(404, "Not Found");
  45.     }
  46.  
  47.     public static ResponseData badRequest() {
  48.         return new ResponseData(400, "Bad Request");
  49.     }
  50.  
  51.     public static ResponseData forbidden() {
  52.         return new ResponseData(403, "Forbidden");
  53.     }
  54.  
  55.     public static ResponseData unauthorized() {
  56.         return new ResponseData(401, "unauthorized");
  57.     }
  58.  
  59.     public static ResponseData serverInternalError() {
  60.         return new ResponseData(500, "Server Internal Error");
  61.     }
  62.  
  63.     public static ResponseData customerError() {
  64.         return new ResponseData(1001, "customer Error");
  65.     }
  66. }
  67.  
  68.  
  69.  
  70. package com.dqw.po;
  71. /**
  72.  * 用户实体类
  73.  * @ClassName:  User   
  74.  * @Description:TODO
  75.  * @author: 丁乾文
  76.  * @date:   2019年5月13日 下午8:43:38
  77.  */
  78. public class User {
  79. 	private Integer id;
  80. 	private String email;
  81. 	private String password;
  82. 	public Integer getId() {
  83. 		return id;
  84. 	}
  85. 	public void setId(Integer id) {
  86. 		this.id = id;
  87. 	}
  88. 	public String getEmail() {
  89. 		return email;
  90. 	}
  91. 	public void setEmail(String email) {
  92. 		this.email = email;
  93. 	}
  94. 	public String getPassword() {
  95. 		return password;
  96. 	}
  97. 	public void setPassword(String password) {
  98. 		this.password = password;
  99. 	}
  100.  
  101. package com.dqw.interceptor;
  102.  
  103. import javax.servlet.http.HttpServletRequest;
  104. import javax.servlet.http.HttpServletResponse;
  105.  
  106. import org.springframework.web.servlet.HandlerInterceptor;
  107. import org.springframework.web.servlet.ModelAndView;
  108. /**
  109.  * 主要解决请求跨域问题
  110.  * @ClassName:  HttpInterceptor   
  111.  * @Description:TODO
  112.  * @author: 丁乾文
  113.  * @date:   2019年5月13日 下午8:46:41
  114.  */
  115. public class HttpInterceptor implements HandlerInterceptor {
  116.     @Override
  117.     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
  118.         // 允许跨域
  119.         response.setHeader("Access-Control-Allow-Origin", "*");
  120.         // 允许自定义请求头token(允许head跨域)
  121.         response.setHeader("Access-Control-Allow-Headers", "token, Accept, Origin, X-Requested-With, Content-Type, Last-Modified");
  122.         return true;
  123.     }
  124.     @Override
  125.     public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
  126.     }
  127.     @Override
  128.     public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
  129.     }
  130. }
  131. package com.dqw.controller;
  132.  
  133. import org.springframework.web.bind.annotation.GetMapping;
  134. import org.springframework.web.bind.annotation.RequestMapping;
  135. import org.springframework.web.bind.annotation.RestController;
  136.  
  137. import com.dqw.util.ResponseData;
  138. /**
  139.  * 首页
  140.  * @ClassName:  IndexController   
  141.  * @Description:TODO
  142.  * @author: 丁乾文
  143.  * @date:   2019年5月13日 下午9:09:35
  144.  */
  145. @RestController
  146. @RequestMapping("index")
  147. public class IndexController {
  148. 	
  149. 	@GetMapping("index")
  150. 	public ResponseData toLogin() {
  151. 		ResponseData responseData = ResponseData.ok();
  152. 		return responseData;
  153. 	}
  154. }
  155.  
  156.  
  157. package com.dqw.controller;
  158.  
  159. import org.springframework.web.bind.annotation.PostMapping;
  160. import org.springframework.web.bind.annotation.RequestMapping;
  161. import org.springframework.web.bind.annotation.ResponseBody;
  162. import org.springframework.web.bind.annotation.RestController;
  163.  
  164. import com.dqw.po.User;
  165. import com.dqw.util.JWTUtil;
  166. import com.dqw.util.ResponseData;
  167. /**
  168.  * @ClassName:  LoginController   
  169.  * @Description:TODO
  170.  * @author: 丁乾文
  171.  * @date:   2019年5月13日 下午8:41:47
  172.  */
  173. @RestController
  174. @RequestMapping("login")
  175. public class LoginController {
  176. 	/**
  177. 	 * 用户登录
  178. 	 * @Title: login   
  179. 	 * @Description: TODO
  180. 	 * @param: @param user
  181. 	 * @param: @return      
  182. 	 * @return: ResponseData      
  183. 	 * @throws
  184. 	 */
  185.     @PostMapping(value="login")
  186.     public @ResponseBody ResponseData login(User user) {
  187.     	//模拟去查询数据库，看是否存在此用户
  188.     	boolean login = toLogin(user);
  189.     	ResponseData responseData = ResponseData.ok();
  190.     	if(login) {
  191.     		//生成token
  192.     		String token = JWTUtil.generToken("1", "Jersey-Security-Basic", user.getEmail());
  193.     		//向浏览器返回token，客户端受到此token后存入cookie中，或者h5的本地存储中
  194.     		responseData.putDataValue("token", token);
  195.     		//以及用户
  196.     		responseData.putDataValue("user", user);
  197.     	}else {
  198.     		//用户或者密码错误
  199.     		responseData=ResponseData.customerError();
  200.     	}
  201.         return responseData;
  202.     }
  203.     public boolean toLogin(User user) {
  204.     	if(user.getEmail()!=null&&user.getEmail().trim().length()>0) {
  205.     		if(user.getEmail().equals("root")) {
  206.     			if(user.getPassword().equals("123456")) {
  207.     				return true;
  208.     			}
  209.     		}
  210.     	}
  211.     	return false;
  212.     }
  213. }
  214.  
  215. }
  216.  
  217.

5.附springmvc配置文件

  1.     <context:component-scan base-package="com"></context:component-scan>
  2.     <!-- 启动注解驱动 -->
  3.     <mvc:annotation-driven/>
  4.     <context:annotation-config></context:annotation-config>
  5.     <mvc:interceptors>
  6.     	<!-- 允许跨域 -->
  7.      	<mvc:interceptor>
  8.             <mvc:mapping path="/**"/>
  9.             <bean class="com.dqw.interceptor.HttpInterceptor"></bean>
  10.         </mvc:interceptor> 
  11.     	<!-- 检验Token -->
  12.          <mvc:interceptor>
  13.             <mvc:mapping path="/**"/>
  14.             <bean class="com.dqw.interceptor.HeaderTokenInterceptor"></bean>
  15.         </mvc:interceptor> 
  16.      </mvc:interceptors>

6.login.html

  1. <!DOCTYPE html>
  2. <html>
  3. <head>
  4. <meta charset="UTF-8">
  5. <title>Insert title here</title>
  6. <script type="text/javascript" src="jquery.min.js"></script>
  7. <script type="text/javascript" src="jquery.cookie.js"></script>
  8. </head>
  9. <body>
  10. 	邮箱：<input type="text" name="email"><br>
  11. 	密码：<input type="text" name="password"><br>
  12. 	<input type="submit" onclick="signIn()" value="登录">
  13. 	<script type="text/javascript">
  14. 	/**
  15.      * 登录ajax，登录成功后获取后台返回的token，并把token保存到cookie中
  16. 	 * 以后用户每次请求后台数据需要携带此token
  17.      */
  18. 	function signIn() {
  19. 	    let email = $("input[name='email']").val();
  20. 	    let password = $("input[name='password']").val();
  21. 	    $.ajax({
  22. 	        url: "http://localhost:8080/jwt/login/login.action",
  23. 	        type: "POST",
  24. 	        dataType: "json",
  25. 	        data: {email: email, password: password},
  26. 	        success: function (result) {
  27. 				if(result.code==200){
  28. 					//保存token用来判断用户是否登录，和身份是否属实
  29. 					$.cookie('token', result.data.token);
  30. 					//$.cookie('user', result.data.user);
  31. 					//转向主页面
  32. 					location="index.html";
  33. 				}else{
  34. 					alert("用户名或者密码错误！");
  35. 				}
  36. 	        }
  37. 	    })
  38. 	}
  39. 	</script>
  40. </body>
  41. </html>

7.index.html

  1. <!DOCTYPE html>
  2. <html>
  3. <head>
  4. <meta charset="UTF-8">
  5. <title>欢迎</title>
  6. <script type="text/javascript" src="jquery.min.js"></script>
  7. <script type="text/javascript" src="jquery.cookie.js"></script>
  8. </head>
  9. <body>
  10. 欢迎你（可以从本地存取获取cookie中获取）
  11. <br>
  12. <button onclick="logout()">注销</button>
  13. <script type="text/javascript">
  14.     /**
  15.      * 请求数据的ajax，需要从cookie读取token放入head传给后台。
  16.      */
  17.     loadDeptTree();
  18. 	function loadDeptTree() {
  19. 	    $.ajax({
  20. 	        // 自定义的headers字段，会出现option请求，在GET请求之前，后台要记得做检验。
  21. 	        headers: {
  22. 	            token: $.cookie('token')
  23. 	        },
  24. 	        url: "http://localhost:8080/jwt/index/index.action",
  25. 	        type: 'GET',
  26. 	        dataType: 'json',
  27. 	        success : function (result) {
  28. 				if(result.code==200){
  29. 					alert("加载到的数据："+result+",并进行渲染页面.....");
  30. 				}else{
  31. 					alert("异常,非法token，这里不直接判断是否token不对，实际开发需要各种判断返回码。");
  32. 				}
  33. 	        }
  34. 	    })
  35. 	}
  36.     /**
  37.      * 注销，清空所有cookie(或者只清空保存着token的Cookie就行)
  38.      */
  39. 	function logout() {
  40. 	    var keys = document.cookie.match(/[^ =;]+(?=\=)/g);
  41. 	    if(keys) {
  42. 	        for(var i = keys.length; i--;)
  43. 	            document.cookie = keys[i] + '=0;expires=' + new Date(0).toUTCString()
  44. 	    }
  45. 	    //返回登录页面或者主页
  46. 	    window.location.href = "login.html";
  47. 	}
  48. </script>
  49. </body>
  50. </html>

 

声明：本文内容由网友自发贡献，转载请注明出处：【wpsshop】
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号