SpringSecurity+Oauth2+JWT令牌加密token

水深无声 2022-12-21 09:23 215阅读 0赞

github仓库地址：https://github.com/Sjj1024/SpringCloudDemo

#

18f92d1709d0b777194eab45c8e5d28c.png

目录结构：
ee0f1928a999c9969b1cbe2aea60a40d.png
pom文件：

  1. <?xml version=”1.0” encoding=”UTF-8”?>
  2. <project xmlns=”http://maven.apache.org/POM/4.0.0“
  3. xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance“
  4. xsi:schemaLocation=”http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  6. springcloud1
  7. org.example
  8. 1.0-SNAPSHOT
  10. 4.0.0
  12. springcloud-oauth-order-8004
  16. org.springframework.cloud
  17. spring-cloud-dependencies
  18. Finchley.RELEASE
  19. pom
  20. import
  24. org.springframework.boot
  25. spring-boot-starter-web
  26. 2.1.4.RELEASE
  30. org.springframework.boot
  31. spring-boot-test
  35. org.springframework.cloud
  36. spring-cloud-netflix-eureka-client
  41. org.springframework.boot
  42. spring-boot-starter-security
  47. org.springframework.cloud
  48. spring-cloud-starter-oauth2
  53. org.springframework.security
  54. spring-security-jwt

Mysecurityconfig配置：

  1. package com.shen.config;
  3. import org.springframework.context.annotation.Configuration;
  4. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  5. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  7. @Configuration
  8. public class MySecurityConfg extends WebSecurityConfigurerAdapter {
  10. @Override
  11. protected void configure(HttpSecurity http) throws Exception {
  12. // 决定那些请求被拦截
  13. http
  14. .csrf().disable()
  15. .authorizeRequests()
  16. .antMatchers(“/css/**“, “/js/**“, “/fonts/**“, “/index”).permitAll() //都可以访问
  17. .antMatchers(“/order/**“).authenticated() // 所有order下的请求都要认证
  18. .anyRequest().permitAll(); // 其他请求都可以访问
  19. // .and()
  20. // .formLogin()
  21. // .loginProcessingUrl(“/login”)
  22. // .permitAll()// 表单登录允许任意权限访问
  23. // .and()
  24. // .logout().permitAll();// 注销操作允许任意权限访问
  25. }
  26. }

resourceconfig配置：

  1. package com.shen.config;
  3. import org.springframework.beans.factory.annotation.Autowired;
  4. import org.springframework.context.annotation.Bean;
  5. import org.springframework.context.annotation.Configuration;
  6. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  7. import org.springframework.security.config.http.SessionCreationPolicy;
  8. import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
  9. import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurer;
  10. import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
  11. import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
  12. import org.springframework.security.oauth2.provider.token.RemoteTokenServices;
  13. import org.springframework.security.oauth2.provider.token.ResourceServerTokenServices;
  14. import org.springframework.security.oauth2.provider.token.TokenStore;
  16. import java.rmi.Remote;
  18. @Configuration
  19. @EnableResourceServer
  20. public class ResouceServeCongie extends ResourceServerConfigurerAdapter {
  22. // 配置资源ID
  23. public static final String RESOURCE_ID = “resource1”;
  25. // // 配置令牌验证的服务
  26. // @Bean
  27. // public ResourceServerTokenServices tokenServices(){
  28. // RemoteTokenServices services = new RemoteTokenServices();
  29. // services.setCheckTokenEndpointUrl(“http://localhost:8003/oauth/check\_token“);
  30. // services.setClientId(“client1”);
  31. // services.setClientSecret(“secret”);
  32. // return services;
  33. // }
  35. // 注入本地验证的配置类
  36. @Autowired
  37. TokenStore tokenStore;
  39. // 配置资源服务
  40. @Override
  41. public void configure(ResourceServerSecurityConfigurer resources){
  42. resources.resourceId(RESOURCE_ID)
  43. // .tokenServices(tokenServices()) // 验证令牌的服务
  44. .tokenStore(tokenStore) // 使用远程校验令牌的服务
  45. .stateless(true);
  46. }
  48. // 配置HTTP服务
  49. public void configure(HttpSecurity http) throws Exception {
  50. http.
  51. authorizeRequests()
  52. .antMatchers(“/**“).access(“#oauth2.hasScope(‘all’)”)
  53. .and().csrf().disable()
  54. .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
  55. }
  57. }

Tokenconfig配置：

  1. package com.shen.config;
  3. import org.springframework.context.annotation.Bean;
  4. import org.springframework.context.annotation.Configuration;
  5. import org.springframework.security.oauth2.provider.token.TokenStore;
  6. import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  7. import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
  9. @Configuration
  10. public class TokenConfig {
  12. // 使用本地校验token的方式，所以需要配置单独的令牌校验服务
  13. // 配置JWT令牌的相关配置
  15. // 配置密钥
  16. private String SIGNING_KEY = “uaa_authorization”;
  18. // 配置JWT存储方案
  19. @Bean
  20. public TokenStore tokenStore(){
  21. return new JwtTokenStore(accessTokenConverter());
  22. }
  24. // 配置生成JWT令牌的过程
  25. @Bean
  26. public JwtAccessTokenConverter accessTokenConverter(){
  27. JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  28. converter.setSigningKey(SIGNING_KEY);
  29. return converter;
  30. }
  32. }

获取到的token：

d80b709b66be2a6428cc06f0da11dc1b.png

发表评论

表情：
评论列表 （有 0 条评论，215人围观）

还没有评论，来说两句吧...

相关阅读