devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

基于SpringBoot2开发WebApi（六）JWT(json web token)集成_jwt getaudience

作者：从前慢现在也慢 | 2024-03-06 20:08:13

赞

踩

jwt getaudience

1.前言

1.1.JWT说明

JWT全程JSON Web Token，是一个开放标准(RFC 7519)，它定义了一种紧凑的、自包含的方式，用于作为JSON对象在各方之间安全地传输信息。该信息可以被验证和信任，因为它是数字签名。

1.2.什么情况下需要用JWT

  • Authorization (授权) : 这是使用JWT的最常见场景。一旦用户登录，后续每个请求都将包含JWT，允许用户访问该令牌允许的路由、服务和资源。单点登录是现在广泛使用的JWT的一个特性，因为它的开销很小，并且可以轻松地跨域使用。
  • Information Exchange (信息交换) : 对于安全的在各方之间传输信息而言，JSON Web Token无疑是一种很好的方式。因为JWT可以被签名，例如，用公钥/私钥对，你可以确定发送人就是它们所说的那个人。另外，由于签名是使用头和有效负载计算的，您还可以验证内容没有被篡改。

1.3.JWT结构说明

JSON Web Token由三部分组成，它们之间用圆点(.)连接。这三部分分别是：

  • Header：JWT头
  • Payload：有效载荷
  • Signature：签名

结构是这样的：xxxxxx.yyyyyy.zzzzzz

例如：

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOlsiMSIsImFkbWluIiwiMSJdLCJleHAiOjE2MjMwNzUyMzcsImlhdCI6MTYyMzA0NjQzN30.pT5NgZCkfN2WwQS8rp1Scifa07KbuvZbXO8y8596ACg

2.集成说明

2.1引入依赖

  1.         <dependency>
  2.             <groupId>com.auth0</groupId>
  3.             <artifactId>java-jwt</artifactId>
  4.             <version>3.4.0</version>
  5.         </dependency>

2.2.定义Token工具类

TokenUtil
  1. package com.xxxxxx.sim.utils;
  2.  
  3. import com.auth0.jwt.JWT;
  4. import com.xxxxxx.sim.model.AdminUser;
  5. import org.springframework.boot.autoconfigure.kafka.KafkaProperties;
  6. import org.springframework.web.context.request.RequestContextHolder;
  7. import org.springframework.web.context.request.ServletRequestAttributes;
  8.  
  9. import javax.servlet.http.HttpServletRequest;
  10. import java.math.BigInteger;
  11. import java.util.List;
  12.  
  13. /**
  14.  * Token方法封装
  15.  * @author xxxx
  16.  * @date 20200428
  17.  */
  18. public class TokenUtil {
  19.     /**
  20.      * 获取Token里面的UserId
  21.      * @return
  22.      */
  23.     public static String getTokenUserId() {
  24.         // 从 http 请求头中取出 token
  25.         String token = getRequest().getHeader("token");
  26.         String userId = JWT.decode(token).getAudience().get(0);
  27.         return userId;
  28.     }
  29.  
  30.     /**
  31.      * 获取Token里面的UserName
  32.      * @return
  33.      */
  34.     public static String getTokenUseName(){
  35.         // 从 http 请求头中取出 token
  36.         String token = getRequest().getHeader("token");
  37.         String userName = JWT.decode(token).getAudience().get(1);
  38.         return userName;
  39.     }
  40.     /**
  41.      * 获取request
  42.      *
  43.      * @return
  44.      */
  45.     public static HttpServletRequest getRequest() {
  46.         ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder
  47.                 .getRequestAttributes();
  48.         return requestAttributes == null ? null : requestAttributes.getRequest();
  49.     }
  50.  
  51. }

2.3.定义注解

@CheckToken需要验证Token注解
  1. package com.xxxxxx.sim.annotation;
  2.  
  3. import java.lang.annotation.ElementType;
  4. import java.lang.annotation.Retention;
  5. import java.lang.annotation.RetentionPolicy;
  6. import java.lang.annotation.Target;
  7.  
  8. /**
  9.  * 需要验证Token
  10.  * @author xxxxxx
  11.  * @date 20200428
  12.  */
  13. @Target({ElementType.METHOD, ElementType.TYPE})
  14. @Retention(RetentionPolicy.RUNTIME)
  15. public @interface CheckToken {
  16.     boolean required() default true;
  17. }
@PassToken跳过Token验证注解
  1. package com.xxxxxx.sim.annotation;
  2.  
  3. import java.lang.annotation.ElementType;
  4. import java.lang.annotation.Retention;
  5. import java.lang.annotation.RetentionPolicy;
  6. import java.lang.annotation.Target;
  7.  
  8.  
  9. /**
  10.  * 跳过验证
  11.  * @author xxxxxx
  12.  * @date 20200428
  13.  */
  14. @Target({ElementType.METHOD, ElementType.TYPE})
  15. @Retention(RetentionPolicy.RUNTIME)
  16. public @interface PassToken {
  17.     boolean required() default true;
  18. }
  19.

需要验证Token注解

2.4.定义Token拦截器

AuthenticationInterceptor
  1. package com.xxxxxx.sim.utils;
  2.  
  3. import com.auth0.jwt.JWT;
  4. import com.auth0.jwt.JWTVerifier;
  5. import com.auth0.jwt.algorithms.Algorithm;
  6. import com.auth0.jwt.exceptions.JWTDecodeException;
  7. import com.auth0.jwt.exceptions.JWTVerificationException;
  8. import com.xxxxxx.sim.annotation.CheckToken;
  9. import com.xxxxxx.sim.annotation.PassToken;
  10. import com.xxxxxx.sim.model.AdminUser;
  11. import com.xxxxxx.sim.service.AdminUserService;
  12. import org.springframework.beans.factory.annotation.Autowired;
  13. import org.springframework.web.method.HandlerMethod;
  14. import org.springframework.web.servlet.HandlerInterceptor;
  15. import org.springframework.web.servlet.ModelAndView;
  16.  
  17. import javax.servlet.http.HttpServletRequest;
  18. import javax.servlet.http.HttpServletResponse;
  19. import java.lang.reflect.Method;
  20. import java.math.BigInteger;
  21.  
  22.  
  23. /**
  24.  * Token拦截器
  25.  * @author xxxxxx
  26.  * @date 20200428
  27.  */
  28. public class AuthenticationInterceptor implements HandlerInterceptor {
  29.     @Autowired
  30.     private AdminUserService adminUserService;
  31.     @Override
  32.     public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object object) throws Exception {
  33.         // 从 http 请求头中取出 token
  34.         String token = httpServletRequest.getHeader("token");
  35.         // 如果不是映射到方法直接通过
  36.         if(!(object instanceof HandlerMethod)){
  37.             return true;
  38.         }
  39.         HandlerMethod handlerMethod=(HandlerMethod)object;
  40.         Method method=handlerMethod.getMethod();
  41.         //检查是否有PassToken注释，有则跳过认证
  42.         if (method.isAnnotationPresent(PassToken.class)) {
  43.             PassToken passToken = method.getAnnotation(PassToken.class);
  44.             if (passToken.required()) {
  45.                 return true;
  46.             }
  47.         }
  48.         //检查有没有需要用户权限的注解
  49.         if (method.isAnnotationPresent(CheckToken.class)) {
  50.             CheckToken checkToken = method.getAnnotation(CheckToken.class);
  51.             if (checkToken.required()) {
  52.                 // 执行认证
  53.                 if (token == null) {
  54.                     return false;
  55.                 }
  56.                 // 获取 token 中的 user id
  57.                 String userId;
  58.                 try {
  59.                     userId = JWT.decode(token).getAudience().get(0);
  60.                 } catch (JWTDecodeException j) {
  61.                     return false;
  62.                 }
  63.                 AdminUser user = adminUserService.queryAdminUserById(new BigInteger(userId));
  64.                 if (user == null) {
  65.                     return false;
  66.                 }
  67.                 // 验证 token
  68.                 JWTVerifier jwtVerifier = JWT.require(Algorithm.HMAC256(user.getPassWord())).build();
  69.                 try {
  70.                     jwtVerifier.verify(token);
  71.                 } catch (JWTVerificationException e) {
  72.                     return false;
  73.                 }
  74.                 return true;
  75.             }
  76.         }
  77.         return true;
  78.     }
  79.  
  80.     @Override
  81.     public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {
  82.  
  83.     }
  84.     @Override
  85.     public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {
  86.     }
  87. }

2.5.初始化拦截器

  1. package com.xxxxxx.sim.configuration;
  2.  
  3. import com.xxxxxx.sim.utils.AuthenticationInterceptor;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.format.FormatterRegistry;
  7. import org.springframework.http.converter.HttpMessageConverter;
  8. import org.springframework.validation.MessageCodesResolver;
  9. import org.springframework.validation.Validator;
  10. import org.springframework.web.method.support.HandlerMethodArgumentResolver;
  11. import org.springframework.web.method.support.HandlerMethodReturnValueHandler;
  12. import org.springframework.web.servlet.HandlerExceptionResolver;
  13. import org.springframework.web.servlet.config.annotation.*;
  14.  
  15. import java.util.List;
  16.  
  17. /**
  18.  * 新建Token拦截器
  19.  * @author xxxxxxx
  20.  * @date 20200429
  21.  */
  22. @Configuration
  23. public class InterceptorConfig implements WebMvcConfigurer {
  24.     @Override
  25.     public void addInterceptors(InterceptorRegistry registry) {
  26.         registry.addInterceptor(authenticationInterceptor())
  27.                 .addPathPatterns("/**");
  28.     }
  29.     @Bean
  30.     public AuthenticationInterceptor authenticationInterceptor() {
  31.         return new AuthenticationInterceptor();
  32.     }
  33.     @Override
  34.     public void addArgumentResolvers(List<HandlerMethodArgumentResolver> arg0) {
  35.         // TODO Auto-generated method stub
  36.  
  37.     }
  38.     @Override
  39.     public void addCorsMappings(CorsRegistry arg0) {
  40.         // TODO Auto-generated method stub
  41.  
  42.     }
  43.     @Override
  44.     public void addFormatters(FormatterRegistry arg0) {
  45.         // TODO Auto-generated method stub
  46.  
  47.     }
  48.     @Override
  49.     public void addResourceHandlers(ResourceHandlerRegistry arg0) {
  50.         // TODO Auto-generated method stub
  51.  
  52.     }
  53.     @Override
  54.     public void addReturnValueHandlers(List<HandlerMethodReturnValueHandler> arg0) {
  55.         // TODO Auto-generated method stub
  56.  
  57.     }
  58.     @Override
  59.     public void addViewControllers(ViewControllerRegistry arg0) {
  60.         // TODO Auto-generated method stub
  61.  
  62.     }
  63.     @Override
  64.     public void configureAsyncSupport(AsyncSupportConfigurer arg0) {
  65.         // TODO Auto-generated method stub
  66.  
  67.     }
  68.     @Override
  69.     public void configureContentNegotiation(ContentNegotiationConfigurer arg0) {
  70.         // TODO Auto-generated method stub
  71.  
  72.     }
  73.     @Override
  74.     public void configureDefaultServletHandling(DefaultServletHandlerConfigurer arg0) {
  75.         // TODO Auto-generated method stub
  76.  
  77.     }
  78.     @Override
  79.     public void configureHandlerExceptionResolvers(List<HandlerExceptionResolver> arg0) {
  80.         // TODO Auto-generated method stub
  81.  
  82.     }
  83.     @Override
  84.     public void configureMessageConverters(List<HttpMessageConverter<?>> arg0) {
  85.         // TODO Auto-generated method stub
  86.  
  87.     }
  88.     @Override
  89.     public void configurePathMatch(PathMatchConfigurer arg0) {
  90.         // TODO Auto-generated method stub
  91.  
  92.     }
  93.     @Override
  94.     public void configureViewResolvers(ViewResolverRegistry arg0) {
  95.         // TODO Auto-generated method stub
  96.  
  97.     }
  98.     @Override
  99.     public void extendHandlerExceptionResolvers(List<HandlerExceptionResolver> arg0) {
  100.         // TODO Auto-generated method stub
  101.  
  102.     }
  103.     @Override
  104.     public void extendMessageConverters(List<HttpMessageConverter<?>> arg0) {
  105.         // TODO Auto-generated method stub
  106.  
  107.     }
  108.     @Override
  109.     public MessageCodesResolver getMessageCodesResolver() {
  110.         // TODO Auto-generated method stub
  111.         return null;
  112.     }
  113.     @Override
  114.     public Validator getValidator() {
  115.         // TODO Auto-generated method stub
  116.         return null;
  117.     }
  118. }

3.Token使用

3.1.定义token使用Service

  1. package com.xxxxxx.sim.service;
  2.  
  3. import com.auth0.jwt.JWT;
  4. import com.auth0.jwt.algorithms.Algorithm;
  5. import com.xxxxxx.sim.model.AdminUser;
  6. import org.springframework.stereotype.Service;
  7.  
  8. import java.util.Date;
  9.  
  10. /**
  11.  * 获取Token Service
  12.  * @author xxxxxx
  13.  */
  14. @Service
  15. public class TokenService {
  16.  
  17.     /**
  18.      * 获取Token
  19.      * @param user
  20.      * @return
  21.      */
  22.     public String getToken(AdminUser user) {
  23.         Date start = new Date();
  24.         //8小时有效时间
  25.         long currentTime = System.currentTimeMillis() + 8*60* 60 * 1000;
  26.         Date end = new Date(currentTime);
  27.         String token = "";
  28.  
  29.         token = JWT.create().withAudience(user.getId().toString()).withIssuedAt(start).withExpiresAt(end)
  30.                 .sign(Algorithm.HMAC256(user.getPassWord()));
  31.         return token;
  32.     }
  33. }

3.2.登录Controller生成Token

  1. package com.xxxxxx.sim.controller;
  2.  
  3. import com.xxxxxx.sim.base.Result;
  4. import com.xxxxxx.sim.base.ResultEnum;
  5. import com.xxxxxx.sim.base.ResultGenerator;
  6. import com.xxxxxx.sim.model.AdminUser;
  7. import com.xxxxxx.sim.service.AdminUserService;
  8. import com.xxxxxx.sim.service.TokenService;
  9. import io.swagger.annotations.Api;
  10. import io.swagger.annotations.ApiOperation;
  11. import io.swagger.annotations.ApiResponse;
  12. import io.swagger.annotations.ApiResponses;
  13. import org.springframework.beans.factory.annotation.Autowired;
  14. import org.springframework.web.bind.annotation.RequestMapping;
  15. import org.springframework.web.bind.annotation.RequestMethod;
  16. import org.springframework.web.bind.annotation.RequestParam;
  17. import org.springframework.web.bind.annotation.RestController;
  18.  
  19. import javax.servlet.http.Cookie;
  20. import javax.servlet.http.HttpServletResponse;
  21.  
  22. /**
  23.  * @author xxxxxx
  24.  */
  25. @Api(tags = "登录")
  26. @RestController
  27. public class LoginController {
  28.     @Autowired
  29.     private AdminUserService adminUserService;
  30.     @Autowired
  31.     private TokenService tokenService;
  32.  
  33.     @ApiOperation(value = "登陆", notes = "登陆")
  34.     @ApiResponses({
  35.             @ApiResponse(code = 200,message = "成功",response = AdminUser.class),
  36.     })
  37.     @RequestMapping(value = "/login" ,method = RequestMethod.GET)
  38.     public Result<Object> login(@RequestParam String userName, @RequestParam String password, HttpServletResponse response){
  39.         AdminUser adminUser=adminUserService.queryAdminUserListByUserName(userName);
  40.         if(adminUser!=null)
  41.         {
  42.             if(adminUser.getPassWord().equals(password))
  43.             {
  44.                 String token = tokenService.getToken(adminUser);
  45.                 Cookie cookie = new Cookie("token", token);
  46.                 cookie.setPath("/");
  47.                 response.addCookie(cookie);
  48.                 //将token返回前端
  49.                 adminUser.setUserToken(token);
  50.                 //将密码置空,不返回给前端
  51.                 adminUser.setPassWord("");
  52.                 return ResultGenerator.success(adminUser);
  53.             }else
  54.             {
  55.                 return ResultGenerator.failure(ResultEnum.PASSWORD_ERROR);
  56.             }
  57.         }else
  58.         {
  59.             return ResultGenerator.failure(ResultEnum.USER_NOT_EXISTS);
  60.         }
  61.     }
  62. }

3.3.接口需要验证Token

  1.     @CheckToken
  2.     @ApiOperation(value = "用户列表查询", notes = "用户列表查询")
  3.     @ApiImplicitParams({
  4.             @ApiImplicitParam(name = "key",value = "查询条件"),
  5.             @ApiImplicitParam(name = "pageNum",value = "当前页",required = true),
  6.             @ApiImplicitParam(name = "pageSize",value = "每页显示条数",required = true),
  7.             @ApiImplicitParam(name = "roleId",value = "角色id",required = true)
  8.     })
  9.     @ApiResponses({
  10.             @ApiResponse(code = 200,message = "成功",response = AdminUser.class),
  11.     })
  12.     @PostMapping(value = "queryAdminUserList")
  13.     public Result<Object> queryAdminUserList(String key, int pageNum, int pageSize,BigInteger roleId){
  14.         try {
  15.             //判空
  16.             if(roleId.longValue() <= 0){
  17.                 return ResultGenerator.failure(ResultEnum.Param_Error) ;
  18.             }
  19.             PageResult pageUserList = adminUserService.queryAdminUserList(key,pageNum,pageSize,roleId);
  20.             return ResultGenerator.success("成功",pageUserList);
  21.         } catch (Exception e) {
  22.             e.printStackTrace();
  23.             return ResultGenerator.error("失败:" + e.getMessage());
  24.         }
  25.     }

在接口方法上加上@CheckToken注解即可

4.最后再Swagger2上增加token传入的说明

  1. package com.xxxxxx.sim.configuration;
  2.  
  3.  
  4. import com.xxxxxx.sim.base.ResultEnum;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.web.bind.annotation.RequestMethod;
  8. import springfox.documentation.builders.*;
  9. import springfox.documentation.schema.ModelRef;
  10. import springfox.documentation.service.ApiInfo;
  11. import springfox.documentation.service.Parameter;
  12. import springfox.documentation.service.ResponseMessage;
  13. import springfox.documentation.spi.DocumentationType;
  14. import springfox.documentation.spring.web.plugins.Docket;
  15. import springfox.documentation.swagger2.annotations.EnableSwagger2;
  16.  
  17. import java.util.ArrayList;
  18. import java.util.Arrays;
  19. import java.util.List;
  20.  
  21. /**
  22.  * <p>Swagger2配置类</p>
  23.  * @author xxxxxx
  24.  * @date 20200429
  25.  */
  26. @Configuration
  27. @EnableSwagger2
  28. public class SwaggerConfig {
  29.     /**
  30.      * 创建API应用
  31.      * apiInfo() 增加API相关信息
  32.      * 通过select()函数返回一个ApiSelectorBuilder实例,用来控制哪些接口暴露给Swagger来展现，
  33.      * 本例采用指定扫描的包路径来定义指定要建立API的目录。
  34.      *
  35.      * @return
  36.      */
  37.     @Bean
  38.     public Docket createRestApi() {
  39.         //添加全局响应状态码
  40.         List<ResponseMessage> responseMessageList = new ArrayList<>();
  41.         Arrays.stream(ResultEnum.values()).forEach(errorEnums -> {
  42.             responseMessageList.add(
  43.                     new ResponseMessageBuilder().code(errorEnums.getCode()).message(errorEnums.getMessage()).responseModel(
  44.                             new ModelRef(errorEnums.getMessage())).build()
  45.             );
  46.         });
  47.  
  48.         ParameterBuilder aParameterBuilder = new ParameterBuilder();
  49.         aParameterBuilder.name("token").description("token验证信息").modelRef(new ModelRef("String")).parameterType("header").build();
  50.         List<Parameter> aParameters = new ArrayList<Parameter>();
  51.         aParameters.add(aParameterBuilder.build());
  52.  
  53.         return new Docket(DocumentationType.SWAGGER_2)
  54.                 // 添加全局响应状态码
  55.                 .globalResponseMessage(RequestMethod.GET, responseMessageList)
  56.                 .globalResponseMessage(RequestMethod.POST, responseMessageList)
  57.                 .globalResponseMessage(RequestMethod.PUT, responseMessageList)
  58.                 .globalResponseMessage(RequestMethod.DELETE, responseMessageList)
  59.  
  60.                 .apiInfo(apiInfo())
  61.                 .select()
  62.                 .apis(RequestHandlerSelectors.basePackage("com.jointcontrols.sim.controller"))
  63.                 .paths(PathSelectors.any())
  64.                 .build()
  65.                 .useDefaultResponseMessages(false)
  66.                 .globalOperationParameters(aParameters);
  67.  
  68.  
  69.  
  70.     }
  71.  
  72.     /**
  73.      * 创建该API的基本信息（这些基本信息会展现在文档页面中）
  74.      * 访问地址：http://项目实际地址/swagger-ui.html
  75.      *
  76.      * @return
  77.      */
  78.     private ApiInfo apiInfo() {
  79.         return new ApiInfoBuilder()
  80.                 .title("SIM Manager APIs")
  81.                 .description("SIM卡管理接口文档")
  82.                 .termsOfServiceUrl("http://www.baidu.com")
  83.                 .version("1.0.0")
  84.                 .build();
  85.     }
  86. }

 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/201254
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号