• JWT -- Json Web token

    JWT 的背景知识可以看这篇文章: JSON Web Token 入门教程

    JWT 由三个部分组成：

    • Header（头部）
    • Payload（负载）
    • Signature（签名）

    在分布式系统下，存在跨session的问题，则使用JWT实现分布式下，身份验证的功能

    JWT有很多的第三方实现，Java JWT 类库对比及使用 - 简书，

    此处我们选择Auth0,此案例实现的功能如下

     认证中心

    1.         <dependency>
    2.             <groupId>org.springframework.bootgroupId>
    3.             <artifactId>spring-boot-starter-webartifactId>
    4.         dependency>
    5.  
    6.         <dependency>
    7.             <groupId>org.projectlombokgroupId>
    8.             <artifactId>lombokartifactId>
    9.         dependency>
    10.  
    11.         <dependency>
    12.             <groupId>com.auth0groupId>
    13.             <artifactId>java-jwtartifactId>
    14.             <version>3.8.3version>
    15.         dependency>

    配置:

    1. server:
    2.   port: 8080
    3.  
    4. jwt:
    5.   secret: "123321" #私钥
    6.   expireTime: 1 #JWT有效期,单位是分钟
    1. import lombok.Data;
    2. import org.springframework.boot.context.properties.ConfigurationProperties;
    3. import org.springframework.stereotype.Component;
    4.  
    5. @Data
    6. @Component
    7. @ConfigurationProperties(prefix = "jwt")
    8. public class JwtProperties {
    9.     private String secret;
    10.     private int expireTime;
    11. }

    自定义异常

    1. public class TokenUnavailableException extends RuntimeException{
    2.     public TokenUnavailableException(String message) {
    3.         super(message);
    4.     }
    5. }
    6.  
    7. import com.lb.bean.JwtResponse;
    8. import org.springframework.http.HttpStatus;
    9. import org.springframework.http.ResponseEntity;
    10. import org.springframework.web.bind.annotation.ExceptionHandler;
    11. import org.springframework.web.bind.annotation.RestControllerAdvice;
    12.  
    13. @RestControllerAdvice
    14. public class ExceptionAdvice {
    15.  
    16.     @ExceptionHandler(TokenUnavailableException.class)
    17.     private ResponseEntity handlerTokenUnavailableException(TokenUnavailableException e) {
    18.         return new ResponseEntity<>(JwtResponse.error(e.getMessage()), HttpStatus.BAD_REQUEST);
    19.     }
    20. }
      21.  

      JWT - 生成，检验
       

      1. package com.lb.config;
      2.  
      3. import com.auth0.jwt.JWT;
      4. import com.auth0.jwt.JWTCreator;
      5. import com.auth0.jwt.JWTVerifier;
      6. import com.auth0.jwt.algorithms.Algorithm;
      7. import com.auth0.jwt.exceptions.TokenExpiredException;
      8. import com.auth0.jwt.interfaces.DecodedJWT;
      9. import com.lb.bean.JwtResponse;
      10. import com.lb.exception.TokenUnavailableException;
      11. import org.springframework.beans.factory.annotation.Autowired;
      12. import org.springframework.stereotype.Component;
      13.  
      14. import java.time.LocalDateTime;
      15. import java.time.ZoneId;
      16. import java.util.Date;
      17. import java.util.Map;
      18.  
      19. @Component
      20. public class JwtService {
      21.  
      22.     @Autowired
      23.     JwtProperties jwtProperties;
      24.  
      25.     public String createToken(String subject, Map claimMap) {
      26.         JWTCreator.Builder builder = JWT.create()
      27. //                .withIssuer("")
      28. //                .withNotBefore(null)
      29. //                .withIssuedAt(null)
      30. //                .withAudience("")
      31.                 .withSubject(subject) //主题
      32.                 .withExpiresAt(Date.from(
      33.                         LocalDateTime.now().plusMinutes(jwtProperties.getExpireTime())
      34.                                 .atZone(ZoneId.systemDefault()).toInstant())
      35.                 );
      36.         claimMap.forEach(builder::withClaim);
      37.         return builder.sign(Algorithm.HMAC256(jwtProperties.getSecret()));
      38.     }
      39.  
      40.     public JwtResponse validateToken(String token) {
      41.         try {
      42.             JWTVerifier jwtVerifier =
      43.                     JWT.require(Algorithm.HMAC256(jwtProperties.getSecret()))
      44.                             .build();
      45.             DecodedJWT decodedJwt = jwtVerifier.verify(token);
      46.  
      47.             return JwtResponse.ok(decodedJwt.getClaims());
      48.         } catch (Exception e) {
      49.             //校验失败
      50.             throw new TokenUnavailableException(e.getMessage());
      51.         }
      52.     }
      53.  
      54.     public boolean isNeedUpdate(String token) {
      55.  
      56.         try {
      57.             Date expiresAt = JWT.require(Algorithm.HMAC256(jwtProperties.getSecret()))
      58.                     .build()
      59.                     .verify(token)
      60.                     .getExpiresAt();
      61.             // 需要更新 时间小于一半
      62.             return (expiresAt.getTime() - System.currentTimeMillis()) < ((jwtProperties.getExpireTime() * 60000) >> 1);
      63.         } catch (TokenExpiredException e) {
      64.             return true;
      65.         } catch (Exception e) {
      66.             //校验失败
      67.             throw new TokenUnavailableException(e.getMessage());
      68.         }
      69.     }
      70. }
       

      controller
       

      1. @RestController
      2. public class JwtController {
      3.     @Autowired
      4.     private JwtService jwtService;
      5.  
      6.     @PostMapping("create")
      7.     public ResponseEntity generateJwtToken(@RequestBody JwtRequest request) {
      8.         String token = jwtService.createToken(request.getSubject(), request.getClaimsMap());
      9.         return ResponseEntity.ok(token);
      10.     }
      11.  
      12.     @PostMapping("validate")
      13.     public ResponseEntity validateToken(@RequestParam String token) {
      14.         JwtResponse response = jwtService.validateToken(token);
      15.         return ResponseEntity.ok(response);
      16.     }
      17.  
      18.     @PostMapping("expire")
      19.     public ResponseEntity expire(@RequestParam String token) {
      20.         return ResponseEntity.ok(jwtService.isNeedUpdate(token));
      21.     }
      22. }
       

      客户端模块
       

      请求认证中心，生成token，验证token，更新token
       

      自定义注解，跳过JWT验证的API
       

      1. import java.lang.annotation.ElementType;
      2. import java.lang.annotation.Retention;
      3. import java.lang.annotation.RetentionPolicy;
      4. import java.lang.annotation.Target;
      5.  
      6. @Target(ElementType.METHOD)
      7. @Retention(RetentionPolicy.RUNTIME)
      8. public @interface PassToken {
      9.     boolean required() default true;
      10. }
       

      自定义拦截器，验证JWT
       

      1. package com.lb.interceptor;
      2.  
      3. import com.fasterxml.jackson.databind.ObjectMapper;
      4. import com.lb.annotation.PassToken;
      5. import com.lb.bean.JwtResponse;
      6. import com.lb.exception.JwtException;
      7. import com.lb.util.JwtHttpEntityUtil;
      8. import org.springframework.http.HttpEntity;
      9. import org.springframework.http.HttpStatus;
      10. import org.springframework.http.ResponseEntity;
      11. import org.springframework.util.StringUtils;
      12. import org.springframework.web.client.RestTemplate;
      13. import org.springframework.web.method.HandlerMethod;
      14. import org.springframework.web.servlet.HandlerInterceptor;
      15.  
      16. import javax.annotation.Resource;
      17. import javax.servlet.http.HttpServletRequest;
      18. import javax.servlet.http.HttpServletResponse;
      19. import java.lang.reflect.Method;
      20. import java.util.Map;
      21.  
      22.  
      23. public class JwtAuthenticationInterceptor implements HandlerInterceptor {
      24.     private static ObjectMapper MAPPER = new ObjectMapper();
      25.     @Resource(name = "facePlusRestTemplate")
      26.     RestTemplate restTemplate;
      27.  
      28.     @Override
      29.     public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
      30.         //如果不是映射到方法直接通过
      31.         if (!(handler instanceof HandlerMethod)) {
      32.             return true;
      33.         }
      34.         HandlerMethod handlerMethod = (HandlerMethod) handler;
      35.         Method method = handlerMethod.getMethod();
      36.         //检查时候包含passtoken注解
      37.         if (method.isAnnotationPresent(PassToken.class)) {
      38.             PassToken passToken = method.getAnnotation(PassToken.class);
      39.             if (passToken.required()) {
      40.                 return true;
      41.             }
      42.         }
      43.         String token = request.getHeader("Authorization");
      44.         if (StringUtils.isEmpty(token)) {
      45.             throw new JwtException(HttpStatus.UNAUTHORIZED, "token 不存在");
      46.         }
      47.         HttpEntity formEntity = JwtHttpEntityUtil.getValidateEntity(token);
      48.         ResponseEntity stringResponseEntity = restTemplate.postForEntity("http://localhost:8080/validate", formEntity, String.class);
      49.         if (stringResponseEntity == null) {
      50.             throw new JwtException(HttpStatus.SERVICE_UNAVAILABLE, "服务不可用，请稍后再试");
      51.         }
      52.         String body = stringResponseEntity.getBody();
      53.         JwtResponse jwtRes = MAPPER.readValue(body, JwtResponse.class);
      54.         if (!jwtRes.isFlag()) {
      55.             throw new JwtException(HttpStatus.UNAUTHORIZED, jwtRes.getMsg());
      56.         }
      57.         Map claimsMap = jwtRes.getClaimsMap();
      58.         request.setAttribute("claims", jwtRes.getClaimsMap());
      59.  
      60.         stringResponseEntity = restTemplate.postForEntity("http://localhost:8080/expire", formEntity, String.class);
      61.         if (stringResponseEntity != null && Boolean.parseBoolean(stringResponseEntity.getBody())) {
      62.             formEntity = JwtHttpEntityUtil.getCreateTokenEntity(claimsMap.get("sub"), claimsMap.get("pwd"));
      63.             token = restTemplate.postForObject("http://localhost:8080/create", formEntity, String.class);
      64.             response.setHeader("token", token);
      65.         }
      66.         return true;
      67.     }
      68. }
       

      注册拦截器
       

      1. import com.lb.exception.FacePlusThrowErrorHandler;
      2. import com.lb.interceptor.JwtAuthenticationInterceptor;
      3. import org.springframework.context.annotation.Bean;
      4. import org.springframework.context.annotation.Configuration;
      5. import org.springframework.http.client.ClientHttpRequestFactory;
      6. import org.springframework.http.client.SimpleClientHttpRequestFactory;
      7. import org.springframework.http.converter.FormHttpMessageConverter;
      8. import org.springframework.http.converter.StringHttpMessageConverter;
      9. import org.springframework.web.client.RestTemplate;
      10. import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
      11. import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
      12.  
      13. import java.nio.charset.StandardCharsets;
      14.  
      15. @Configuration
      16. public class ApplicationConfig implements WebMvcConfigurer {
      17.     @Bean
      18.     public RestTemplate restTemplate(ClientHttpRequestFactory factory) {
      19.         return new RestTemplate(factory);
      20.     }
      21.  
      22.     @Bean
      23.     public ClientHttpRequestFactory simpleClientHttpRequestFactory() {
      24.         SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
      25.         factory.setReadTimeout(5000);
      26.         factory.setConnectTimeout(15000);
      27.         return factory;
      28.     }
      29.  
      30.     @Override
      31.     public void addInterceptors(InterceptorRegistry registry) {
      32.         //拦截所有请求
      33.         registry.addInterceptor(jwtAuthenticationInterceptor()).addPathPatterns("/**");
      34.     }
      35.  
      36.     @Bean
      37.     public JwtAuthenticationInterceptor jwtAuthenticationInterceptor() {
      38.         return new JwtAuthenticationInterceptor();
      39.     }
      40.     
      41.     //自定义处理400,500返回
      42.     @Bean
      43.     public RestTemplate facePlusRestTemplate(ClientHttpRequestFactory factory) {
      44.         RestTemplate restTemplate = new RestTemplate(factory);
      45.         restTemplate.getMessageConverters().set(1, new StringHttpMessageConverter(StandardCharsets.UTF_8));
      46.         restTemplate.getMessageConverters().add(new FormHttpMessageConverter());
      47.         restTemplate.setErrorHandler(new FacePlusThrowErrorHandler());
      48.         return restTemplate;
      49.     }
      50. }
       

      1. import org.springframework.http.client.ClientHttpResponse;
      2. import org.springframework.web.client.ResponseErrorHandler;
      3.  
      4. import java.io.IOException;
      5.  
      6. public class FacePlusThrowErrorHandler  implements ResponseErrorHandler {
      7.     @Override
      8.     public boolean hasError(ClientHttpResponse response) throws IOException {
      9.         return false;
      10.     }
      11.  
      12.     @Override
      13.     public void handleError(ClientHttpResponse response) throws IOException {
      14.         throw new JwtException(response.getStatusCode(), response.getBody().toString());
      15.     }
      16. }
       

      1. import com.fasterxml.jackson.core.JsonProcessingException;
      2. import com.fasterxml.jackson.databind.ObjectMapper;
      3. import org.springframework.http.HttpEntity;
      4. import org.springframework.http.HttpHeaders;
      5. import org.springframework.http.MediaType;
      6. import org.springframework.util.LinkedMultiValueMap;
      7. import org.springframework.util.MultiValueMap;
      8.  
      9. import java.util.HashMap;
      10. import java.util.Map;
      11.  
      12. public class JwtHttpEntityUtil {
      13.     private static ObjectMapper MAPPER = new ObjectMapper();
      14.     public static HttpEntity getCreateTokenEntity(String userName, String password) throws JsonProcessingException {
      15.         HttpHeaders headers = new HttpHeaders();
      16.         MediaType type = MediaType.parseMediaType("application/json; charset=UTF-8");
      17.         headers.setContentType(type);
      18.         headers.add("Accept", MediaType.APPLICATION_JSON.toString());
      19.         HashMap map = new HashMap<>();
      20.         map.put("subject", userName);
      21.         Map calims = new HashMap<>();
      22.         calims.put("pwd", password);
      23.         map.put("claimsMap", calims);
      24.         String stu = MAPPER.writeValueAsString(map);
      25.         return new HttpEntity(stu, headers);
      26.     }
      27.  
      28.     public static HttpEntity getValidateEntity(String token) throws JsonProcessingException {
      29.         MultiValueMap paramMap = new LinkedMultiValueMap();
      30.         paramMap.set("token",token);
      31.         //2、添加请求头
      32.         HttpHeaders headers = new HttpHeaders();
      33.         headers.add("Content-Type","application/x-www-form-urlencoded");
      34.         return new HttpEntity(paramMap, headers);
      35.     }
      36. }
       

      客户端Controller 
       

      1. @RestController
      2. public class MyController {
      3.  
      4.     @Autowired
      5.     RestTemplate restTemplate;
      6.  
      7.     @PassToken
      8.     @PostMapping("login")
      9.     public String login(String userName, String password, HttpServletResponse response) throws JsonProcessingException {
      10.         //模拟数据库查询用户
      11.         if ("admin".equals(userName) && "admin".equals(password)) {
      12.             HttpEntity formEntity = JwtHttpEntityUtil.getCreateTokenEntity(userName, password);
      13.             String token = restTemplate.postForObject("http://localhost:8080/create", formEntity, String.class);
      14.             response.setHeader("token", token);
      15.             return "登陆成功";
      16.         } else {
      17.             return "用户名密码不正确";
      18.         }
      19.     }
      20.  
      21.     @GetMapping("test")
      22.     public String test(HttpServletRequest request) {
      23.         return request.getAttribute("claims").toString();
      24.     }
      25. }
       

      以上代码省略了 异常类和异常处理类
       

      结果
       

       create API -- 拦截器放行login API，并返回token
       

       
       

       validate 、expire API -- 验证和更新token
       

       

       
 
       以上案例是为了，实现注册中心是单独服务，如果不需要它是单独的服务，直接在项目内提供工具类直接生成token，以及token的验证。更加简单
       

      
                
                    
                

                
    21. 

                    相关阅读:
      
                    
EMQX 实践                            
      
UnityAPI学习之碰撞检测与触发检测                            
      
java实验（头歌）--面向对象封装继承和多态                            
      
Integer和int 的区别                            
      
洛谷P1162 填涂颜色                            
      
电气基础——电源、变压器、接触器、断路器、线缆                            
      
RBF神经网络python实践学习（BP算法）                            
      
一级造价工程师（安装）- 计量笔记 - 重点必考考点                            
      
react评论列表连接数据库                            
      
centos7 安装与卸载 Mysql 5.7.27(详细完整教程）                            
      
                          
                
      22. 
                
    22. 
                    原文地址：https://blog.csdn.net/qq_33753147/article/details/128080876
                
      23.