006 签发的用户认证token超时刷新策略

电玩女神 2023-06-15 09:59 16阅读 0赞

*  参考文献：https://blog.csdn.net/sinat\_25235033/article/details/80324006
 *  文献缺点：用的是id，这样多个用户登录同一个账户就有问题，只要我知道你的用户id，其他人登录一下，这边就可以无限登录  
    ![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0h1YW5GZW5nWmhpUWl1_size_16_color_FFFFFF_t_70]

#### 1.登录时保存到redis ####

redisTemplate.opsForValue().set("jwt_session_"+token, JSONObject.toJSONString(map),120, TimeUnit.SECONDS);

public R login(UserEntity user, String smsCode,String loginType) throws Exception {
        R info = userService.getLoginUser(user.getUsername(),user.getTelPhone(), user.getPassword(), smsCode, loginType);
            UserEntity entity=new UserEntity();
        	entity = (UserEntity) info.get("entity");
        	String token=jwtTokenUtil.generateToken(new JWTInfo(entity.getId(), entity.getUsername(), entity.getRealname(),entity.getTelPhone(),entity.getIconImg(),entity.getOrgId(),entity.getClientId()));
        	Map<String, String> map = new HashMap<String,String>();
            map.put("id",entity.getId());
            map.put("account",entity.getUsername());
            map.put("realname",entity.getRealname());
            map.put("phone",entity.getTelPhone());
            map.put("headImg",entity.getIconImg());
            map.put("orgId",entity.getOrgId());
            map.put("clientId",entity.getClientId());
            map.put("token",token);
        	redisTemplate.opsForValue().set("jwt_session_"+token, JSONObject.toJSONString(map),120, TimeUnit.SECONDS);
        	return R.ok().put("token",token);
    }

#### 2.访问超时是刷新token ####

/**
         * 获取token中的用户信息
         *
         * @param token
         * @param pubKeyPath
         * @return
         * @throws Exception
         */
        public  JWTInfo getInfoFromToken(String token) throws Exception {
        	System.out.println("验证token:"+token);
        	//1. 通过redis获取它实际的token
    		Object json =redisTemplate.opsForValue().get("jwt_session_"+token);
    		//2. redis就获取，没有就过期
    		if(ObjectUtils.isEmpty(json)){
    			throw new Exception("token已失效!");
    		}
        	Algorithm algorithm = Algorithm.HMAC256("epf123");
        	JWTVerifier verifier = JWT.require(algorithm).withIssuer("ADMIN").build();
    		//3. 再看redis里面的真实token是否过期
    		Map maps = (Map)JSON.parse(json.toString());
    		try{
    			//4.没有过期就直接获取内容返回
    			DecodedJWT jwt = verifier.verify(maps.get("token").toString());
    			String subject = jwt.getSubject();
    			List<String> audience = jwt.getAudience();
    			Map<String, Claim> claims = jwt.getClaims();
    			JWTInfo jwtInfo =new JWTInfo(claims.get("id").asString(), claims.get("account").asString(), claims.get("realname").asString(),claims.get("phone").asString() ,claims.get("headImg").asString() ,claims.get("orgId").asString(),claims.get("clientId").asString() );
    			return jwtInfo;
    		}catch(Exception e){
    			try{
    				//5. 过期就重新生成token,并保存到redis里面，刷新token
    				JWTInfo jwtInfo=new JWTInfo(maps.get("id").toString(), maps.get("account").toString(), maps.get("realname").toString(),"","",maps.get("orgId").toString(),"");
    				String refreshToken=jwtTokenUtil.generateToken(jwtInfo);
    				//刷新旧的token
    				maps.put("token",refreshToken);
    				redisTemplate.opsForValue().set("jwt_session_"+token, JSONObject.toJSONString(maps),600, TimeUnit.SECONDS);
    				return jwtInfo;
    			}catch (Exception e2){
    				e2.printStackTrace();
    				return null;
    			}
    
    		}
        }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0h1YW5GZW5nWmhpUWl1_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191121212907514.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0h1YW5GZW5nWmhpUWl1,size_16,color_FFFFFF,t_70