SpringBoot整合Spring Security，基于JWT的认证（八）

﹏ヽ暗。殇╰゛Y 2022-12-10 08:43 102阅读 0赞

# 一、首先导入依赖 #

<dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>0.9.0</version>
            </dependency>

# 二、编写工具类 #

package com.zimug.jwtserver.config.auth.jwt;
    
    import io.jsonwebtoken.Claims;
    import io.jsonwebtoken.Jwts;
    import io.jsonwebtoken.SignatureAlgorithm;
    import lombok.Data;
    import org.springframework.boot.context.properties.ConfigurationProperties;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.stereotype.Component;
    
    import java.util.Date;
    import java.util.HashMap;
    import java.util.Map;
    
    @Data
    @ConfigurationProperties(prefix = "jwt")
    @Component
    public class JwtTokenUtil {
    
        private String secret;
        private Long expiration;
        private String header;
    
    
        /**
         * 生成token令牌
         *
         * @param userDetails 用户
         * @return 令token牌
         */
        public String generateToken(UserDetails userDetails) {
            Map<String, Object> claims = new HashMap<>(2);
            claims.put("sub", userDetails.getUsername());
            claims.put("created", new Date());
    
            return generateToken(claims);
        }
    
        /**
         * 从令牌中获取用户名
         *
         * @param token 令牌
         * @return 用户名
         */
        public String getUsernameFromToken(String token) {
            String username;
            try {
                Claims claims = getClaimsFromToken(token);
                username = claims.getSubject();
            } catch (Exception e) {
                username = null;
            }
            return username;
        }
    
        /**
         * 判断令牌是否过期
         *
         * @param token 令牌
         * @return 是否过期
         */
        public Boolean isTokenExpired(String token) {
            try {
                Claims claims = getClaimsFromToken(token);
                Date expiration = claims.getExpiration();
                return expiration.before(new Date());
            } catch (Exception e) {
                return false;
            }
        }
    
        /**
         * 刷新令牌
         *
         * @param token 原令牌
         * @return 新令牌
         */
        public String refreshToken(String token) {
            String refreshedToken;
            try {
                Claims claims = getClaimsFromToken(token);
                claims.put("created", new Date());
                refreshedToken = generateToken(claims);
            } catch (Exception e) {
                refreshedToken = null;
            }
            return refreshedToken;
        }
    
        /**
         * 验证令牌
         *
         * @param token       令牌
         * @param userDetails 用户
         * @return 是否有效
         */
        public Boolean validateToken(String token, UserDetails userDetails) {
    
            String username = getUsernameFromToken(token);
            return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
        }
    
    
        /**
         * 从claims生成令牌,如果看不懂就看谁调用它
         *
         * @param claims 数据声明
         * @return 令牌
         */
        private String generateToken(Map<String, Object> claims) {
            Date expirationDate = new Date(System.currentTimeMillis() + expiration);
            return Jwts.builder().setClaims(claims)
                    .setExpiration(expirationDate)
                    .signWith(SignatureAlgorithm.HS512, secret)
                    .compact();
        }
    
        /**
         * 从令牌中获取数据声明,如果看不懂就看谁调用它
         *
         * @param token 令牌
         * @return 数据声明
         */
        private Claims getClaimsFromToken(String token) {
            Claims claims;
            try {
                claims = Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
            } catch (Exception e) {
                claims = null;
            }
            return claims;
        }
    
    }

# 三、在配置文件里配置属性 #

jwt:
      secret: asfdsafsdasadf
      expriation: 3600000
      header: JWTHeaderName

# 四、编写服务类和控制器 #

package com.example.jwt.config.auth.jwt;
    import com.example.jwt.config.exception.CustomException;
    import com.example.jwt.config.exception.CustomExceptionType;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.stereotype.Service;
    
    import javax.annotation.Resource;
    
    @Service
    public class JwtAuthService {
    
        @Resource
        AuthenticationManager authenticationManager;
    
        @Resource
        UserDetailsService userDetailsService;
    
        @Resource
        JwtTokenUtil jwtTokenUtil;
    
        /**
         * 登录认证换取JWT令牌
         * @return JWT
         */
        public String login(String username,String password) throws CustomException {
            try {
                UsernamePasswordAuthenticationToken upToken =
                        new UsernamePasswordAuthenticationToken(username, password);
                Authentication authentication = authenticationManager.authenticate(upToken);
                SecurityContextHolder.getContext().setAuthentication(authentication);
            }catch (AuthenticationException e){
                throw new CustomException(CustomExceptionType.USER_INPUT_ERROR
                                ,"用户名或者密码不正确");
            }
    
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            return jwtTokenUtil.generateToken(userDetails);
        }
    
    
        public String refreshToken(String oldToken){
            if(!jwtTokenUtil.isTokenExpired(oldToken)){
                return jwtTokenUtil.refreshToken(oldToken);
            }
            return null;
        }
    
    
    
    }

package com.example.jwt.config.auth.jwt;
    
    import com.example.jwt.config.exception.AjaxResponse;
    import com.example.jwt.config.exception.CustomException;
    import com.example.jwt.config.exception.CustomExceptionType;
    import org.springframework.util.StringUtils;
    import org.springframework.web.bind.annotation.RequestBody;
    import org.springframework.web.bind.annotation.RequestHeader;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import javax.annotation.Resource;
    import java.util.Map;
    
    @RestController
    public class JwtAuthController {
    
    
        @Resource
        JwtAuthService jwtAuthService;
    
        @RequestMapping(value = "/authentication")
        public AjaxResponse login(@RequestBody Map<String,String> map){
            String username  = map.get("username");
            String password = map.get("password");
    
            if(StringUtils.isEmpty(username)
                    || StringUtils.isEmpty(password)){
                return AjaxResponse.error(
                        new CustomException(CustomExceptionType.USER_INPUT_ERROR,
                        "用户名或者密码不能为空"));
            }
            try {
                return AjaxResponse.success(jwtAuthService.login(username, password));
            }catch (CustomException e){
                return AjaxResponse.error(e);
            }
        }
    
        @RequestMapping(value = "/refreshtoken")
        public  AjaxResponse refresh(@RequestHeader("${jwt.header}") String token){
                return AjaxResponse.success(jwtAuthService.refreshToken(token));
        }
    
    }

放行一下接口这两个接口：

.antMatchers("/authentication","/refreshtoken").permitAll()

注意要自己要在SecurityConfig里声明一下manager，service那边才能用

@Bean(name = BeanIds.AUTHENTICATION_MANAGER)
        @Override
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }

到这里就能生成jwt令牌和刷新令牌了。

# 五、编写过滤器，进行鉴权 #

package com.example.jwt.config.auth.jwt;
    
    import com.example.jwt.config.auth.MyUserDetailsService;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.stereotype.Component;
    import org.springframework.util.StringUtils;
    import org.springframework.web.filter.OncePerRequestFilter;
    
    import javax.annotation.Resource;
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    @Component
    public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    
        @Resource
        JwtTokenUtil jwtTokenUtil;
    
        @Resource
        MyUserDetailsService myUserDetailsService;
    
        @Override
        protected void doFilterInternal(HttpServletRequest request,
                                        HttpServletResponse response,
                                        FilterChain filterChain)
                throws ServletException, IOException {
            //请求头里需要有token
            String jwtToken = request.getHeader(jwtTokenUtil.getHeader());
            if(!StringUtils.isEmpty(jwtToken)){
                //解密取出用户名
                String username = jwtTokenUtil.getUsernameFromToken(jwtToken);
    
                if(username != null &&
                        SecurityContextHolder.getContext().getAuthentication() == null){
                    UserDetails userDetails = myUserDetailsService.loadUserByUsername(username);
                    if(jwtTokenUtil.validateToken(jwtToken,userDetails)){
                        //给使用该JWT令牌的用户进行授权
                        UsernamePasswordAuthenticationToken authenticationToken
                                = new UsernamePasswordAuthenticationToken(userDetails,null,userDetails.getAuthorities());
    
                        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
                    }
                }
            }
    
            filterChain.doFilter(request,response);
        }
    }

添加过滤器在用户名密码过滤器之前：

.addFilterBefore(jwtAuthenticationTokenFilter,UsernamePasswordAuthenticationFilter.class)

# 六、解决跨域访问的问题 #

开启：

.cors()

@Bean
        CorsConfigurationSource corsConfigurationSource() {
    
            CorsConfiguration configuration = new CorsConfiguration();
            configuration.setAllowedOrigins(Arrays.asList("http://localhost:8080"));
            configuration.setAllowedMethods(Arrays.asList("GET","POST"));
            configuration.applyPermitDefaultValues();
    
            UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
            source.registerCorsConfiguration("/**", configuration);
            return source;
        }

# 七、防止跨域攻击 #

//仿跨站攻击，在登陆后会返回XSRF-TOKEN的cookie，在除了get请求的其他类型时均需带上 X-XSRF-TOKEN 的header，每请求一次该cookie就会刷新，下次带上新的值才能访问
           http.csrf()
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())//允许脚本读取cookie
                    .ignoringAntMatchers("/authentication")

然后写个控制器测试下：

@RequestMapping(value = "/hello")
        public String hello() {
            return "world";
        }

可以看到get请求时不需要X-XSRF-TOKEN请求头

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JhaWt1bmxvbmc_size_16_color_FFFFFF_t_70][]

换成post请求，勾上xsrf请求头，还是403了，因为这个是之前的了，我们要把最新的复制过去：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JhaWt1bmxvbmc_size_16_color_FFFFFF_t_70 1][]

换了后，就成功了：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JhaWt1bmxvbmc_size_16_color_FFFFFF_t_70 2][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JhaWt1bmxvbmc_size_16_color_FFFFFF_t_70]: /images/20221123/266abf68c18c4de4bb9b50f5e8dd829f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JhaWt1bmxvbmc_size_16_color_FFFFFF_t_70 1]: /images/20221123/7a1ef7c9e9804b24b46912470207d994.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2JhaWt1bmxvbmc_size_16_color_FFFFFF_t_70 2]: /images/20221123/3ad6e47811034d26ae0812422dfca10d.png