SpringBoot+JWT实现用户接口访问权限验证

刺骨的言语ヽ痛彻心扉 2022-09-03 04:17 274阅读 0赞

流程：

1.用户访问login接口，验证用户身份信息，并生成token绑定用户信息，token返回前端

2.前端把token存入request header中访问后端接口即可成功，否则提示无权访问

代码部分：

1.JwtUtil类 （生成token，校验token等）

/* *
 * @Author qy
 * JWT工具类 
 * @Param
 * @Return
 */
 public class JwtUtil {
 
 // Token过期时间30分钟
 public static final long EXPIRE_TIME = 30 * 60 * 1000;
 
 /* *
 * @Author qy
 * 校验token是否正确 
 * @Param token
 * @Param username
 * @Param secret
 * @Return boolean
 */
 public static boolean verify(String token, String username, String secret) {
 try {
 // 设置加密算法
 Algorithm algorithm = Algorithm.HMAC256(secret);
 JWTVerifier verifier = JWT.require(algorithm)
 .withClaim("username", username)
 .build();
 // 效验TOKEN
 DecodedJWT jwt = verifier.verify(token);
 return true;
 } catch (Exception exception) {
 return false;
 }
 }
 
 /* *
 * @Author qy
 * 生成签名,30min后过期 
 * @Param [username, secret]
 * @Return java.lang.String
 */
 public static String sign(String username, String secret) {
 Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
 Algorithm algorithm = Algorithm.HMAC256(secret);
 // 附带username信息
 return JWT.create()
 .withClaim("username", username)
 .withExpiresAt(date)
 .sign(algorithm);
 
 }
 
 /* *
 * @Author qy
 * 获得用户名 
 * @Param [request]
 * @Return java.lang.String
 */
 public static String getUserNameByToken(HttpServletRequest request) {
 String token = request.getHeader("token");
 DecodedJWT jwt = JWT.decode(token);
 return jwt.getClaim("username")
 .asString();
 }
 }

2.JwtInterceptor （拦截请求类，校验错误返回错误信息）

/**
 * @Author qinyi
 * token验证拦截器 
 */
 @Component
 public class JwtInterceptor implements HandlerInterceptor {
 @Autowired
 SysUserService sysUserService;
 
 @Override
 public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
 // 从 http 请求头中取出 token
 String token = request.getHeader("token");
 // 如果不是映射到方法直接通过
 if(!(handler instanceof HandlerMethod)){
 return true;
 }
 if (token != null){
 String username = JwtUtil.getUserNameByToken(request);
 // 这边拿到的 用户名 应该去数据库查询获得密码，简略，步骤在service直接获取密码
 boolean result = JwtUtil.verify(token,username,sysUserService.getPassword(username));
 if(result){
 System.out.println("通过拦截器");
 return true;
 }
 }
 response.setCharacterEncoding("UTF-8");
 response.setContentType("application/json; charset=utf-8");
 PrintWriter out = null ;
 try {
 JSONObject res = new JSONObject();
 res.put("success", "false");
 res.put("msg", "您无权访问");
 out = response.getWriter();
 out.append(res.toString());
 }catch (Exception e){
 e.printStackTrace();
 response.sendError(500);
 }
 return false;
 }
 
 @Override
 public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
 
 }
 
 @Override
 public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
 
 }
 }

3. InterceptorConfig （拦截器配置类注入spring管理，配置只放通login，拦截其他所有请求，并支持跨域）

/* *
 * @Author qy
 * 拦截器配置 
 * @Param
 * @Return
 */
 @Configuration
 public class InterceptorConfig implements WebMvcConfigurer {
 /* *
 * @Author qy
 * 设置拦截路径 
 * @Param [registry]
 * @Return void
 */
 @Override
 public void addInterceptors(InterceptorRegistry registry) {
 registry.addInterceptor(authenticationInterceptor())
 .addPathPatterns("/**")
 .excludePathPatterns("/sysuser/login");
 }
 /* *
 * @Author qy
 * 将拦截器注入context 
 * @Param []
 * @Return com.zszxz.jwt.interceptor.JwtInterceptor
 */
 @Bean
 public JwtInterceptor authenticationInterceptor() {
 return new JwtInterceptor();
 }
 
 /* *
 * @Author qy
 * 跨域支持 
 * @Param [registry]
 * @Return void
 */
 @Override
 public void addCorsMappings(CorsRegistry registry) {
 registry.addMapping("/**")
 .allowedOrigins("*")
 .allowedMethods("GET", "POST", "DELETE", "PUT", "PATCH", "OPTIONS", "HEAD")
 .maxAge(3600 * 24);
 }
 }

4.controller层示例

/**
     * @author qinyi
     * @since 2021-07-22 10:40:42
     */
    @CrossOrigin
    @RestController
    @RequestMapping("sysuser")
    public class LoginController {
        /**
         * 服务对象
         */
        @Resource
        private SysUserService sysUserService;
    
    
    
        @PostMapping("login")
        public ResponseData queryPaper(HttpServletRequest request,@RequestBody SysUser sysUser){
            ResponseData res = ResponseData.ok();
            String username = sysUser.getUserName();
            String password = sysUser.getPassword();
            //账号密码验证
            String token = JwtUtil.sign(username,password);
            if(null != token){
                res.putDataValue("token",token);
            }else {
                res = ResponseData.unauthorized();
            }
            return res;
        }
    
    }

5.pom.xml引入

<dependency>
 <groupId>com.auth0</groupId>
 <artifactId>java-jwt</artifactId>
 <version>3.8.2</version>
 </dependency>

6.postman访问成功结果

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI0MTM4MTUx_size_16_color_FFFFFF_t_70][]

token过期或错误-失败结果

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI0MTM4MTUx_size_16_color_FFFFFF_t_70 1][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI0MTM4MTUx_size_16_color_FFFFFF_t_70]: /images/20220829/dd7ea41ceafc4a9bb464f05415742467.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI0MTM4MTUx_size_16_color_FFFFFF_t_70 1]: /images/20220829/f9f13891fee744b6a06bd3285023e432.png