文章目录
Springboot:JWT
一、JWT简介
1、JWT的优势
2、JWT的结构
2.1、标头(Header)
标头通常是由Base64编码组成JWT结构的一部分,但是注意的是Base64编码是一种编码,而不是一种加密过程
通常标头不需要规定
{
"alg": "HS256",
"typ": "JWT"
}
2.2、有效负荷(Payload)
{
"usename": "zhangsan",
"admin": true
}
2.3、签名(Signature)
这当中也依然存在安全问题,主要是因为Base64是可以解码的,因此我们的传输的信息依然会被暴露,jwt一般不用传输敏感信息。
JWT一般用来设计用户认证和授权系统,甚至实现Web应用的单点登录
二、SpringBoot整合JWT
<!--引入jwt-->
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.4.0</version>
</dependency>
//生成Token
Calendar instance = Calendar.getInstance();
instance.add(Calendar.SECOND, 90);
String token = JWT.create()//生成令牌
.withClaim("username", "李四")//设置自定义用户名
.withExpiresAt(instance.getTime())//设置过期时间
.sign(Algorithm.HMAC256("DSADA_23#@#@$!GDFGS"));//设置签名 保密 复杂
System.out.println(token);//输出令牌
public class JWTUtils {
//定义自己的密钥
private static String TOKEN = "token!DASD(#$dsad%$#.";
/**
* 生成token
* @param map 传入的有效负荷
* @return
*/
public static String genToken(Map<String, String> map){
JWTCreator.Builder builder = JWT.create();
map.forEach((k,v)->{
builder.withClaim(k, v);
});
Calendar instance = Calendar.getInstance();
//定义过期时间
instance.add(Calendar.DATE, 7);
builder.withExpiresAt(instance.getTime());
return builder.sign(Algorithm.HMAC256(TOKEN)).toString();
}
/**
* 验证获取token中的有效负载,验证失败返回null
* @param token
* @return
*/
public static DecodedJWT getToken(String token){
return JWT.require(Algorithm.HMAC256(TOKEN)).build().verify(token);
}
}
public class JWTInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
Map<String, Object> map = new HashMap<>();
//获取请求头中令牌
String token = request.getHeader("token");
try {
JWTUtils.verify(token);//验证令牌
return true;//放行请求
} catch (SignatureVerificationException e) {
e.printStackTrace();
map.put("msg","无效签名!");
}catch (TokenExpiredException e){
e.printStackTrace();
map.put("msg","token过期!");
}catch (AlgorithmMismatchException e){
e.printStackTrace();
map.put("msg","token算法不一致!");
}catch (Exception e){
e.printStackTrace();
map.put("msg","token无效!!");
}
map.put("state",false);//设置状态
//将map 专为json jackson
String json = new ObjectMapper().writeValueAsString(map);
response.setContentType("application/json;charset=UTF-8");
response.getWriter().println(json);
return false;
}
}
@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new JWTInterceptor())
//其他接口token验证
.addPathPatterns("/user/test")
//所有用户都放心
.excludePathPatterns("/user/login");
}
}
package com.baizhi.controller;
import com.auth0.jwt.exceptions.AlgorithmMismatchException;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.baizhi.entity.User;
import com.baizhi.service.UserService;
import com.baizhi.utils.JWTUtils;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;
import javax.servlet.http.HttpServletRequest;
import java.util.HashMap;
import java.util.Map;
@RestController
@Slf4j
public class UserController {
@Autowired
private UserService userService;
@GetMapping("/user/login")
public Map<String,Object> login(User user){
log.info("用户名: [{}]",user.getName());
log.info("密码: [{}]",user.getPassword());
Map<String, Object> map = new HashMap<>();
try{
User userDB = userService.login(user);
Map<String,String> payload = new HashMap<>();
payload.put("id",userDB.getId());
payload.put("name",userDB.getName());
//生成JWT的令牌
String token = JWTUtils.getToken(payload);
map.put("state",true);
map.put("msg","认证成功");
map.put("token",token);//响应token
}catch (Exception e){
map.put("state",false);
map.put("msg",e.getMessage());
}
return map;
}
@PostMapping("/user/test")
public Map<String,Object> test(HttpServletRequest request){
Map<String, Object> map = new HashMap<>();
//处理自己业务逻辑
String token = request.getHeader("token");
DecodedJWT verify = JWTUtils.verify(token);
log.info("用户id: [{}]",verify.getClaim("id").asString());
log.info("用户name: [{}]",verify.getClaim("name").asString());
map.put("state",true);
map.put("msg","请求成功!");
return map;
}
}