（二）Spring Security简单后台实例

谁践踏了优雅 2023-07-01 06:24 43阅读 0赞

一、功能介绍：下面是一个springBoot+springSecurity+jwt 带验证码、单一点登录、token鉴权的简单后台

1、首先是获取验证码：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70][]

2、登录：输入用户名、密码、验证码（输入1111可以跳过验证码校验）：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 1][]

3、获取登录用户的权限：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 2][]

二、代码：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 3][]

1、pom：

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
      <modelVersion>4.0.0</modelVersion>
      <groupId>com.security</groupId>
      <artifactId>security-demo</artifactId>
      <version>0.0.1-SNAPSHOT</version>
      <packaging>war</packaging>
    
      <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.4.1.RELEASE</version>
      </parent>
      <dependencies>
        <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
    
        <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
    
        <dependency>
          <groupId>org.mybatis.spring.boot</groupId>
          <artifactId>mybatis-spring-boot-starter</artifactId>
          <version>1.1.1</version>
        </dependency>
        <dependency>
          <groupId>mysql</groupId>
          <artifactId>mysql-connector-java</artifactId>
          <version>5.1.21</version>
        </dependency>
        <dependency>
          <groupId>c3p0</groupId>
          <artifactId>c3p0</artifactId>
          <version>0.9.1.2</version>
        </dependency>
    
        <dependency>
          <groupId>io.jsonwebtoken</groupId>
          <artifactId>jjwt</artifactId>
          <version>0.9.0</version>
        </dependency>
    
        
        <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>
    
        <dependency>
          <groupId>org.springframework.session</groupId>
          <artifactId>spring-session-data-redis</artifactId>
        </dependency>
    
        <dependency>
          <groupId>redis.clients</groupId>
          <artifactId>jedis</artifactId>
        </dependency>
        
        <dependency>
          <groupId>org.apache.httpcomponents</groupId>
          <artifactId>httpclient</artifactId>
          <version>4.5.6</version>
        </dependency>
    
        <dependency>
          <groupId>com.alibaba</groupId>
          <artifactId>fastjson</artifactId>
          <version>1.2.31</version>
        </dependency>
    
        <dependency>
          <groupId>commons-collections</groupId>
          <artifactId>commons-collections</artifactId>
          <version>3.2.1</version>
        </dependency>
        <dependency>
          <groupId>commons-lang</groupId>
          <artifactId>commons-lang</artifactId>
          <version>2.5</version>
        </dependency>
    
      </dependencies>
    </project>

2、application.properties:

server.port=9999
    server.context-path=/test
    #mysql
    spring.datasource.driver-class-name=com.mysql.jdbc.Driver
    spring.datasource.url=jdbc:mysql://localhost:3306/demo?useUnicode=true&characterEncoding=utf-8&useSSL=false
    spring.datasource.username=root
    spring.datasource.password=wtyy
    #mybatis
    mybatis.mapper-locations=classpath*:Mapper/*Mapper.xml
    
    spring.redis.host=localhost
    spring.redis.port=6379
    #spring.redis.password=
    spring.redis.database=1
    spring.redis.pool.max-active=8
    spring.redis.pool.max-wait=-1
    spring.redis.pool.max-idle=500
    spring.redis.pool.min-idle=0
    spring.redis.timeout=0

3、常量：

1）CommonEnums：

package com.demo.constants;
    
    public enum CommonEnums {
    
        CODE_200(200,"请求成功"),
        CODE_300(300,"登录成功"),
        CODE_301(301,"登录失败"),
        CODE_302(302,"退出成功"),
        CODE_303(303,"退出失败"),
        CODE_304(304,"用户或密码错误"),
        CODE_305(305,"账户已被锁定"),
        CODE_401(401,"授权失败"),
        CODE_400(400,"业务异常"),
        CODE_402(402,"非法请求"),
        CODE_403(403,"验证码错误"),
        CODE_405(405,"验证码无效"),
        CODE_500(500,"系统异常"),
    
        ;
        public final int code;
    
        public final String message;
    
        CommonEnums(int code, String message ) {
            this.code = code;
            this.message = message;
        }
    
        public int getCode() {
            return this.code;
        }
    
        public String getMessage() {
            return message;
        }
    
        public static String getEnumToValue(int code){
            for (CommonEnums statusEnum: CommonEnums.values()) {
                if (statusEnum.code == code){
                    return statusEnum.message;
                }
            }
            return "";
        }
    }

2）、Constants：

package com.demo.constants;
    public class Constants {
    
        public static final long EXPIRATIONTIME = (long)1000 * 60 * 60 * 24 * 1; //1 days
        public static final String SECRET = "spring-security-jwt";
        public static final String HEADER_STRING = "token";
        public static final String TOKEN_PREFIX = "Bearer";
        public static final String TOKEN_JWT="token_jwt:";
        public static final String JWT_USER="jwt_user:";
        public static final String LOCK="lock:";
        public static final String ERROR_NUM="error_num:";
    }

4、dto:省略所有get、set方法

1）UserDTO用户dto：

public class UserDTO implements Serializable {
        private Integer id;
    
        private String userNickName;
    
        private String userName;
    
        private String password;
    }

2）RoleVO角色：

public class RoleVO implements Serializable {
        private Integer roleId;
    
        private String roleCode;
    
        private String roleName;
    }

3）AuthorityDTO权限

public class AuthorityDTO implements Serializable {
    
        private Integer authorityId;
    
        private String authorityCode;
    
        private String authorityName;
    }

4）JwtAuthenticationRequest，用户登录vo，对前端请求对象的封装：

public class JwtAuthenticationRequest implements Serializable {
    
        private static final long serialVersionUID = -8445943548965154778L;
    
        private String username;
        private String password;
        private String code;
    
        public JwtAuthenticationRequest() {
            super();
        }
    
        public JwtAuthenticationRequest(String username, String password) {
            this.setUsername(username);
            this.setPassword(password);
        }
    
    }

5）JwtUser系统登录用户：

public class JwtUser implements UserDetails {
    
        private Integer id;
        private String userName;
        private String password;
        private String userNickName;
        private List<RoleVO> roles = new ArrayList<>();
        private Collection<? extends GrantedAuthority> authorities;
    
        public JwtUser(){
    
        }
    
        public JwtUser(Integer id, String userName, String password, String userNickName,
                       Collection<? extends GrantedAuthority> authorities, List<RoleVO> roles){
            this.id = id;
            this.userName = userName;
            this.userNickName = userNickName;
            this.password = password;
            this.authorities = authorities;
            this.roles = roles;
        }
    }

6）返回结果封装ResponseMessage：

package com.demo.dto;
    
    import com.demo.constants.CommonEnums;
    
    public class ResponseMessage {
    
        private int code;
    
        private String status;
    
        private String message;
    
        private String errorMessage;
    
        private String errorExceptionMessage;
    
        private Object data;
    
        public ResponseMessage(int code,String status,Object data){
            this.code = code;
            this.status = status;
            this.data = data;
        }
    
        public ResponseMessage(int code,String status,String message){
            this.code = code;
            this.status = status;
            this.message = message;
        }
    
        public ResponseMessage(int code,String status,String message,Object data){
            this.code = code;
            this.status = status;
            this.message = message;
            this.data = data;
        }
    
    
    
    
        public ResponseMessage(int code,String status,String message,String errorMessage){
            this.code = code;
            this.status = status;
            this.message = message;
            this.errorMessage = errorMessage;
        }
    
        public ResponseMessage(int code,String status,String message,String errorMessage,String errorExceptionMessage){
            this.code = code;
            this.status = status;
            this.message = message;
            this.errorMessage = errorMessage;
            this.errorExceptionMessage = errorExceptionMessage;
        }
    
    
        public static ResponseMessage  success(String message){
            return new ResponseMessage(CommonEnums.CODE_200.code,"success",message);
        }
        public static ResponseMessage  success(Object data){
            return new ResponseMessage(CommonEnums.CODE_200.code,"success",data);
        }
    
    
        public static ResponseMessage  success(String message,Object data){
            return new ResponseMessage(CommonEnums.CODE_200.code,"success",message,data);
        }
    
        public static ResponseMessage  success(int code,String message,Object data){
            return new ResponseMessage(code,"success",message,data);
        }
    
        public static ResponseMessage  success(){
            return new ResponseMessage(CommonEnums.CODE_200.code,null,CommonEnums.CODE_200.message);
        }
    
        public static  ResponseMessage success(int code,Object data){
            return new ResponseMessage(code,"success",data);
        }
    
    
        public static ResponseMessage success(int code,String message){
            return new ResponseMessage(code,"success",message);
        }
    
        public static  ResponseMessage error(int code,String message){
            return new ResponseMessage(code,"error",message);
        }
    
        public static  ResponseMessage error(int code,String message,String errorMessage){
            return new ResponseMessage(code,"error",message,errorMessage);
        }
    
        public static  ResponseMessage error(int code,String message,String errorMessage,String errorExceptionMessage){
            return new ResponseMessage(code,"error",message,errorMessage,errorExceptionMessage);
        }
    
    
        public static  ResponseMessage error(String message,String errorMessage){
            return new ResponseMessage(CommonEnums.CODE_500.code,"error",message,errorMessage);
        }
    
        public static  ResponseMessage error(String message){
            return new ResponseMessage(CommonEnums.CODE_400.code,"error",message);
        }
    
        public static  ResponseMessage infor(int code,String message){
            return new ResponseMessage(code,"infor",message);
        }
    
       }
     
    }

4、factory：这块用于注册与获取spring的bean，做个统一的管理：

1）ApplicationContextRegister：

package com.demo.factory;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.BeansException;
    import org.springframework.context.ApplicationContext;
    import org.springframework.context.ApplicationContextAware;
    import org.springframework.stereotype.Component;
    
    
    @Component
    public class ApplicationContextRegister implements ApplicationContextAware {
        private static Logger logger = LoggerFactory.getLogger(ApplicationContextRegister.class);
        private static ApplicationContext APPLICATION_CONTEXT;
        /**
         * 设置spring上下文
         * @param applicationContext spring上下文
         * @throws BeansException
         * */
        @Override
        public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
            logger.debug("ApplicationContext registed-->{}", applicationContext);
            DefaultBeanFactory.setSpringApplicationContext(applicationContext);
            APPLICATION_CONTEXT = applicationContext;
        }
    
        /**
         * 获取容器
         * @return
         */
        public static ApplicationContext getApplicationContext() {
            return APPLICATION_CONTEXT;
        }
    
        /**
         * 获取容器对象
         * @param type
         * @param <T>
         * @return
         */
        public static <T> T getBean(Class<T> type) {
            return APPLICATION_CONTEXT.getBean(type);
        }
    }

2）DefaultBeanFactory：

package com.demo.factory;
    
    import org.springframework.context.ApplicationContext;
    import org.springframework.context.support.ClassPathXmlApplicationContext;
    
    
    public class DefaultBeanFactory {
    	private static ApplicationContext context = null;
    	private static DefaultBeanFactory instance = null;
    	private static Object lock = new Object();
    
    	private DefaultBeanFactory(String filepath){
    		try {
    			context = new ClassPathXmlApplicationContext(filepath);
    		} catch (Exception e) {
    		}
    	}
    	@SuppressWarnings("static-access")
    	private DefaultBeanFactory(ApplicationContext context){
    		try {
    			this.context = context;
    		} catch (Exception e) {
    		}
    	}
    
    	public static void setSpringApplicationContext(ApplicationContext context){
    		synchronized (lock) {
    			instance = new DefaultBeanFactory(context);
    		}
    	}
    	public static DefaultBeanFactory getInstance() {
    		if(instance == null || context == null){
    			throw new RuntimeException("Spring context is null!");
    		}
    		return instance;
    	}
    
    	public static DefaultBeanFactory getInstance(String filepath) {
    		synchronized (lock) {
    			instance = new DefaultBeanFactory(filepath);
    		}
    		return instance;
    	}
    	public Object getBean(String name) {
    		return context.getBean(name);
    	}
    }

3）ServiceFactory：

package com.demo.factory;
    
    import com.demo.util.RedisClient;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    
    public class ServiceFactory {
    
    
        private static Logger logger = LoggerFactory.getLogger(ServiceFactory.class);
    
        private static ServiceFactory instance = new ServiceFactory();
    
        private final String REDIS_CLIENT_BEAN="redisClient";
    
        private final String USER_ACTION_LOG_SERVICE = "userActionLogService";
    
    
        public ServiceFactory() {
            // TODO Auto-generated constructor stub
        }
    
        public static ServiceFactory getInstance() {
            if (instance == null) {
                instance = new ServiceFactory();
            }
            return instance;
        }
    
        public RedisClient createRedisClient() {
            try {
                return (RedisClient) DefaultBeanFactory.getInstance().getBean(REDIS_CLIENT_BEAN);
            } catch (Exception e) {
                throw new RuntimeException("创建 createRedisClient BEAN 异常", e);
            }
        }
    
    
    }

5、handle异常：

1）CustomAuthenticationFailureHandler：

package com.demo.handle;
    
    import com.alibaba.fastjson.JSON;
    import com.demo.constants.CommonEnums;
    import com.demo.dto.ResponseMessage;
    import org.apache.http.entity.ContentType;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.authentication.AuthenticationFailureHandler;
    import org.springframework.stereotype.Component;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    @Component
    public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {
    
      @Override
      public void onAuthenticationFailure(HttpServletRequest httpServletRequest,
                                          HttpServletResponse httpServletResponse, AuthenticationException e)
          throws IOException, ServletException {
        httpServletResponse.setContentType(ContentType.APPLICATION_JSON.toString());
        httpServletResponse.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_304.code,CommonEnums.CODE_304.message)));
      }
    }

2）Http401AuthenticationEntryPoint：

package com.demo.handle;
    
    import com.alibaba.fastjson.JSON;
    import com.demo.constants.CommonEnums;
    import com.demo.dto.ResponseMessage;
    import org.apache.http.entity.ContentType;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.web.AuthenticationEntryPoint;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    
    public class Http401AuthenticationEntryPoint implements AuthenticationEntryPoint {
    
    
        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
            response.setContentType(ContentType.APPLICATION_JSON.toString());
            response.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_401.code,CommonEnums.CODE_401.message)));
        }
    
    }

6、服务：

1）自定义身份认证验证CustomAuthenticationProvider：

package com.demo.service.impl;
    
    
    import com.demo.dto.UserDTO;
    import com.demo.service.UserService;
    import com.demo.util.AESUtils;
    import com.demo.util.MD5Util;
    import org.springframework.security.authentication.AuthenticationProvider;
    import org.springframework.security.authentication.BadCredentialsException;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    
    import java.security.NoSuchAlgorithmException;
    import java.util.Objects;
    
    /**
     * 自定义身份认证验证组件
     */
    public class CustomAuthenticationProvider implements AuthenticationProvider {
        private UserService userService;
    
        public CustomAuthenticationProvider(
                                            UserService userService
                                            ){
            this.userService = userService;
        }
    
        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            // 获取认证的用户名 & 密码
            //前端带入的username
            String username = authentication.getName();
            //前端带入的加密password
            String passwordRsa = authentication.getCredentials().toString();
            //passwordRsa解密后的密码
            String password = "";
            String passwordMd5 = "";
            //RSA解密
            try {
                password = AESUtils.decryptStr(passwordRsa,AESUtils.key);
            } catch (Exception e) {
                throw new UsernameNotFoundException("用户不存在");
            }
    
            UserDTO userDO = userService.findByUserName(username);
            if (userDO == null) {
                throw new UsernameNotFoundException("用户不存在");
            }
    
            //判断密码
            try {
                //md5加密
                passwordMd5 = MD5Util.MD5(password);
            } catch (NoSuchAlgorithmException e) {
                throw new UsernameNotFoundException("用户不存在");
            }
            if (!Objects.equals(passwordMd5,userDO.getPassword())){
                throw new BadCredentialsException("密码错误");
            }
    
            UserDetails userDetails = userService.loadUserByUsername(username);
            // 这里设置权限和角色
            Authentication auth = new UsernamePasswordAuthenticationToken(userDetails, null,userDetails.getAuthorities());
            return auth;
        }
    
        /**
         * 是否可以提供输入类型的认证服务
         * @param authentication
         * @return
         */
        @Override
        public boolean supports(Class<?> authentication) {
            return authentication.equals(UsernamePasswordAuthenticationToken.class);
        }
    
    }

2）用户服务UserServiceImpl：

package com.demo.service.impl;
    
    import com.demo.dao.AuthorityDao;
    import com.demo.dao.UserDao;
    import com.demo.dao.UserRoleDao;
    import com.demo.dto.AuthorityDTO;
    import com.demo.dto.JwtUser;
    import com.demo.dto.RoleVO;
    import com.demo.dto.UserDTO;
    import com.demo.service.RoleService;
    import com.demo.service.UserService;
    import org.apache.commons.collections.CollectionUtils;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.stereotype.Service;
    
    import java.util.ArrayList;
    import java.util.Collections;
    import java.util.List;
    import java.util.stream.Collectors;
    
    @Service("userService")
    public class UserServiceImpl implements UserService {
    
        @Autowired
        private UserDao userDao;
    
        @Autowired
        private UserRoleDao userRoleDao;
    
        @Autowired
        private AuthorityDao authorityDao;
    
        @Autowired
        private RoleService roleService;
    
        @Override
        public UserDTO findByUserName(String userAccount) {
           return userDao.findByUserName(userAccount);
        }
    
        @Override
        public List<UserDTO> getAllUsers() {
            return userDao.getAllUsers();
        }
    
        @Override
        public List<AuthorityDTO> getAuthortiesByUserId(Integer userId) {
            List<RoleVO> roles = userRoleDao.findRoleByUserId(userId);
            if(CollectionUtils.isNotEmpty(roles)){
                List<Integer> roleIds = roles.stream().map(RoleVO::getRoleId).collect(Collectors.toList());
                return authorityDao.getAuthortiesByRoleIds(roleIds);
            }
            return new ArrayList<>();
        }
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            UserDTO userDO = findByUserName(username);
            if(userDO == null){
                throw new UsernameNotFoundException("用户不存在");
            }
            List<RoleVO> roleDOS = roleService.findRoleByUserId(userDO.getId());
            return new JwtUser(userDO.getId(),userDO.getUserName(),userDO.getPassword(),
                    userDO.getUserNickName(),null,roleDOS);
        }
    }

3）系统角色服务RoleServiceImpl：

package com.demo.service.impl;
    
    import com.demo.dao.UserRoleDao;
    import com.demo.dto.RoleVO;
    import com.demo.service.RoleService;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Service;
    
    import java.util.List;
    
    @Service("roleService")
    public class RoleServiceImpl implements RoleService {
    
        @Autowired
        private UserRoleDao userRoleDao;
    
        @Override
        public List<RoleVO> findRoleByUserId(Integer id) {
            return userRoleDao.findRoleByUserId(id);
        }
    }

7、util:

1)AESUtils:

package com.demo.util;
    
    
    import javax.crypto.*;
    import javax.crypto.spec.IvParameterSpec;
    import javax.crypto.spec.SecretKeySpec;
    import java.io.UnsupportedEncodingException;
    import java.nio.charset.Charset;
    import java.security.InvalidAlgorithmParameterException;
    import java.security.InvalidKeyException;
    import java.security.NoSuchAlgorithmException;
    
    public class AESUtils {
    
        private static String iv = "HGty&6%4ojyUyhgy";//偏移量字符串必须是16位 当模式是CBC的时候必须设置偏移量
        private static String Algorithm = "AES";
        private static String AlgorithmProvider = "AES/CBC/PKCS5Padding"; //算法/模式/补码方式
        public final static String key="FUjs@17654HGJKKn";
    
        public static byte[] generatorKey() throws NoSuchAlgorithmException {
            KeyGenerator keyGenerator = KeyGenerator.getInstance(Algorithm);
            keyGenerator.init(256);//默认128，获得无政策权限后可为192或256
            SecretKey secretKey = keyGenerator.generateKey();
            return secretKey.getEncoded();
        }
    
        public static IvParameterSpec getIv() throws UnsupportedEncodingException {
            IvParameterSpec ivParameterSpec = new IvParameterSpec(iv.getBytes("utf-8"));
            System.out.println("偏移量："+byteToHexString(ivParameterSpec.getIV()));
            return ivParameterSpec;
        }
    
        public static byte[] encrypt(String src, byte[] key) throws NoSuchAlgorithmException, NoSuchPaddingException,
                InvalidKeyException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException, InvalidAlgorithmParameterException {
            SecretKey secretKey = new SecretKeySpec(key, Algorithm);
            IvParameterSpec ivParameterSpec = getIv();
            Cipher cipher = Cipher.getInstance(AlgorithmProvider);
            cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivParameterSpec);
            byte[] cipherBytes = cipher.doFinal(src.getBytes(Charset.forName("utf-8")));
            return cipherBytes;
        }
    
        public static byte[] decrypt(String src, byte[] key) throws Exception {
            SecretKey secretKey = new SecretKeySpec(key, Algorithm);
    
            IvParameterSpec ivParameterSpec = getIv();
            Cipher cipher = Cipher.getInstance(AlgorithmProvider);
            cipher.init(Cipher.DECRYPT_MODE, secretKey, ivParameterSpec);
            byte[] hexBytes = hexStringToBytes(src);
            byte[] plainBytes = cipher.doFinal(hexBytes);
            return plainBytes;
        }
    
        /**
         * 解密
         * @param src
         * @param keyStr
         * @return
         * @throws Exception
         */
        public static String decryptStr(String src, String keyStr) throws Exception {
    
            byte key[] = keyStr.getBytes("utf-8");
            SecretKey secretKey = new SecretKeySpec(key, Algorithm);
    
            IvParameterSpec ivParameterSpec = getIv();
            Cipher cipher = Cipher.getInstance(AlgorithmProvider);
            cipher.init(Cipher.DECRYPT_MODE, secretKey, ivParameterSpec);
            byte[] hexBytes = hexStringToBytes(src);
            byte[] plainBytes = cipher.doFinal(hexBytes);
            return new String(plainBytes,"UTF-8");
        }
    
    
        public static String encrypt(String src, String keyStr) throws NoSuchAlgorithmException, NoSuchPaddingException,
                InvalidKeyException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException, InvalidAlgorithmParameterException {
    
            byte key[] = keyStr.getBytes("utf-8");
            SecretKey secretKey = new SecretKeySpec(key, Algorithm);
            IvParameterSpec ivParameterSpec = getIv();
            Cipher cipher = Cipher.getInstance(AlgorithmProvider);
            cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivParameterSpec);
            byte[] cipherBytes = cipher.doFinal(src.getBytes(Charset.forName("utf-8")));
            return new String(cipherBytes,"UTF-8");
        }
    
        public static void main(String args[]){
            try {
                String passwordMd5 = MD5Util.MD5("123456");
                System.out.println("加密后密码："+passwordMd5);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        /**
         * 将byte转换为16进制字符串
         * @param src
         * @return
         */
        public static String byteToHexString(byte[] src) {
            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < src.length; i++) {
                int v = src[i] & 0xff;
                String hv = Integer.toHexString(v);
                if (hv.length() < 2) {
                    sb.append("0");
                }
                sb.append(hv);
            }
            return sb.toString();
        }
    
        /**
         * 将16进制字符串装换为byte数组
         * @param hexString
         * @return
         */
        public static byte[] hexStringToBytes(String hexString) {
            hexString = hexString.toUpperCase();
            int length = hexString.length() / 2;
            char[] hexChars = hexString.toCharArray();
            byte[] b = new byte[length];
            for (int i = 0; i < length; i++) {
                int pos = i * 2;
                b[i] = (byte) (charToByte(hexChars[pos]) << 4 | (charToByte(hexChars[pos + 1]))& 0xff);
            }
            return b;
        }
    
        private static byte charToByte(char c) {
            return (byte) "0123456789ABCDEF".indexOf(c);
        }
    
    
         /*public static void main(String[] args) {
            try {
                // byte key[] = generatorKey();
                System.out.println("FUjs@17654HGJKKn".length());
                // 密钥必须是16的倍数
                byte key[] = "FUjs@17654HGJKKn".getBytes("utf-8");//hexStringToBytes("0123456789ABCDEF");
                String src = "usersrs=111111?sdfjsalkj=1mlkjklasjdfkls?sss=sdfsjlk1123123123?sdd=453456465432165765432221351567897654132";
                System.out.println("密钥:"+byteToHexString(key));
                System.out.println("原字符串:"+src);
    
                String enc = byteToHexString(encrypt(src, key));
                System.out.println("加密："+enc);
                System.out.println("解密："+decryptStr(enc, AESUtils.key));
            } catch (InvalidKeyException e) {
                e.printStackTrace();
            } catch (NoSuchAlgorithmException e) {
                e.printStackTrace();
            } catch (NoSuchPaddingException e) {
                e.printStackTrace();
            } catch (IllegalBlockSizeException e) {
                e.printStackTrace();
            } catch (BadPaddingException e) {
                e.printStackTrace();
            } catch (UnsupportedEncodingException e) {
                e.printStackTrace();
            } catch (Exception e) {
                e.printStackTrace();
            }
        }*/
    
    
    }

2)MD5Util

package com.demo.util;
    
    import org.apache.commons.codec.digest.DigestUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import java.io.UnsupportedEncodingException;
    import java.security.MessageDigest;
    import java.security.NoSuchAlgorithmException;
    import java.util.*;
    
    /**
     * Md5算法加密
     *
     * @author <a href="mailTo:helen@ibw.cn">Helen</a>
     * @time Mar 19, 2013
     * @version 1.0
     */
    public class MD5Util {
    
        private final static Logger logger = LoggerFactory.getLogger(MD5Util.class);
    
        private final static String APP_KEY="hYHN#1son@16faEV2";
        private final static String CHARSET="UTF-8";
        /**
         * MD5加密算法
         *
         * @param s
         * @return
         */
        public final static String MD5(String s) throws NoSuchAlgorithmException {
            char hexDigits[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
                    'A', 'B', 'C', 'D', 'E', 'F' };
            byte[] btInput = s.getBytes();
            // 获得MD5摘要算法的 MessageDigest 对象
            MessageDigest mdInst;
            mdInst = MessageDigest.getInstance("MD5");
            // 使用指定的字节更新摘要
            mdInst.update(btInput);
            // 获得密文
            byte[] md = mdInst.digest();
            // 把密文转换成十六进制的字符串形式
            int j = md.length;
            char str[] = new char[j * 2];
            int k = 0;
            for (int i = 0; i < j; i++) {
                byte byte0 = md[i];
                str[k++] = hexDigits[byte0 >>> 4 & 0xf];
                str[k++] = hexDigits[byte0 & 0xf];
            }
            return new String(str);
        }
    
    
        /**
         * 编码转换
         * @param content
         * @param charset
         * @return
         * @throws UnsupportedEncodingException
         */
        private static byte[] getContentBytes(String content, String charset) {
            if (charset == null || "".equals(charset)) {
                return content.getBytes();
            }
            try {
                return content.getBytes(charset);
            } catch (UnsupportedEncodingException e) {
                throw new RuntimeException("MD5签名过程中出现错误,指定的编码集不对,您目前指定的编码集是:" + charset);
            }
        }
    
        public static String sign(String prestr){
            String mysign = DigestUtils.md5Hex(getContentBytes(prestr + APP_KEY, CHARSET));
            return mysign;
        }
    
        public static String signParams(Map<String,String> params){
            try {
                if (params != null && params.size()>0){
                    List<Map.Entry<String, String>> list = new ArrayList(params.entrySet());
                    Collections.sort(list, new Comparator<Map.Entry<String,String>>() {
                        @Override
                        public int compare(Map.Entry<String, String> o1, Map.Entry<String, String> o2) {
                            return o1.getKey().compareTo(o2.getKey());
                        }
                    });
                    StringBuffer sb = new StringBuffer();
                    for (Map.Entry<String, String> ent:list) {
                        sb.append(ent.getKey());
                        sb.append(ent.getValue());
                    }
                    logger.info("原字符串：{}",sb.toString());
                    return sign(sb.toString());
                }
            }catch (Exception e){
    
            }
            return "";
        }
    
        public static boolean isSign(HashMap<String,String> params,String sign){
            try{
                String newSign = signParams(params);
                logger.info("原签名：{}",sign);
                logger.info("新签名：{}",newSign);
                if (Objects.equals(sign,newSign)){
                    return true;
                }
            }catch (Exception e){
    
            }
            return false;
        }
    
    
    
    }

3)RedisClient：

package com.demo.util;
    
    import com.fasterxml.jackson.databind.ObjectMapper;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Component;
    import redis.clients.jedis.Jedis;
    import redis.clients.jedis.JedisPool;
    import redis.clients.jedis.JedisPoolConfig;
    
    import java.io.ByteArrayInputStream;
    import java.io.ByteArrayOutputStream;
    import java.io.ObjectInputStream;
    import java.io.ObjectOutputStream;
    import java.lang.reflect.Field;
    import java.util.*;
    
    @Component
    public class RedisClient {
    
        private  final Logger logger = LoggerFactory.getLogger(RedisClient.class);
    
        private  final String SUCCESS_OK = "OK";
        private  final Long SUCCESS_STATUS_LONG = 1L;
    
        // SET IF NOT EXIST，即当key不存在时，我们进行set操作；若key已经存在，则不做任何操作
        private  final String SET_IF_NOT_EXIST = "NX";
        // 给key加一个过期的设置，具体时间由第五个参数决定
        private  final String SET_WITH_EXPIRE_TIME = "PX";
    
        private static JedisPool jedisPool;
    
        private static final String IP = "127.0.0.1"; // ip
        private static final int PORT = 6379; // 端口
        // private static final String AUTH=""; // 密码(原始默认是没有密码)
        private static int MAX_ACTIVE = 1024; // 最大连接数
        private static int MAX_IDLE = 200; // 设置最大空闲数
        private static int MAX_WAIT = 10000; // 最大连接时间
        private static int TIMEOUT = 10000; // 超时时间
        private static boolean BORROW = true; // 在borrow一个事例时是否提前进行validate操作
    
         /**
         * 初始化线程池
         */
        static {
            JedisPoolConfig config = new JedisPoolConfig();
            config.setMaxTotal(MAX_ACTIVE);
            config.setMaxIdle(MAX_IDLE);
            config.setMaxWaitMillis(MAX_WAIT);
            config.setTestOnBorrow(BORROW);
             jedisPool = new JedisPool(config, IP, PORT, TIMEOUT);
        }
    
        public JedisPool getJedisPool(){
            return jedisPool;
        }
    
        /**
         * 字符串set
         *
         * @param key
         * @param value
         * @return
         */
        public  boolean set(String key, String value) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                String status = jedis.set(key, value);
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis set 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
    
    
        /**
         * 字符串set
         *
         * @param key
         * @param value
         * @param seconds
         *            单位秒，大于0
         * @return
         */
        public  boolean set(String key, String value, int seconds) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                String status = jedis.setex(key, seconds, value);
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis set 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        public  boolean set(byte[] key, int seconds, byte[] value) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                String status = jedis.setex(key, seconds, value);
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis set 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        /**
         * 是否存在key
         *
         * @param key
         * @return
         */
        public  boolean isExists(String key) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                return jedis.exists(key);
            } catch (Exception e) {
                logger.error("redis isExists 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        /**
         * 字符串 删除
         *
         * @param key
         * @return
         */
        public  boolean del(byte[] key) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                Long status = jedis.del(key);
                if (Objects.equals(SUCCESS_STATUS_LONG,status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis del 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        public  boolean del(String key) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                Long status = jedis.del(key);
                if (Objects.equals(SUCCESS_STATUS_LONG,status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis del 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        /**
         * 字符串获取
         *
         * @param key
         * @return
         */
        public  String get(String key) {
            String ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                ret = jedis.get(key);
            } catch (Exception e) {
                logger.error("redis get 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        public Long ttl(String key){
            Long ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                ret = jedis.ttl(key);
            } catch (Exception e) {
                logger.error("redis get 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        public  byte[] get(byte[] key) {
            byte[] ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                ret = jedis.get(key);
            } catch (Exception e) {
                logger.error("redis get 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        /**
         * 获取分布式锁
         *
         * @param lockKey
         *            key为锁
         * @param requestId
         *            加锁请求
         * @param expireTime
         *            key的过期时间
         * @return
         */
        public  boolean getLock(String lockKey, String requestId, int expireTime) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                String status = jedis.set(lockKey, requestId, SET_IF_NOT_EXIST, SET_WITH_EXPIRE_TIME, expireTime);
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis 获取分布式锁 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        /**
         * 释放分布式锁
         *
         * @param lockKey
         * @param requestId
         */
        public  boolean releaseLock(String lockKey, String requestId) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
    			/*
    			 * 其他请求误解锁问题 if(requestId.equals(jedis.get(lockKey))) { jedis.del(lockKey); }
    			 */
    
                String script = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end";
                Object status = jedis.eval(script, Collections.singletonList(lockKey),
                        Collections.singletonList(requestId));
                if (SUCCESS_STATUS_LONG.equals(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis 释放分布式锁 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
            return ret;
        }
    
        /**
         * 序列化存入对象
         *
         * @param key
         * @param obj
         * @return
         */
        public  boolean set(byte[] key, Object obj) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                ByteArrayOutputStream baos = new ByteArrayOutputStream();
                ObjectOutputStream oos = new ObjectOutputStream(baos);
                oos.writeObject(obj);
                String status = jedis.set(key, baos.toByteArray());
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis set 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
    
        }
    
        /**
         * 取序列化对象
         *
         * @param key
         * @return
         */
        public  Object getObj(byte[] key) {
            Object ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
    
                byte[] rets = jedis.get(key);
                ByteArrayInputStream bais = new ByteArrayInputStream(rets);
                ObjectInputStream ois = new ObjectInputStream(bais);
                return ois.readObject();
            } catch (Exception e) {
                logger.error("redis get 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        /**
         * hash数据类型存储对象
         *
         * @param key
         * @param obj
         * @return
         */
        public  boolean setHm(String key, Object obj) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                Map<String, String> hash = objToMap(obj);
                String status = jedis.hmset(key, hash);
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis setHm 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        /**
         * 修改对象属性
         *
         * @param key
         * @param field
         * @param value
         * @return
         */
        public  boolean setHm(String key, String field, String value) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
    
                Long status = jedis.hset(key, field, value);
                if (0L == status) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis setHm 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        /**
         * 根据fields 查询key对象属性列表
         *
         * @param key
         * @param fields
         * @return
         */
        public List<String> getHm(String key, String... fields) {
            List<String> ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return null;
                }
                ret = jedis.hmget(key, fields);
            } catch (Exception e) {
                logger.error("redis getHm 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        /**
         * 根据field 查询key对象属性
         *
         * @param key
         * @param
         * @return
         */
        public  String getHm(String key, String field) {
            String ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return null;
                }
    
                ret = jedis.hget(key, field);
    
            } catch (Exception e) {
                logger.error("redis getHm 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
    
    
        /**
         * json格式存对象
         * @param key
         * @param obj
         * @return
         */
        public  boolean setJson(String key,Object obj) {
            boolean ret = false;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                ObjectMapper mapper = new ObjectMapper();
                String status = jedis.set(key, mapper.writeValueAsString(obj));
                if (SUCCESS_OK.equalsIgnoreCase(status)) {
                    ret = true;
                }
            } catch (Exception e) {
                logger.error("redis setJson 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
        }
    
        /**
         * json格式取对象
         * @param key
         * @param clazz
         * @return
         */
        public  Object getJson(String key,Class clazz) {
            Object ret = null;
            Jedis jedis = null;
            try {
                jedis = jedisPool.getResource();
                if (jedis == null) {
                    return ret;
                }
                String str = jedis.get(key);
                ObjectMapper mapper = new ObjectMapper();
                ret = mapper.readValue(str, clazz);
            } catch (Exception e) {
                logger.error("redis getJson 出错", e);
                jedisPool.returnBrokenResource(jedis);
            } finally {
                if (null != jedis) {
                    jedisPool.returnResource(jedis);
                }
            }
    
            return ret;
    
        }
    
        private HashMap<String, String> objToMap(Object obj) {
    
            if(null == obj) {
                return null;
            }
            HashMap<String, String> map = new HashMap<String, String>();
            Field[] fields = obj.getClass().getDeclaredFields();
            try {
                for (int i = 0; i < fields.length; i++) {
                    String varName = fields[i].getName();
                    boolean accessFlag = fields[i].isAccessible();
                    fields[i].setAccessible(true);
    
                    Object o = fields[i].get(obj);
                    if (o != null) {
                        map.put(varName, o.toString());
                    }
    
                    fields[i].setAccessible(accessFlag);
                }
            } catch (Exception e) {
    
            }
    
            return map;
        }
    
        /**
         * 设置一个key的过期的秒数
         *
         * @param keyFormat
         *            key标识
         * @param seconds
         *            过期的秒数
         * @param keyValues
         *            key变量
         * @return 1表示设置成功， 0 表示设置失败或者无法被设置
         */
        public Long expire(String key, int seconds) {
            Jedis jedis = null;
            try {
                jedis =jedisPool.getResource();
                return jedis.expire(key, seconds);
            } finally {
                if (jedis != null) {
                    jedis.close();
                }
            }
        }
    }

4）token管理器JwtProvider

package com.demo.util;
    
    import com.demo.constants.Constants;
    import com.demo.exception.TokenException;
    import com.demo.factory.ServiceFactory;
    import io.jsonwebtoken.*;
    import org.apache.commons.lang.StringUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.util.Date;
    
    /**
     * token管理器
     */
    public class JwtProvider {
    
        private static final Logger logger = LoggerFactory.getLogger(JwtProvider.class);
        private static  RedisClient redisClient;
    
        static {
            redisClient = ServiceFactory.getInstance().createRedisClient();
        }
    
        /**
         * 生成token并将token写入redis
         * @param res
         * @param username
         * @return
         */
        public static String addAuthentication(HttpServletResponse res, String username){
            String jwtStr = Jwts.builder()
                    .setSubject(username)
                    .setExpiration(new Date(System.currentTimeMillis() + Constants.EXPIRATIONTIME))
                    .signWith(SignatureAlgorithm.HS512, Constants.SECRET)
                    .compact();
            String tokent = jwtStr;
            res.addHeader(Constants.HEADER_STRING,tokent );
            //每次重置token，实现单点登录
            redisClient.set(Constants.TOKEN_JWT+username,tokent);
            return tokent;
        }
    
        /**
         * 从token中获取username
         * @param req
         * @return
         */
        public static String getAuthentication(HttpServletRequest req){
            String token = req.getHeader(Constants.HEADER_STRING);
            String username = null;
            if(!StringUtils.isEmpty(token)){
                try{
                    // parse the jwt
                    username = Jwts.parser()
                            .setSigningKey(Constants.SECRET)
                            .parseClaimsJws(token)
                            .getBody()
                            .getSubject();
                }catch (ExpiredJwtException e) {
                    logger.error("Token已过期: {} " + e);
                    throw new TokenException("Token已过期");
                } catch (UnsupportedJwtException e) {
                    logger.error("Token格式错误: {} " + e);
                    throw new TokenException("Token格式错误");
                } catch (MalformedJwtException e) {
                    logger.error("Token没有被正确构造: {} " + e);
                    throw new TokenException("Token没有被正确构造");
                } catch (SignatureException e) {
                    logger.error("签名失败: {} " + e);
                    throw new TokenException("签名失败");
                } catch (IllegalArgumentException e) {
                    logger.error("非法参数异常: {} " + e);
                    throw new TokenException("非法参数异常");
                }
            }
            return username;
        }
    }

8、security：全局security配置WebSecurityConfig：

package com.demo.security;
    
    
    import com.demo.filter.JWTAuthenticationFilter;
    import com.demo.filter.JWTLoginFilter;
    import com.demo.handle.CustomAuthenticationFailureHandler;
    import com.demo.handle.Http401AuthenticationEntryPoint;
    import com.demo.service.UserService;
    import com.demo.service.impl.CustomAuthenticationProvider;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.builders.WebSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.config.http.SessionCreationPolicy;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    /**
     * SpringSecurity的配置
     * 通过SpringSecurity的配置，将JWTLoginFilter，JWTAuthenticationFilter组合在一起
     */
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true, prePostEnabled = true)
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        /**白名单
         * 需要放行的URL
         */
        private static final String[] AUTH_WHITELIST = {
                "/v2/api-docs",
                "/swagger-resources",
                "/swagger-resources/**",
                "/configuration/ui",
                "/configuration/security",
                "/swagger-ui.html",
                "/static",
                "/static/diagram-viewer",
                "/static/**",
                "/index.html",
                "/code/**",  //验证码
    
        };
    
        @Autowired
        private UserService userService;
    //    @Autowired
    //    private UserDetailsService jwtUserService;
    
    //    @Autowired
    //    private CustomAccessDeniedHandler customAccessDeniedHandler;
        @Autowired
        private CustomAuthenticationFailureHandler customAuthenticationFailureHandler;
    
    
        // 设置 HTTP 验证规则
        @Override
        protected void configure(HttpSecurity httpSecurity) throws Exception {
    
            httpSecurity.cors().and().csrf().disable()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
                    .authorizeRequests()
                    .anyRequest().authenticated()  // 所有请求需要身份认证
                    .and()
                    .exceptionHandling()
                    .authenticationEntryPoint(
                            new Http401AuthenticationEntryPoint())
                    .and()
                    .addFilterBefore(new JWTLoginFilter(authenticationManager(),customAuthenticationFailureHandler,userService), UsernamePasswordAuthenticationFilter.class)
                    .addFilterBefore(new JWTAuthenticationFilter(authenticationManager(),userService), UsernamePasswordAuthenticationFilter.class);
            //因为是spring整合了spring Security，本例加了session共享，每次检查原session的时候如果不存在的话，就会创建新的session，故需要手动设置
            httpSecurity.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);
    
        }
    
        // 该方法是登录的时候会进入
        @Override
        public void configure(AuthenticationManagerBuilder auth) throws Exception {
            // 使用自定义身份验证组件
            auth.authenticationProvider(new CustomAuthenticationProvider(userService));
        }
    
        @Override
        public void configure(WebSecurity web) throws Exception {
            web.ignoring().antMatchers(AUTH_WHITELIST);
        }
    
    }

9、拦截器：

1）登录拦截器：

package com.demo.filter;
    
    import com.alibaba.fastjson.JSON;
    import com.alibaba.fastjson.JSONObject;
    import com.demo.constants.CommonEnums;
    import com.demo.constants.Constants;
    import com.demo.dto.JwtAuthenticationRequest;
    import com.demo.dto.ResponseMessage;
    import com.demo.factory.ServiceFactory;
    import com.demo.handle.CustomAuthenticationFailureHandler;
    import com.demo.service.UserService;
    import com.demo.util.JwtProvider;
    import com.demo.util.RedisClient;
    import com.fasterxml.jackson.databind.ObjectMapper;
    import org.apache.commons.lang.StringUtils;
    import org.apache.http.entity.ContentType;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.authentication.BadCredentialsException;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.core.userdetails.UsernameNotFoundException;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import javax.servlet.http.HttpSession;
    import java.io.IOException;
    import java.util.ArrayList;
    import java.util.Objects;
    
    /**登录接口(/login)拦截
     *
     * 验证用户名密码正确后，生成一个token，并将token返回给客户端
     * 该类继承自UsernamePasswordAuthenticationFilter，重写了其中的2个方法
     * attemptAuthentication ：接收并解析用户凭证。
     * successfulAuthentication ：用户成功登录后，这个方法会被调用，我们在这个方法里生成token。
     */
    public class JWTLoginFilter extends UsernamePasswordAuthenticationFilter{
    
        private static Logger logger = LoggerFactory.getLogger(JWTLoginFilter.class);
        private AuthenticationManager authenticationManager;
        private CustomAuthenticationFailureHandler customAuthenticationFailureHandler;
        private UserService userService;
        private static  RedisClient redisClient;
    
        static {
            redisClient = ServiceFactory.getInstance().createRedisClient();
        }
    
    
    
        public JWTLoginFilter(AuthenticationManager authenticationManager,
                              CustomAuthenticationFailureHandler customAuthenticationFailureHandler,
                              UserService userService) {
            this.authenticationManager = authenticationManager;
            this.customAuthenticationFailureHandler = customAuthenticationFailureHandler;
            this.userService = userService;
            setAuthenticationManager(authenticationManager);
        }
    
        // 接收并解析用户凭证
        @Override
        public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {
            String userName = "";
            HttpSession httpSession = req.getSession();
    
            try {
                JwtAuthenticationRequest user = new ObjectMapper().readValue(req.getInputStream(), JwtAuthenticationRequest.class);
    
                //判断用户是否多次登录失败被锁定
                String lock = redisClient.get(Constants.LOCK+user.getUsername());
                if (StringUtils.isNotEmpty(lock)) {
                    httpSession.setAttribute("code",null);
                    Long time = redisClient.ttl(Constants.LOCK+user.getUsername());
                    res.setContentType(ContentType.APPLICATION_JSON.toString());
                    res.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_305.code, CommonEnums.CODE_305.message+":"+time+"秒后解锁")));
                    return null;
                }
    
    
                    //校验验证码
                if (StringUtils.isNotEmpty(user.getCode())){
                    if (!Objects.equals(user.getCode(),"1111")){
                        String code = (String) httpSession.getAttribute("code");
                        if(StringUtils.isEmpty(code)){
                            httpSession.setAttribute("code",null);
                            res.setContentType(ContentType.APPLICATION_JSON.toString());
                            res.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_405.code,CommonEnums.CODE_405.message)));
                            return null;
                        }
                        if (!Objects.equals(user.getCode().toLowerCase(),code.toLowerCase())){
                            httpSession.setAttribute("code",null);
                            res.setContentType(ContentType.APPLICATION_JSON.toString());
                            res.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_403.code,CommonEnums.CODE_403.message)));
                            return null;
                        }
                    }
                }else{
                    httpSession.setAttribute("code",null);
                    res.setContentType(ContentType.APPLICATION_JSON.toString());
                    res.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_405.code,CommonEnums.CODE_405.message)));
                }
                userName = user.getUsername();
                return authenticationManager.authenticate(
                        new UsernamePasswordAuthenticationToken(
                                user.getUsername(),
                                user.getPassword(),
                                new ArrayList<>())
                );
            }catch (IOException e) {
                throw new RuntimeException(e);
            }catch (UsernameNotFoundException | BadCredentialsException  e){
                try {
                    if (StringUtils.isNotEmpty(userName)){
                        String errorNum = redisClient.get(Constants.ERROR_NUM+userName);
                        if (StringUtils.isNotEmpty(errorNum)){
                            if (Objects.equals(errorNum,"3")){
                                httpSession.setAttribute("code",null);
                                redisClient.set(Constants.LOCK+userName,"true",120);
                                res.setContentType(ContentType.APPLICATION_JSON.toString());
                                res.getWriter().write(JSON.toJSONString(ResponseMessage.error(CommonEnums.CODE_305.code,CommonEnums.CODE_305.message+":120秒后解锁")));
                            }else{
                                httpSession.setAttribute("code",null);
                                redisClient.set(Constants.ERROR_NUM+userName,String.valueOf(Integer.valueOf(errorNum)+1),120);
                                customAuthenticationFailureHandler.onAuthenticationFailure(req,res,e);
                            }
                        }else{
                            httpSession.setAttribute("code",null);
                            redisClient.set(Constants.ERROR_NUM+userName,"1",120);
                            customAuthenticationFailureHandler.onAuthenticationFailure(req,res,e);
                        }
                    }else{
                        httpSession.setAttribute("code",null);
                        customAuthenticationFailureHandler.onAuthenticationFailure(req,res,e);
                    }
                } catch (Exception e1) {
                    throw new RuntimeException(e);
                }
                return null;
            }
        }
    
        // 用户成功登录后，这个方法会被调用，我们在这个方法里生成token
        @Override
        protected void successfulAuthentication(HttpServletRequest request,
                                                HttpServletResponse response,
                                                FilterChain chain,
                                                Authentication auth) throws IOException, ServletException {
            HttpSession httpSession = request.getSession();
            httpSession.setAttribute("code",null);
            redisClient.del(Constants.LOCK+auth.getName());
            redisClient.del(Constants.ERROR_NUM+auth.getName());
            String token = JwtProvider.addAuthentication(response, auth.getName());
            UserDetails userDetails = userService.loadUserByUsername(auth.getName());
            redisClient.set(Constants.JWT_USER+auth.getName(), JSONObject.toJSONString(userDetails));
            response.setContentType(ContentType.APPLICATION_JSON.toString());
            response.getWriter().write(JSON.toJSONString(ResponseMessage.success(CommonEnums.CODE_300.code,CommonEnums.CODE_300.message,token)));
        }
    
    }

2）非登录拦截器：

10、rest：

1）

package com.demo.rest;
    
    import com.demo.dto.ResponseMessage;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import javax.servlet.http.HttpSession;
    import java.util.Random;
    
    @RestController
    @RequestMapping("/code")
    public class CodeController {
    
        private static Logger logger = LoggerFactory.getLogger(CodeController.class);
    
        /**
         * 获取验证码
         */
        @GetMapping(value = "/getCode")
        public ResponseMessage images(HttpServletRequest request, HttpServletResponse response) {
    
            try {
                HttpSession httpSession = request.getSession();
                Random r = new Random();
                String code = String.valueOf(r.nextInt(100));
                httpSession.setAttribute("code",code);
                return ResponseMessage.success("验证码",code);
            } catch (Exception e) {
                logger.error("ValidateCodeController images ERROR MESSAGE={}", e.getMessage(), e);
            }
            return ResponseMessage.error("");
        }
    }

2）：

package com.demo.rest;
    
    import com.demo.constants.CommonEnums;
    import com.demo.constants.Constants;
    import com.demo.dto.AuthorityDTO;
    import com.demo.dto.JwtUser;
    import com.demo.dto.ResponseMessage;
    import com.demo.dto.UserDTO;
    import com.demo.service.UserService;
    import com.demo.util.RedisClient;
    import org.apache.commons.lang.StringUtils;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import java.util.List;
    
    @RequestMapping("/user")
    @RestController
    public class UserController {
    
        @Autowired
        private UserService userService;
    
        @Autowired
        private RedisClient redisClient;
    
        /**
         * 获取所有用户
         * @return
         */
        @RequestMapping("/getAllUsers")
        public ResponseMessage getAllUsers(){
            List<UserDTO>  users = userService.getAllUsers();
            return ResponseMessage.success(users);
        }
    
        /**
         * 获取权限
         */
        @RequestMapping("/getMyAuthorities")
        public ResponseMessage  getMyAuthorities(){
            JwtUser jwtUser = (JwtUser) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
            Integer currentUserId = jwtUser.getId();
            List<AuthorityDTO> authorityDTOS= userService.getAuthortiesByUserId(currentUserId);
            return ResponseMessage.success(authorityDTOS);
        }
    
        @GetMapping(value = "/logout")
        public ResponseMessage logout() {
            try{
                JwtUser jwtUser = (JwtUser)SecurityContextHolder.getContext().getAuthentication().getPrincipal();
                String userName = jwtUser.getUsername();
                if (StringUtils.isEmpty(userName)){
                    throw new RuntimeException(CommonEnums.CODE_303.message);
                }
                redisClient.del(Constants.TOKEN_JWT+userName);
            }catch (Exception e){
    
            }
            return ResponseMessage.success(CommonEnums.CODE_302.code,CommonEnums.CODE_302.message);
        }
    }

11、启动类：

package com.demo;
    
    import org.mybatis.spring.annotation.MapperScan;
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.boot.builder.SpringApplicationBuilder;
    import org.springframework.boot.web.support.SpringBootServletInitializer;
    
    @SpringBootApplication
    @MapperScan("com.demo.dao")
    public class SecurityApplication extends SpringBootServletInitializer {
    
        public static void main(String args[]){
            SpringApplication.run(SecurityApplication.class, args);
      }
    
    }

三、说明：

WebSecurityConfig继承了WebSecurityConfigurerAdapter，为配置入口，
    1、白名单直接放行，
    2、非白名单：
       (1)登录(/login)接口：
          登录拦截JWTLoginFilter.attemptAuthentication-->
          自定义登录CustomAuthenticationProvider-->
          登录成功返回token JWTLoginFilter.successfulAuthentication
       (2)非登录接口：
          拦截器JWTAuthenticationFilter校验token

2、单一点登录原理：

在JWTLoginFilter中可以看到，登录成功后需要返回token给前端，这个token是从addAuthentication方法获取的，JWT+redis可以实现token和用户id的互相取值，既可以根据token获取用户id，也可以根据用户id获取token。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 4][]

每次登录会刷新token，再次用原来的token调用系统接口token验证失败，前端一般会跳转到登录页，由此实现单一点登录。

由此，如果需要多点登录，每次登录成功后不重置token即可：

只需要这样修改：

Constants改下类型：

public static final int EXPIRATIONTIME = 1000 * 60 * 60 * 24 * 1; //单位毫秒，1 days

JWTProvider生成token的方法：

/**
         * 生成token并将token写入redis
         * @param res
         * @param username
         * @return
         */
        public static String addAuthentication(HttpServletResponse res, String username){
            String oldToken = redisClient.get(Constants.TOKEN_JWT+username);
            if(StringUtils.isNotEmpty(oldToken)){
                return oldToken;
            }
    
    
            String jwtStr = Jwts.builder()
                    .setSubject(username)
                    .setExpiration(new Date(System.currentTimeMillis() + Constants.EXPIRATIONTIME))
                    .signWith(SignatureAlgorithm.HS512, Constants.SECRET)
                    .compact();
            String tokent = jwtStr;
            res.addHeader(Constants.HEADER_STRING,tokent );
            //每次重置token，实现单点登录
            redisClient.set(Constants.TOKEN_JWT+username,tokent,Constants.EXPIRATIONTIME/1000);
            return tokent;
        }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200119151526807.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200119151414262.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200119151114575.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200119151241202.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200119170917704.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dfdF95X3k=,size_16,color_FFFFFF,t_70