devbox
羊村懒王
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringBoot+SpringSecurity+JWT实RESTfulAPI权限控制_springboot security jwt

作者：羊村懒王 | 2024-05-06 23:17:27

赞

踩

springboot security jwt

关于什么是jwt（json web token），还有jwt的工作流程我这边就不多介绍，主要给大家介绍一下SpringBoot中如何整合Security然后在添加jwt的支持。

​​​​​​​史上最全Java技术栈面试题都在这里面了：Java面试题

通过SpringBoot+Security+JWT来实现token校验的过程。在生产环境中，对发布API增加授权保护是非常必要的一件事情，这里我们就是利用jwt生成token，利用token来进行接口安全验证。

在整合jwt之前，我们首先要在SpringBoot中整合security的模块，来实现基于security的授权控制。用过security的人都知道，它的功能无比的强大比shiro还要强大，但是今天我就介绍security中关于权限控制和是登录验证的这一块的功能。

1.在开始之前我们先在pom.xml中添加security和jwt的相关依赖，如下所示：

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <groupId>org.sang</groupId>
  6.     <artifactId>test26-security</artifactId>
  7.     <version>0.0.1-SNAPSHOT</version>
  8.     <packaging>jar</packaging>
  9.     <name>Test26-Security</name>
  10.     <description>Demo project for Spring Boot</description>
  11.     <parent>
  12.         <groupId>org.springframework.boot</groupId>
  13.         <artifactId>spring-boot-starter-parent</artifactId>
  14.         <version>1.4.3.RELEASE</version>
  15.         <relativePath/> <!-- lookup parent from repository -->
  16.     </parent>
  17.     <properties>
  18.         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  19.         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
  20.         <java.version>1.8</java.version>
  21.     </properties>
  22.     <dependencies>
  23.         <dependency>
  24.             <groupId>org.springframework.boot</groupId>
  25.             <artifactId>spring-boot-starter-data-jpa</artifactId>
  26.         </dependency>
  27.         <dependency>
  28.             <groupId>org.springframework.boot</groupId>
  29.             <artifactId>spring-boot-starter-security</artifactId>
  30.         </dependency>
  31.         <dependency>
  32.             <groupId>org.springframework.boot</groupId>
  33.             <artifactId>spring-boot-starter-thymeleaf</artifactId>
  34.         </dependency>
  35.         <dependency>
  36.             <groupId>org.springframework.boot</groupId>
  37.             <artifactId>spring-boot-starter-test</artifactId>
  38.             <scope>test</scope>
  39.         </dependency>
  40.         <dependency>
  41.             <groupId>org.thymeleaf.extras</groupId>
  42.             <artifactId>thymeleaf-extras-springsecurity4</artifactId>
  43.         </dependency>
  44.         <dependency>
  45.             <groupId>mysql</groupId>
  46.             <artifactId>mysql-connector-java</artifactId>
  47.             <version>5.1.40</version>
  48.         </dependency>
  49.         <!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt -->
  50.         <dependency>
  51.             <groupId>io.jsonwebtoken</groupId>
  52.             <artifactId>jjwt</artifactId>
  53.             <version>0.9.0</version>
  54.         </dependency>
  55.     </dependencies>
  56.     <build>
  57.         <plugins>
  58.             <plugin>
  59.                 <groupId>org.springframework.boot</groupId>
  60.                 <artifactId>spring-boot-maven-plugin</artifactId>
  61.             </plugin>
  62.         </plugins>
  63.     </build>
  64. </project>

2.在application.properties中添加数据库和jpa还有jwt的相关配置。具体如下所示：

  1. spring.datasource.driver-class-name=com.mysql.jdbc.Driver
  2. spring.datasource.url=jdbc:mysql://localhost:3306/security_db?useUnicode=true&characterEncoding=utf-8
  3. spring.datasource.username=root
  4. spring.datasource.password=220316
  5. logging.level.org.springframework.security=info
  6. spring.thymeleaf.cache=false
  7. spring.jpa.hibernate.ddl-auto=update
  8. spring.jpa.show-sql=true
  9. spring.jackson.serialization.indent_output=true
  10.  
  11. # JWT 604800
  12. jwt.header:Authorization
  13. jwt.secret:mySecret
  14. jwt.expiration:10
  15. jwt.tokenHead:Bearer
  16. jwt.route.authentication.path:auth/login
  17. jwt.route.authentication.refresh:auth/refresh
  18. jwt.route.authentication.register:"auth/register"

3.新建实体类，进行用户登录的授权验证。（这里我新建两个实体类，一个是用户实体类，一个是用户关系实体类）

用户实体类：SysUser

  1. package org.security.entity;
  2. import org.springframework.security.core.GrantedAuthority;
  3. import org.springframework.security.core.authority.SimpleGrantedAuthority;
  4. import org.springframework.security.core.userdetails.UserDetails;
  5. import javax.persistence.*;
  6. import java.util.ArrayList;
  7. import java.util.Collection;
  8. import java.util.Date;
  9. import java.util.List;
  10. @Entity
  11. public class SysUser implements UserDetails {
  12.     @Id
  13.     @GeneratedValue
  14.     private Long id;
  15.     private String username;
  16.     private String password;
  17.     private Date lastPasswordResetDate;
  18.     @ManyToMany(cascade = {CascadeType.REFRESH},fetch = FetchType.EAGER)
  19.     private List<SysRole> roles;
  20.     public Long getId() {
  21.         return id;
  22.     }
  23.  
  24.     public void setId(Long id) {
  25.         this.id = id;
  26.     }
  27.  
  28.     public void setUsername(String username) {
  29.         this.username = username;
  30.     }
  31.  
  32.     public void setPassword(String password) {
  33.         this.password = password;
  34.     }
  35.  
  36.     public List<SysRole> getRoles() {
  37.         return roles;
  38.     }
  39.  
  40.     public void setRoles(List<SysRole> roles) {
  41.         this.roles = roles;
  42.     }
  43.  
  44.     public Date getLastPasswordResetDate() {
  45.         return lastPasswordResetDate;
  46.     }
  47.  
  48.     public void setLastPasswordResetDate(Date lastPasswordResetDate) {
  49.         this.lastPasswordResetDate = lastPasswordResetDate;
  50.     }
  51.  
  52.     @Override
  53.     public Collection<? extends GrantedAuthority> getAuthorities() {
  54.         List<GrantedAuthority> auths = new ArrayList<>();
  55.         List<SysRole> roles = this.getRoles();
  56.         for (SysRole role : roles) {
  57.             auths.add(new SimpleGrantedAuthority(role.getName()));
  58.         }
  59.         return auths;
  60.     }
  61.  
  62.     @Override
  63.     public String getPassword() {
  64.         return this.password;
  65.     }
  66.  
  67.     @Override
  68.     public String getUsername() {
  69.         return this.username;
  70.     }
  71.  
  72.     @Override
  73.     public boolean isAccountNonExpired() {
  74.         return true;
  75.     }
  76.  
  77.     @Override
  78.     public boolean isAccountNonLocked() {
  79.         return true;
  80.     }
  81.  
  82.     @Override
  83.     public boolean isCredentialsNonExpired() {
  84.         return true;
  85.     }
  86.  
  87.     @Override
  88.     public boolean isEnabled() {
  89.         return true;
  90.     }
  91. }

因为SysUser实体类继承UserDetails接口，这个类是基于Security的安全服务。所以通过继承UserDetails这个类，我们就可以实现Security中相关的功能了，后面我们会具体介绍是怎么一回事。

用户关系实体类：SysRole

  1. package org.security.entity;
  2. import javax.persistence.Entity;
  3. import javax.persistence.GeneratedValue;
  4. import javax.persistence.Id;
  5. @Entity
  6. public class SysRole {
  7.     @Id
  8.     @GeneratedValue
  9.     private Long id;
  10.     private String name;
  11.  
  12.  
  13.     public Long getId() {
  14.         return id;
  15.     }
  16.  
  17.     public void setId(Long id) {
  18.         this.id = id;
  19.     }
  20.  
  21.     public String getName() {
  22.         return name;
  23.     }
  24.  
  25.     public void setName(String name) {
  26.         this.name = name;
  27.     }
  28. }

SysRole实体类是保存着用户的拥有什么样权限的实体类。和用户实体是多对一的关系，也就是一个用户可以拥有多个权限。

实体类创建好之后，我们就可以编写相应的dao，service，controller类来实现用户登录的功能了。这里我会新建一个login.html页面和index.html页面，来进行登录校验的和权限控制演示。

dao接口（这里我采用jpa来实现用户查询的功能）

  1. package org.security.dao;
  2. import org.security.entity.SysUser;
  3. import org.springframework.data.jpa.repository.JpaRepository;
  4. public interface SysUserRepository extends JpaRepository<SysUser, Long> {
  5.     SysUser findByUsername(String username);
  6. }

service业务类

  1. package org.security.service;
  2. import org.security.dao.SysUserRepository;
  3. import org.security.entity.SysUser;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.security.core.userdetails.UserDetails;
  6. import org.springframework.security.core.userdetails.UserDetailsService;
  7. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  8. public class CustomUserService implements UserDetailsService {
  9.     @Autowired
  10.     SysUserRepository userRepository;
  11.     @Override
  12.     public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
  13.         SysUser user = userRepository.findByUsername(s);
  14.         if (user == null) {
  15.             throw new UsernameNotFoundException("用户名不存在");
  16.         }
  17.         System.out.println("s:"+s);
  18.         System.out.println("username:"+user.getUsername()+";password:"+user.getPassword());
  19.         System.out.println("size:"+user.getRoles().size());
  20.         System.out.println("role:"+user.getRoles().get(0).getName());
  21.         return user;
  22.     }
  23. }

controller控制类：

  1. package org.security.controller;
  2. import org.security.entity.Msg;
  3. import org.springframework.security.access.prepost.PreAuthorize;
  4. import org.springframework.stereotype.Controller;
  5. import org.springframework.ui.Model;
  6. import org.springframework.web.bind.annotation.RequestMapping;
  7. import org.springframework.web.bind.annotation.RequestMethod;
  8. import org.springframework.web.bind.annotation.ResponseBody;
  9.  
  10. /**
  11.  * Created by linzhiqiang on 2017/10/26
  12.  */
  13. @Controller
  14. public class HomeController {
  15.     @RequestMapping("/")
  16.     public String index(Model model) {
  17.         Msg msg = new Msg("测试标题", "测试内容", "额外信息，只对管理员显示");
  18.         model.addAttribute("msg", msg);
  19.         return "index";
  20.     }
  21.     
  22.     @PreAuthorize("hasAuthority('ROLE_USER')")
  23.     @RequestMapping(value="/admin/test1")
  24.     @ResponseBody
  25.     public String adminTest1() {
  26.         return "ROLE_USER";
  27.     }
  28.     
  29.     @PreAuthorize("hasAuthority('ROLE_ADMIN')")
  30.     @RequestMapping("/admin/test2")
  31.     @ResponseBody
  32.     public String adminTest2() {
  33.         return "ROLE_ADMIN";
  34.     }
  35. }

login.html页面：

  1. <!DOCTYPE html>
  2. <html lang="en" xmlns:th="http://www.thymeleaf.org">
  3. <head>
  4.     <meta charset="UTF-8"/>
  5.     <title>登录</title>
  6.     <link rel="stylesheet" th:href="@{css/bootstrap.min.css}"/>
  7.     <link rel="stylesheet" th:href="@{css/signin.css}"/>
  8.     <style type="text/css">
  9.         body {
  10.             padding-top: 50px;
  11.         }
  12.         .starter-template {
  13.             padding: 40px 15px;
  14.             text-align: center;
  15.         }
  16.     </style>
  17. </head>
  18. <body>
  19. <nav class="navbar navbar-inverse navbar-fixed-top">
  20.     <div class="container">
  21.         <div class="navbar-header">
  22.             <a class="navbar-brand" href="#">Spring Security演示</a>
  23.         </div>
  24.         <div id="navbar" class="collapse navbar-collapse">
  25.             <ul class="nav navbar-nav">
  26.                 <li><a th:href="@{/}">首页</a></li>
  27.                 <li><a th:href="@{http://www.baidu.com}">百度</a></li>
  28.             </ul>
  29.         </div>
  30.     </div>
  31. </nav>
  32. <div class="container">
  33.     <div class="starter-template">
  34.         <p th:if="${param.logout}" class="bg-warning">已注销</p>
  35.         <p th:if="${param.error}" class="bg-danger">有错误，请重试</p>
  36.         <h2>使用账号密码登录</h2>
  37.         <form class="form-signin" role="form" name="form" th:action="@{/login}" action="/login" method="post">
  38.             <div class="form-group">
  39.                 <label for="username">账号</label>
  40.                 <input type="text" class="form-control" name="username" value="" placeholder="账号"/>
  41.             </div>
  42.             <div class="form-group">
  43.                 <label for="password">密码</label>
  44.                 <input type="password" class="form-control" name="password" placeholder="密码"/>
  45.             </div>
  46.             <input type="submit" id="login" value="Login" class="btn btn-primary"/>
  47.         </form>
  48.     </div>
  49. </div>
  50. </body>
  51. </html>

index.html页面：

  1. <!DOCTYPE html>
  2. <html lang="en" xmlns:th="http://www.thymeleaf.org"
  3.       xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
  4. <head>
  5.     <meta charset="UTF-8"/>
  6.     <title sec:authentication="name"></title>
  7.     <link rel="stylesheet" th:href="@{css/bootstrap.min.css}"/>
  8.     <style type="text/css">
  9.         body {
  10.             padding-top: 50px;
  11.         }
  12.  
  13.         .starter-template {
  14.             padding: 40px 15px;
  15.             text-align: center;
  16.         }
  17.     </style>
  18. </head>
  19. <body>
  20. <nav class="navbar navbar-inverse navbar-fixed-top">
  21.     <div class="container">
  22.         <div class="navbar-header">
  23.             <a class="navbar-brand" href="#">Spring Security演示</a>
  24.         </div>
  25.         <div id="navbar" class="collapse navbar-collapse">
  26.             <ul class="nav navbar-nav">
  27.                 <li><a th:href="@{/}">首页</a></li>
  28.                 <li><a th:href="@{http://www.baidu.com}">百度</a></li>
  29.             </ul>
  30.         </div>
  31.     </div>
  32. </nav>
  33. <div class="container">
  34.     <div class="starter-template">
  35.         <h1 th:text="${msg.title}"></h1>
  36.         <p class="bg-primary" th:text="${msg.content}"></p>
  37.         <div sec:authorize="hasRole('ROLE_ADMIN')">
  38.             <p class="bg-info" th:text="${msg.extraInfo}"></p>
  39.         </div>
  40.         <div sec:authorize="hasRole('ROLE_USER')">
  41.             <p class="bg-info">无更多显示信息</p>
  42.         </div>
  43.         <form th:action="@{/logout}" method="post">
  44.             <input type="submit" class="btn btn-primary" value="注销"/>
  45.         </form>
  46.     </div>
  47. </div>
  48. </body>
  49. </html>

4.SpringBoot中配置基于security的支持，这里我有两个配置

一个是没有登录用户都跳转到login.html页面的配置：

  1. package org.security.config;
  2. import org.springframework.context.annotation.Configuration;
  3. import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
  4. import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
  5. @Configuration
  6. public class WebMvcConfig extends WebMvcConfigurerAdapter {
  7.     @Override
  8.     public void addViewControllers(ViewControllerRegistry registry) {
  9.         registry.addViewController("/login").setViewName("login");
  10.     }
  11. }

接下来就是security核心的配置类了：

  1. package org.security.config;
  2. import org.security.service.CustomUserService;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.http.HttpMethod;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  9. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  10. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  11. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  12. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  13. import org.springframework.security.config.http.SessionCreationPolicy;
  14. import org.springframework.security.core.userdetails.UserDetailsService;
  15. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  16. import org.springframework.security.crypto.password.PasswordEncoder;
  17. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  18. @Configuration
  19. @EnableWebSecurity
  20. @EnableGlobalMethodSecurity(prePostEnabled = true)
  21. public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  22.     @Bean
  23.     protected UserDetailsService customUserService() {
  24.         return new CustomUserService();
  25.     }
  26.  
  27.     @Autowired
  28.     public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
  29.         authenticationManagerBuilder
  30.                 // 设置UserDetailsService
  31.                 .userDetailsService(customUserService())
  32.                 // 使用BCrypt进行密码的hash
  33.                 .passwordEncoder(passwordEncoder());
  34.     }
  35.  
  36.     // 装载BCrypt密码编码器
  37.     @Bean
  38.     public PasswordEncoder passwordEncoder() {
  39.         return new BCryptPasswordEncoder();
  40.     }
  41.  
  42.     @Bean
  43.     public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
  44.         return new JwtAuthenticationTokenFilter();
  45.     }
  46.  
  47.     @Override
  48.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  49.         auth.userDetailsService(customUserService());
  50.     }
  51.  
  52.     @Bean
  53.     @Override
  54.     public AuthenticationManager authenticationManagerBean() throws Exception {
  55.         return super.authenticationManagerBean();
  56.     }
  57.  
  58.     @Override
  59.     protected void configure(HttpSecurity httpSecurity) throws Exception {
  60.         httpSecurity
  61.                 // 由于使用的是JWT，我们这里不需要csrf
  62. //                .csrf().disable()
  63.                 // 基于token，所以不需要session
  64. //                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
  65.                 .authorizeRequests()
  66.                 //.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
  67.                 // 允许对于网站静态资源的无授权访问
  68.                 .antMatchers(
  69.                         HttpMethod.GET,
  70.                         "/",
  71.                         "/*.html",
  72.                         "/favicon.ico",
  73.                         "/**/*.html",
  74.                         "/**/*.css",
  75.                         "/**/*.js"
  76.                 ).permitAll()
  77.                 // 对于获取token的rest api要允许匿名访问
  78.                 .antMatchers("/auth/**").permitAll()
  79.                 .antMatchers("/admin/**").hasIpAddress("127.0.0.1")
  80.                 .antMatchers("/admin/**").access("hasAuthority('ROLE_ADMIN')")
  81.                 .anyRequest().authenticated().and().formLogin().loginPage("/login")
  82.                 .failureUrl("/login?error").permitAll().and().logout().permitAll();
  83.         // 除上面外的所有请求全部需要鉴权认证
  84. //				.anyRequest().authenticated();
  85.         // 添加JWT filter
  86. //        httpSecurity
  87. //                .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
  88.         // 禁用缓存
  89. //        httpSecurity.headers().cacheControl();
  90.     }
  91. }

这里我暂时先把jwt相关的代码先注释掉，将注解取消掉的话，就可以实现jwt相关的功能了。

5.打开浏览器进行功能测试，下面是测试的结果：



如果未登录的话，就都会跳转到这个login.html登录页面


登录成功后进入的index页面，这里测试的账户权限类型是admin，下面有两个地址一个是admin/test1只能user权限才可以访问，还有一个是admin/test2拥有admin权限的人才可以访问，下面我们开始测试。

因为权限不够所以，返回的是403错误。

权限够的话，返回的是这个接口获取的数据。

到这里关于SpringBoot整合Security就介绍完了，接下来就是如何添加jwt的支持了。

6.基本过程和security差不多：一：首先创建一个工具类，用来生成jwt的token和token的验证刷新之类的。

二：然后创建一个fiter类，并配置注入security配置文件中

三：接下来就是创建dao，service，controller来实现接口。

四：最后就是利用postman来测试是否实现jwt功能

工具类JwtTokenUtil：

  1. package org.security.util;
  2. import io.jsonwebtoken.Claims;
  3. import io.jsonwebtoken.Jwts;
  4. import io.jsonwebtoken.SignatureAlgorithm;
  5. import org.security.entity.SysUser;
  6. import org.springframework.beans.factory.annotation.Value;
  7. import org.springframework.security.core.userdetails.UserDetails;
  8. import org.springframework.stereotype.Component;
  9. import java.io.Serializable;
  10. import java.util.Date;
  11. import java.util.HashMap;
  12. import java.util.Map;
  13.  
  14. @Component
  15. public class JwtTokenUtil implements Serializable {
  16.  
  17.     private static final long serialVersionUID = -3301605591108950415L;
  18.  
  19.     private static final String CLAIM_KEY_USERNAME = "sub";
  20.     private static final String CLAIM_KEY_CREATED = "created";
  21.  
  22.     @Value("${jwt.secret}")
  23.     private String secret;
  24.  
  25.     @Value("${jwt.expiration}")
  26.     private Long expiration;
  27.  
  28.     public String getUsernameFromToken(String token) {
  29.         String username;
  30.         try {
  31.             final Claims claims = getClaimsFromToken(token);
  32.             username = claims.getSubject();
  33.         } catch (Exception e) {
  34.             username = null;
  35.         }
  36.         return username;
  37.     }
  38.  
  39.     public Date getCreatedDateFromToken(String token) {
  40.         Date created;
  41.         try {
  42.             final Claims claims = getClaimsFromToken(token);
  43.             created = new Date((Long) claims.get(CLAIM_KEY_CREATED));
  44.         } catch (Exception e) {
  45.             created = null;
  46.         }
  47.         return created;
  48.     }
  49.  
  50.     public Date getExpirationDateFromToken(String token) {
  51.         Date expiration;
  52.         try {
  53.             final Claims claims = getClaimsFromToken(token);
  54.             expiration = claims.getExpiration();
  55.         } catch (Exception e) {
  56.             expiration = null;
  57.         }
  58.         return expiration;
  59.     }
  60.  
  61.     private Claims getClaimsFromToken(String token) {
  62.         Claims claims;
  63.         try {
  64.             claims = Jwts.parser()
  65.                     .setSigningKey(secret)
  66.                     .parseClaimsJws(token)
  67.                     .getBody();
  68.         } catch (Exception e) {
  69.             claims = null;
  70.         }
  71.         return claims;
  72.     }
  73.  
  74.     private Date generateExpirationDate() {
  75.         return new Date(System.currentTimeMillis() + expiration * 1000);
  76.     }
  77.  
  78.     private Boolean isTokenExpired(String token) {
  79.         final Date expiration = getExpirationDateFromToken(token);
  80.         return expiration.before(new Date());
  81.     }
  82.  
  83.     private Boolean isCreatedBeforeLastPasswordReset(Date created, Date lastPasswordReset) {
  84.         return (lastPasswordReset != null && created.before(lastPasswordReset));
  85.     }
  86.  
  87.     public String generateToken(UserDetails userDetails) {
  88.         Map<String, Object> claims = new HashMap<>();
  89.         claims.put(CLAIM_KEY_USERNAME, userDetails.getUsername());
  90.         claims.put(CLAIM_KEY_CREATED, new Date());
  91.         return generateToken(claims);
  92.     }
  93.  
  94.     String generateToken(Map<String, Object> claims) {
  95.         return Jwts.builder()
  96.                 .setClaims(claims)
  97.                 .setExpiration(generateExpirationDate())
  98.                 .signWith(SignatureAlgorithm.HS512, secret)
  99.                 .compact();
  100.     }
  101.  
  102.     public Boolean canTokenBeRefreshed(String token, Date lastPasswordReset) {
  103.         final Date created = getCreatedDateFromToken(token);
  104.         return !isCreatedBeforeLastPasswordReset(created, lastPasswordReset)
  105.                 && !isTokenExpired(token);
  106.     }
  107.  
  108.     public String refreshToken(String token) {
  109.         String refreshedToken;
  110.         try {
  111.             final Claims claims = getClaimsFromToken(token);
  112.             claims.put(CLAIM_KEY_CREATED, new Date());
  113.             refreshedToken = generateToken(claims);
  114.         } catch (Exception e) {
  115.             refreshedToken = null;
  116.         }
  117.         return refreshedToken;
  118.     }
  119.  
  120.     public Boolean validateToken(String token, UserDetails userDetails) {
  121.         SysUser user = (SysUser) userDetails;
  122.         final String username = getUsernameFromToken(token);
  123.         final Date created = getCreatedDateFromToken(token);
  124. //        final Date expiration = getExpirationDateFromToken(token);
  125.         return (
  126.                 username.equals(user.getUsername())
  127.                         && !isTokenExpired(token)
  128.                         && !isCreatedBeforeLastPasswordReset(created, user.getLastPasswordResetDate()));
  129.     }
  130. }

dao接口：

  1. package org.security.dao;
  2. import org.security.entity.SysUser;
  3. public interface AuthService {
  4.     SysUser register(SysUser userToAdd);
  5.     String login(String username, String password);
  6.     String refresh(String oldToken);
  7. }

dao接口实现类（service业务类）：

  1. package org.security.service;
  2. import org.security.dao.AuthService;
  3. import org.security.dao.SysUserRepository;
  4. import org.security.entity.SysUser;
  5. import org.security.util.JwtTokenUtil;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.beans.factory.annotation.Value;
  8. import org.springframework.security.authentication.AuthenticationManager;
  9. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  10. import org.springframework.security.core.Authentication;
  11. import org.springframework.security.core.context.SecurityContextHolder;
  12. import org.springframework.security.core.userdetails.UserDetails;
  13. import org.springframework.security.core.userdetails.UserDetailsService;
  14. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  15. import org.springframework.stereotype.Service;
  16.  
  17. import java.util.Date;
  18.  
  19. import static java.util.Arrays.asList;
  20.  
  21. @Service
  22. public class AuthServiceImpl implements AuthService {
  23.  
  24.     private AuthenticationManager authenticationManager;
  25.     private UserDetailsService userDetailsService;
  26.     private JwtTokenUtil jwtTokenUtil;
  27.     private SysUserRepository userRepository;
  28.  
  29.     @Value("${jwt.tokenHead}")
  30.     private String tokenHead;
  31.  
  32.     @Autowired
  33.     public AuthServiceImpl(
  34.             AuthenticationManager authenticationManager,
  35.             UserDetailsService userDetailsService,
  36.             JwtTokenUtil jwtTokenUtil,
  37.             SysUserRepository userRepository) {
  38.         this.authenticationManager = authenticationManager;
  39.         this.userDetailsService = userDetailsService;
  40.         this.jwtTokenUtil = jwtTokenUtil;
  41.         this.userRepository = userRepository;
  42.     }
  43.  
  44.     @Override
  45.     public SysUser register(SysUser userToAdd) {
  46.         final String username = userToAdd.getUsername();
  47.         if(userRepository.findByUsername(username)!=null) {
  48.             return null;
  49.         }
  50.         BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
  51.         final String rawPassword = userToAdd.getPassword();
  52.         userToAdd.setPassword(encoder.encode(rawPassword));
  53.         userToAdd.setLastPasswordResetDate(new Date());
  54. //        userToAdd.setRoles(asList("ROLE_USER"));
  55.         return userRepository.save(userToAdd);
  56.     }
  57.  
  58.     @Override
  59.     public String login(String username, String password) {
  60.         UsernamePasswordAuthenticationToken upToken = new UsernamePasswordAuthenticationToken(username, password);
  61.         // Perform the security
  62.         final Authentication authentication = authenticationManager.authenticate(upToken);
  63.         SecurityContextHolder.getContext().setAuthentication(authentication);
  64.         // Reload password post-security so we can generate token
  65.         final UserDetails userDetails = userDetailsService.loadUserByUsername(username);
  66.         final String token = jwtTokenUtil.generateToken(userDetails);
  67.         return token;
  68.     }
  69.  
  70.     @Override
  71.     public String refresh(String oldToken) {
  72.         final String token = oldToken.substring(tokenHead.length());
  73.         String username = jwtTokenUtil.getUsernameFromToken(token);
  74.         SysUser user = (SysUser) userDetailsService.loadUserByUsername(username);
  75.         if (jwtTokenUtil.canTokenBeRefreshed(token, user.getLastPasswordResetDate())){
  76.             return jwtTokenUtil.refreshToken(token);
  77.         }
  78.         return null;
  79.     }
  80. }

controller控制类：

  1. package org.security.controller;
  2. import org.security.dao.AuthService;
  3. import org.security.entity.SysUser;
  4. import org.security.service.JwtAuthenticationRequest;
  5. import org.security.service.JwtAuthenticationResponse;
  6. import org.springframework.beans.factory.annotation.Autowired;
  7. import org.springframework.beans.factory.annotation.Value;
  8. import org.springframework.http.ResponseEntity;
  9. import org.springframework.security.core.AuthenticationException;
  10. import org.springframework.web.bind.annotation.RequestBody;
  11. import org.springframework.web.bind.annotation.RequestMapping;
  12. import org.springframework.web.bind.annotation.RequestMethod;
  13. import org.springframework.web.bind.annotation.RestController;
  14.  
  15. import javax.servlet.http.HttpServletRequest;
  16.  
  17. @RestController
  18. public class AuthController {
  19.     @Value("${jwt.header}")
  20.     private String tokenHeader;
  21.  
  22.     @Autowired
  23.     private AuthService authService;
  24.  
  25.     @RequestMapping(value = "/auth/login", method = RequestMethod.POST)
  26.     public ResponseEntity<?> createAuthenticationToken(
  27.             String username,String password
  28.     ) throws AuthenticationException{
  29.         //  @RequestBody JwtAuthenticationRequest authenticationRequest
  30.         final String token = authService.login(username,password);
  31.  
  32.         // Return the token
  33.         return ResponseEntity.ok(new JwtAuthenticationResponse(token));
  34.     }
  35.  
  36.     @RequestMapping(value = "/auth/refresh", method = RequestMethod.GET)
  37.     public ResponseEntity<?> refreshAndGetAuthenticationToken(
  38.             HttpServletRequest request) throws AuthenticationException{
  39.         String token = request.getHeader(tokenHeader);
  40.         String refreshedToken = authService.refresh(token);
  41.         if(refreshedToken == null) {
  42.             return ResponseEntity.badRequest().body(null);
  43.         } else {
  44.             return ResponseEntity.ok(new JwtAuthenticationResponse(refreshedToken));
  45.         }
  46.     }
  47.  
  48.     @RequestMapping(value = "${jwt.route.authentication.register}", method = RequestMethod.POST)
  49.     public SysUser register(@RequestBody SysUser addedUser) throws AuthenticationException{
  50.         return authService.register(addedUser);
  51.     }
  52. }

接在来就是最重要的filter类：

  1. package org.security.config;
  2. import java.io.IOException;
  3. import javax.servlet.FilterChain;
  4. import javax.servlet.ServletException;
  5. import javax.servlet.http.HttpServletRequest;
  6. import javax.servlet.http.HttpServletResponse;
  7. import org.security.util.JwtTokenUtil;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.beans.factory.annotation.Value;
  10. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  11. import org.springframework.security.core.context.SecurityContextHolder;
  12. import org.springframework.security.core.userdetails.UserDetails;
  13. import org.springframework.security.core.userdetails.UserDetailsService;
  14. import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
  15. import org.springframework.stereotype.Component;
  16. import org.springframework.web.filter.OncePerRequestFilter;
  17.  
  18. @Component
  19. public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
  20.  
  21.     @Autowired
  22.     private UserDetailsService userDetailsService;
  23.  
  24.     @Value("${jwt.header}")
  25.     private String tokenHeader;
  26.  
  27.     @Value("${jwt.tokenHead}")
  28.     private String tokenHead;
  29.  
  30.     @Autowired
  31.     private JwtTokenUtil jwtTokenUtil;
  32.     @Override
  33.     protected void doFilterInternal(
  34.             HttpServletRequest request,
  35.             HttpServletResponse response,
  36.             FilterChain chain) throws ServletException, IOException {
  37.         String authHeader = request.getHeader(this.tokenHeader);
  38.         if (authHeader != null && authHeader.startsWith(tokenHead)) {
  39.             final String authToken = authHeader.substring(tokenHead.length()); // The part after "Bearer "
  40.             String username = jwtTokenUtil.getUsernameFromToken(authToken);
  41.             logger.info("checking authentication " + username);
  42.             if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
  43.                 UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
  44.                 	if (jwtTokenUtil.validateToken(authToken, userDetails)) {
  45.                         UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
  46.                                 userDetails, null, userDetails.getAuthorities());
  47.                         authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(
  48.                                 request));
  49.                         logger.info("authenticated user " + username + ", setting security context");
  50.                         SecurityContextHolder.getContext().setAuthentication(authentication);
  51.                     }
  52.             }
  53.         }
  54.         chain.doFilter(request, response);
  55.     }
  56. }

将security中配置文件注解去掉，去掉之后如下所示：

  1. package org.security.config;
  2.  
  3. import org.security.service.CustomUserService;
  4. import org.springframework.beans.factory.annotation.Autowired;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.http.HttpMethod;
  8. import org.springframework.security.authentication.AuthenticationManager;
  9. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  10. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  11. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  12. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  13. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  14. import org.springframework.security.config.http.SessionCreationPolicy;
  15. import org.springframework.security.core.userdetails.UserDetailsService;
  16. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  17. import org.springframework.security.crypto.password.PasswordEncoder;
  18. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  19.  
  20. @Configuration
  21. @EnableWebSecurity
  22. @EnableGlobalMethodSecurity(prePostEnabled = true)
  23. public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  24.     @Bean
  25.     protected UserDetailsService customUserService() {
  26.         return new CustomUserService();
  27.     }
  28.  
  29.     @Autowired
  30.     public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
  31.         authenticationManagerBuilder
  32.                 // 设置UserDetailsService
  33.                 .userDetailsService(customUserService())
  34.                 // 使用BCrypt进行密码的hash
  35.                 .passwordEncoder(passwordEncoder());
  36.     }
  37.  
  38.     // 装载BCrypt密码编码器
  39.     @Bean
  40.     public PasswordEncoder passwordEncoder() {
  41.         return new BCryptPasswordEncoder();
  42.     }
  43.  
  44.     @Bean
  45.     public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
  46.         return new JwtAuthenticationTokenFilter();
  47.     }
  48.  
  49.     @Override
  50.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  51.         auth.userDetailsService(customUserService());
  52.     }
  53.  
  54.     @Bean
  55.     @Override
  56.     public AuthenticationManager authenticationManagerBean() throws Exception {
  57.         return super.authenticationManagerBean();
  58.     }
  59.  
  60.     @Override
  61.     protected void configure(HttpSecurity httpSecurity) throws Exception {
  62.         httpSecurity
  63.                 // 由于使用的是JWT，我们这里不需要csrf
  64.                 .csrf().disable()
  65.                 // 基于token，所以不需要session
  66.                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
  67.                 .authorizeRequests()
  68.                 .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
  69.                 // 允许对于网站静态资源的无授权访问
  70.                 .antMatchers(
  71.                         HttpMethod.GET,
  72.                         "/",
  73.                         "/*.html",
  74.                         "/favicon.ico",
  75.                         "/**/*.html",
  76.                         "/**/*.css",
  77.                         "/**/*.js"
  78.                 ).permitAll()
  79.                 // 对于获取token的rest api要允许匿名访问
  80.                 .antMatchers("/auth/**").permitAll()
  81.                 .antMatchers("/admin/**").hasIpAddress("127.0.0.1")
  82.                 .antMatchers("/admin/**").access("hasAuthority('ROLE_ADMIN')")
  83. //                .anyRequest().authenticated().and().formLogin().loginPage("/login")
  84. //                .failureUrl("/login?error").permitAll().and().logout().permitAll();
  85.         // 除上面外的所有请求全部需要鉴权认证
  86. 				.anyRequest().authenticated();
  87.         // 添加JWT filter
  88.         httpSecurity
  89.                 .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
  90.         // 禁用缓存
  91.         httpSecurity.headers().cacheControl();
  92.     }
  93. }

到这边jwt整合也介绍了，现在我们就可以postman来进行测试。

测试结果如下所示：
生成token：


刷新token：


不带token访问接口:

带token但是权限不够：
带token而且权限也够：


到这里关于 SpringBoot+SpringSecurity+JWT就基本结束了，这篇博客我重点是将如何通过代码来实现这个功能，关于代码本身没有很细致的介绍。关于代码功能的介绍，例如怎么通过注解配置权限控制，如何通过配置来进行权限控制，token更新和验证等等的细节，我会在我这篇博客的教学视频中介绍，视频地址：点击打开链接

GitHub地址：点击打开链接

如果大家对文章有什么问题或者疑意之类的，可以加我订阅号在上面留言，订阅号上面我会定期更新最新博客。如果嫌麻烦可以直接加我wechat：lzqcode

 



 


 



 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/羊村懒王/article/detail/546367
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号