• Springboot整合Shiro+JWT实现认证授权

    1.Shiro用来认证用户及权限控制，jwt用来生成一个token令牌，暂存用户信息。令牌存储在客户端，用户每次请求将其放在header中，在每个服务器节点进行验证。

    2.导入依赖库：

    1. <dependency>
    2. 	<groupId>org.apache.shirogroupId>
    3. 	<artifactId>shiro-webartifactId>
    4. 	<version>1.5.3version>
    5. dependency>
    6. <dependency>
    7. 	<groupId>org.apache.shirogroupId>
    8. 	<artifactId>shiro-springartifactId>
    9. 	<version>1.5.3version>
    10. dependency>
    11. <dependency>
    12. 	<groupId>com.auth0groupId>
    13. 	<artifactId>java-jwtartifactId>
    14. 	<version>3.10.3version>
    15. dependency>
    16. <dependency>
    17. 	<groupId>org.springframework.bootgroupId>
    18. 	<artifactId>spring-boot-configuration-processorartifactId>
    19. 	<optional>trueoptional>
    20. dependency>
    21. <dependency>
    22. 	<groupId>org.apache.commonsgroupId>
    23. 	<artifactId>commons-lang3artifactId>
    24. 	<version>3.11version>
    25. dependency>
    26. <dependency>
    27. 	<groupId>org.apache.httpcomponentsgroupId>
    28. 	<artifactId>httpcoreartifactId>
    29. 	<version>4.4.13version>
    30. dependency>
    31. <dependency>
    32. 	<groupId>org.springframework.bootgroupId>
    33. 	<artifactId>spring-boot-starter-aopartifactId>
    34. dependency>

    3.定义密钥和过期时间

    这个过程一般在springboot配置文件中进行编辑，然后再注入到Javabean中，维护起来方便。

    1. emos:
    2.   jwt:
    3.     #密钥
    4.     secret: abc123456
    5.     #令牌过期时间（天）
    6.     expire:  5
    7.     #令牌缓存时间（天数）
    8.     cache-expire: 10

    4.创建JWT工具类

    可以创建一个shiro包，然后再创建类，该类主要方法包括创建token,获得token用户id,验证token

    1. package com.example.emos.wx.config.shiro;
    2.  
    3. import cn.hutool.core.date.DateField;
    4. import cn.hutool.core.date.DateUtil;
    5. import com.auth0.jwt.JWT;
    6. import com.auth0.jwt.JWTCreator;
    7. import com.auth0.jwt.JWTVerifier;
    8. import com.auth0.jwt.algorithms.Algorithm;
    9. import com.auth0.jwt.interfaces.DecodedJWT;
    10. import com.example.emos.wx.exception.EmosException;
    11. import lombok.extern.slf4j.Slf4j;
    12. import org.springframework.beans.factory.annotation.Value;
    13. import org.springframework.stereotype.Component;
    14.  
    15. import java.util.Date;
    16.  
    17. @Component
    18. @Slf4j
    19. public class JwtUtil {
    20.  
    21.     //密钥
    22.     @Value("${emos.jwt.secret}")
    23.     private String secret;
    24.  
    25.     //过期时间（天）
    26.     @Value("${emos.jwt.expire}")
    27.     private int expire;
    28.  
    29.     public String createToken(int userId) {
    30.         Date date = DateUtil.offset(new Date(), DateField.DAY_OF_YEAR, expire).toJdkDate();
    31.         Algorithm algorithm = Algorithm.HMAC256(secret); //创建加密算法对象
    32.         JWTCreator.Builder builder = JWT.create();
    33.         String token = builder.withClaim("userId", userId).withExpiresAt(date).sign(algorithm);
    34.         return token;
    35.     }
    36.  
    37.  
    38.     public int getUserId(String token) {
    39.         try {
    40.             DecodedJWT jwt = JWT.decode(token);
    41.             return jwt.getClaim("userId").asInt();
    42.         } catch (Exception e) {
    43.             throw new EmosException("令牌无效");
    44.         }
    45.     }
    46.  
    47.     public void verifierToken(String token) {
    48.         Algorithm algorithm = Algorithm.HMAC256(secret); //创建加密算法对象
    49.         JWTVerifier verifier = JWT.require(algorithm).build();
    50.         verifier.verify(token);
    51.     }
    52.  
    53. }
    54.

    5.把令牌封装成认证对象

    因为Shiro框架认证需要用到认证对象，把令牌字符串做简单的封装。客户端提交的token不能直接交给Shiro框架，需要向封装成AuthenticationToken类型的对象。

    1. package com.example.emos.wx.config.shiro;
    2.  
    3. import org.apache.shiro.authc.AuthenticationToken;
    4.  
    5. public class OAuth2Token implements AuthenticationToken {
    6.     private String token;
    7.  
    8.     public OAuth2Token(String token){
    9.         this.token = token;
    10.     }
    11.  
    12.     @Override
    13.     public Object getPrincipal() {
    14.         return token;
    15.     }
    16.  
    17.     @Override
    18.     public Object getCredentials() {
    19.         return token;
    20.     }
    21. }
    22.

    6.创建OAuth2Realm类，实现AuthorizingRealm接口

    1. package com.example.emos.wx.config.shiro;
    2.  
    3. import org.apache.shiro.authc.*;
    4. import org.apache.shiro.authz.AuthorizationInfo;
    5. import org.apache.shiro.authz.SimpleAuthorizationInfo;
    6. import org.apache.shiro.realm.AuthorizingRealm;
    7. import org.apache.shiro.subject.PrincipalCollection;
    8. import org.springframework.beans.factory.annotation.Autowired;
    9. import org.springframework.stereotype.Component;
    10.  
    11. import java.util.Set;
    12.  
    13. @Component
    14. public class OAuth2Realm extends AuthorizingRealm {
    15.  
    16.     @Autowired
    17.     private JwtUtil jwtUtil;
    18.  
    19.  
    20.     @Override
    21.     public boolean supports(AuthenticationToken token) {
    22.         return token instanceof OAuth2Token;
    23.     }
    24.  
    25.     /**
    26.      * 授权(验证权限时调用)
    27.      */
    28.     @Override
    29.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    30.  
    31.         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    32.         //TODO 查询用户的权限列表
    33.         //TODO 把权限列表添加到info对象中
    34.         return info;
    35.     }
    36.  
    37.     /**
    38.      * 认证(登录时调用)
    39.      */
    40.     @Override
    41.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    42.         //TODO 从令牌中获取userId，然后检测该账户是否被冻结。
    43.         SimpleAuthenticationInfo info = new SimpleAuthenticationInfo();
    44.         //TODO 往info对象中添加用户信息、Token字符串
    45.         return info;
    46.     }
    47. }

    7.刷新令牌如何设计？

    一个是采用短令牌和长令牌的双令牌机制；一个是采用redis缓存令牌机制。更常用第二种;

     

     

     8.创建ThreadLocalToken类

    1. package com.example.emos.wx.config.shiro;
    2.  
    3. import org.springframework.stereotype.Component;
    4.  
    5. @Component
    6. public class ThreadLocalToken {
    7.     private ThreadLocal local=new ThreadLocal();
    8.  
    9.     public void setToken(String token){
    10.         local.set(token);
    11.     }
    12.  
    13.     public String getToken(){
    14.         return (String) local.get();
    15.     }
    16.  
    17.     public void clear(){
    18.         local.remove();
    19.     }
    20. }
    21.

    9.创建OAuth2Filter类

     

    1. emos:
    2.   jwt:
    3.     #密钥
    4.     secret: abc123456
    5.     #令牌过期时间（天）
    6.     expire:  5
    7.     #令牌缓存时间（天数）
    8.     cache-expire: 10
    1. package com.example.emos.wx.config.shiro;
    2.  
    3. import com.auth0.jwt.exceptions.JWTDecodeException;
    4. import com.auth0.jwt.exceptions.TokenExpiredException;
    5. import org.apache.commons.lang3.StringUtils;
    6. import org.apache.http.HttpStatus;
    7. import org.apache.shiro.authc.AuthenticationException;
    8. import org.apache.shiro.authc.AuthenticationToken;
    9. import org.apache.shiro.web.filter.authc.AuthenticatingFilter;
    10. import org.springframework.beans.factory.annotation.Autowired;
    11. import org.springframework.beans.factory.annotation.Value;
    12. import org.springframework.context.annotation.Scope;
    13. import org.springframework.data.redis.core.RedisTemplate;
    14. import org.springframework.stereotype.Component;
    15. import org.springframework.web.bind.annotation.RequestMethod;
    16.  
    17. import javax.servlet.FilterChain;
    18. import javax.servlet.ServletException;
    19. import javax.servlet.ServletRequest;
    20. import javax.servlet.ServletResponse;
    21. import javax.servlet.http.HttpServletRequest;
    22. import javax.servlet.http.HttpServletResponse;
    23. import java.io.IOException;
    24. import java.util.concurrent.TimeUnit;
    25.  
    26. @Component
    27. @Scope("prototype")
    28. public class OAuth2Filter extends AuthenticatingFilter {
    29.     @Autowired
    30.     private ThreadLocalToken threadLocalToken;
    31.  
    32.     @Value("${emos.jwt.cache-expire}")
    33.     private int cacheExpire;
    34.  
    35.     @Autowired
    36.     private JwtUtil jwtUtil;
    37.     @Autowired
    38.     private RedisTemplate redisTemplate;
    39.  
    40.     /**
    41. 	 * 拦截请求之后，用于把令牌字符串封装成令牌对象
    42. 	 */
    43. 	@Override
    44.     protected AuthenticationToken createToken(ServletRequest request, 
    45. 		ServletResponse response) throws Exception {
    46.         //获取请求token
    47.         String token = getRequestToken((HttpServletRequest) request);
    48.  
    49.         if (StringUtils.isBlank(token)) {
    50.             return null;
    51.         }
    52.  
    53.         return new OAuth2Token(token);
    54.     }
    55.  
    56.     /**
    57. 	 * 拦截请求，判断请求是否需要被Shiro处理
    58. 	 */
    59.     @Override
    60.     protected boolean isAccessAllowed(ServletRequest request, 
    61. 		ServletResponse response, Object mappedValue) {
    62.         HttpServletRequest req = (HttpServletRequest) request;
    63.         // Ajax提交application/json数据的时候，会先发出Options请求
    64. 		// 这里要放行Options请求，不需要Shiro处理
    65. 		if (req.getMethod().equals(RequestMethod.OPTIONS.name())) {
    66.             return true;
    67.         }
    68. 		// 除了Options请求之外，所有请求都要被Shiro处理
    69.         return false;
    70.     }
    71.  
    72.     /**
    73. 	 * 该方法用于处理所有应该被Shiro处理的请求
    74. 	 */
    75.     @Override
    76.     protected boolean onAccessDenied(ServletRequest request, 
    77. 		ServletResponse response) throws Exception {
    78.         HttpServletRequest req = (HttpServletRequest) request;
    79.         HttpServletResponse resp = (HttpServletResponse) response;
    80.  
    81. 		resp.setHeader("Content-Type", "text/html;charset=UTF-8");
    82. 		//允许跨域请求
    83.         resp.setHeader("Access-Control-Allow-Credentials", "true");
    84.         resp.setHeader("Access-Control-Allow-Origin", req.getHeader("Origin"));
    85.  
    86. 		threadLocalToken.clear();
    87.         //获取请求token，如果token不存在，直接返回401
    88.         String token = getRequestToken((HttpServletRequest) request);
    89.         if (StringUtils.isBlank(token)) {
    90.             resp.setStatus(HttpStatus.SC_UNAUTHORIZED);
    91.             resp.getWriter().print("无效的令牌");
    92.             return false;
    93.         }
    94. 		
    95.         try {
    96.             jwtUtil.verifierToken(token); //检查令牌是否过期
    97.         } catch (TokenExpiredException e) {
    98.             //客户端令牌过期，查询Redis中是否存在令牌，如果存在令牌就重新生成一个令牌给客户端
    99.             if (redisTemplate.hasKey(token)) {
    100.                 redisTemplate.delete(token);//删除令牌
    101.                 int userId = jwtUtil.getUserId(token);
    102.                 token = jwtUtil.createToken(userId);  //生成新的令牌
    103.                 //把新的令牌保存到Redis中
    104.                 redisTemplate.opsForValue().set(token, userId + "", cacheExpire, TimeUnit.DAYS);
    105.                 //把新令牌绑定到线程
    106.                 threadLocalToken.setToken(token);
    107.             } else {
    108.                 //如果Redis不存在令牌，让用户重新登录
    109.                 resp.setStatus(HttpStatus.SC_UNAUTHORIZED);
    110.                 resp.getWriter().print("令牌已经过期");
    111.                 return false;
    112.             }
    113.  
    114.         } catch (JWTDecodeException e) {
    115.             resp.setStatus(HttpStatus.SC_UNAUTHORIZED);
    116.             resp.getWriter().print("无效的令牌");
    117.             return false;
    118.         }
    119.  
    120.         boolean bool = executeLogin(request, response);
    121.         return bool;
    122.     }
    123.  
    124.     @Override
    125.     protected boolean onLoginFailure(AuthenticationToken token,
    126. 		AuthenticationException e, ServletRequest request, ServletResponse response) {
    127.         HttpServletRequest req = (HttpServletRequest) request;
    128.         HttpServletResponse resp = (HttpServletResponse) response;
    129.         resp.setStatus(HttpStatus.SC_UNAUTHORIZED);
    130.         resp.setContentType("application/json;charset=utf-8");
    131.         resp.setHeader("Access-Control-Allow-Credentials", "true");
    132.         resp.setHeader("Access-Control-Allow-Origin", req.getHeader("Origin"));
    133.         try {
    134.             resp.getWriter().print(e.getMessage());
    135.         } catch (IOException exception) {
    136.  
    137.         }
    138.         return false;
    139.     }
    140.  
    141.     /**
    142.      * 获取请求头里面的token
    143.      */
    144.     private String getRequestToken(HttpServletRequest httpRequest) {
    145.         //从header中获取token
    146.         String token = httpRequest.getHeader("token");
    147.  
    148.         //如果header中不存在token，则从参数中获取token
    149.         if (StringUtils.isBlank(token)) {
    150.             token = httpRequest.getParameter("token");
    151.         }
    152.         return token;
    153.  
    154.     }
    155.  
    156.     @Override
    157.     public void doFilterInternal(ServletRequest request, 
    158. 		ServletResponse response, FilterChain chain) throws ServletException, IOException {
    159.         super.doFilterInternal(request, response, chain);
    160.     }
    161. }
    162.

    10.创建ShiroConfig类

     

    1. package com.example.emos.wx.config.shiro;
    2.  
    3. import org.apache.shiro.mgt.SecurityManager;
    4. import org.apache.shiro.spring.LifecycleBeanPostProcessor;
    5. import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    6. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    7. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    8. import org.springframework.context.annotation.Bean;
    9. import org.springframework.context.annotation.Configuration;
    10.  
    11. import javax.servlet.Filter;
    12. import java.util.HashMap;
    13. import java.util.LinkedHashMap;
    14. import java.util.Map;
    15.  
    16. @Configuration
    17. public class ShiroConfig {
    18.  
    19.     @Bean("securityManager")
    20.     public SecurityManager securityManager(OAuth2Realm oAuth2Realm) {
    21.         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    22.         securityManager.setRealm(oAuth2Realm);
    23.         securityManager.setRememberMeManager(null);
    24.         return securityManager;
    25.     }
    26.  
    27.     @Bean("shiroFilter")
    28.     public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager,OAuth2Filter oAuth2Filter) {
    29.         ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    30.         shiroFilter.setSecurityManager(securityManager);
    31.  
    32.         //oauth过滤
    33.         Map filters = new HashMap<>();
    34.         filters.put("oauth2", oAuth2Filter);
    35.         shiroFilter.setFilters(filters);
    36.  
    37.         Map filterMap = new LinkedHashMap<>();
    38.         filterMap.put("/webjars/**", "anon");
    39.         filterMap.put("/druid/**", "anon");
    40.         filterMap.put("/app/**", "anon");
    41.         filterMap.put("/sys/login", "anon");
    42.         filterMap.put("/swagger/**", "anon");
    43.         filterMap.put("/v2/api-docs", "anon");
    44.         filterMap.put("/swagger-ui.html", "anon");
    45.         filterMap.put("/swagger-resources/**", "anon");
    46.         filterMap.put("/captcha.jpg", "anon");
    47.         filterMap.put("/user/register", "anon");
    48.         filterMap.put("/user/login", "anon");
    49.         filterMap.put("/test/**", "anon");
    50.         filterMap.put("/**", "oauth2");
    51.         shiroFilter.setFilterChainDefinitionMap(filterMap);
    52.         return shiroFilter;
    53.     }
    54.  
    55.     @Bean("lifecycleBeanPostProcessor")
    56.     public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
    57.         return new LifecycleBeanPostProcessor();
    58.     }
    59.  
    60.     @Bean
    61.     public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
    62.         AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
    63.         advisor.setSecurityManager(securityManager);
    64.         return advisor;
    65.     }
    66.  
    67. }
    68.  
    69.  
    70.

    11.利用aop，把更新的令牌返回给客户端

     

    1. package com.example.emos.wx.aop;
    2.  
    3. import com.example.emos.wx.common.util.R;
    4. import com.example.emos.wx.config.shiro.ThreadLocalToken;
    5. import org.aspectj.lang.ProceedingJoinPoint;
    6. import org.aspectj.lang.annotation.Around;
    7. import org.aspectj.lang.annotation.Aspect;
    8. import org.aspectj.lang.annotation.Pointcut;
    9. import org.springframework.beans.factory.annotation.Autowired;
    10. import org.springframework.stereotype.Component;
    11.  
    12. @Aspect
    13. @Component
    14. public class TokenAspect {
    15.  
    16.     @Autowired
    17.     private ThreadLocalToken threadLocalToken;
    18.  
    19.     @Pointcut("execution(public * com.example.emos.wx.controller.*.*(..)))")
    20.     public void aspect() {
    22.     }
    24.     @Around("aspect()")
    25.     public Object around(ProceedingJoinPoint point) throws Throwable {
    26.         R r = (R) point.proceed(); //方法执行结果
    27.         String token = threadLocalToken.getToken();
    28.         //如果ThreadLocal中存在Token，说明是更新的Token
    29.         if (token != null) {
    30.             r.put("token", token); //往响应中放置Token
    31.             threadLocalToken.clear();
    32.         }
    33.         return r;
    34.     }
    35. }

    12.返回给客户端的异常精简化，进行测试

    1. package com.example.emos.wx.config;
    2.  
    3. import com.example.emos.wx.exception.EmosException;
    4. import lombok.extern.slf4j.Slf4j;
    5. import org.springframework.http.HttpStatus;
    6. import org.springframework.web.bind.MethodArgumentNotValidException;
    7. import org.springframework.web.bind.annotation.ExceptionHandler;
    8. import org.springframework.web.bind.annotation.ResponseBody;
    9. import org.springframework.web.bind.annotation.ResponseStatus;
    10. import org.springframework.web.bind.annotation.RestControllerAdvice;
    11.  
    12. @Slf4j
    13. @RestControllerAdvice
    14. public class ExceptionAdvice {
    15.  
    16.     @ResponseBody
    17.     @ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
    18.     @ExceptionHandler(Exception.class)
    19.     public String validExceptionHandler(Exception e) {
    20.         log.error("执行异常",e);
    21.         if (e instanceof MethodArgumentNotValidException) {
    22.             MethodArgumentNotValidException exception = (MethodArgumentNotValidException) e;
    23.             //将错误信息返回给前台
    24.             return exception.getBindingResult().getFieldError().getDefaultMessage();
    25.         }
    26.         else if(e instanceof EmosException){
    27.             EmosException exception=(EmosException)e;
    28.             return exception.getMsg();
    29.         }
    30.         else if(e instanceof UnauthorizedException){
    31.             return "你不具有相关权限";
    32.         }
    33.         else {
    34.             return "后端执行异常";
    35.         }
    36.  
    37.     }
    38.  
    39. }
    40.

  • 相关阅读:
    7-10 LinkedHashSet
    FPGA按键消抖
    一个产品级MCU菜单框架设计
    光学设计相关知识概念（持续更新中）
    render() 函数即渲染函数 转换器 converter JS函数用于获取url参数:
    程序员个性终端指南（cmder、powershell、window terminal）
    数据库自动备份到gitee上，实现数据自动化备份
    分布式文件系统HDFS实践及原理详解part3
    CSS旋转、缩放、渐变
    IDM下载器使用教程
  • 原文地址：https://blog.csdn.net/qq_35207086/article/details/126657142