如何创建public class JwtAuthenticationWebFilter extends AuthenticationWebFilter

引自免费微信小程序：皆我百晓生

为了创建一个名为 JwtAuthenticationWebFilter 的类，它扩展了 Spring Security 的 AuthenticationWebFilter 类，你需要按照下面的步骤进行操作。

首先确保你的项目已经添加了Spring Boot和Spring Security依赖。如果你正在使用Maven，可以在pom.xml文件中添加以下依赖：

    
        org.springframework.boot
        spring-boot-starter-security
    

接下来，创建一个新的Java类，命名为 JwtAuthenticationWebFilter，并继承自 AuthenticationWebFilter。在类中，你需要覆盖一些方法以便处理JWT（JSON Web Tokens）的身份验证。这里是一个基本的示例：

import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.util.Assert;
import reactor.core.publisher.Mono;

import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class JwtAuthenticationWebFilter extends AuthenticationWebFilter {

    private final JwtTokenProvider jwtTokenProvider;

    public JwtAuthenticationWebFilter(JwtTokenProvider jwtTokenProvider) {
        super(new WebAuthenticationDetailsSource());
        this.jwtTokenProvider = Assert.notNull(jwtTokenProvider, "jwtTokenProvider cannot be null");
    }

    @Override
    protected Mono attemptAuthentication(HttpServletRequest request, FilterChain filterChain) throws IOException {
        String authToken = jwtTokenProvider.getTokenFromRequest(request);
        if (authToken != null && jwtTokenProvider.validateToken(authToken)) {
            return Mono.just(jwtTokenProvider.getAuthentication(authToken));
        }
        return Mono.empty();
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
                                            FilterChain chain, Authentication authResult) throws IOException {
        // If you want to add custom logic on successful authentication, do it here.
        super.successfulAuthentication(request, response, chain, authResult);
    }
}

在这个例子中，我们假设有一个 JwtTokenProvider 类，它是用于解析、验证和从请求头中提取JWT的工具类。你需要根据实际需求实现这个类。这是一个简单的 JwtTokenProvider 示例：

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.stereotype.Component;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

@Component
public class JwtTokenProvider {

    private static final String SECRET_KEY = "your_secret_key";
    private static final long EXPIRATION_TIME_IN_SECONDS = 86400; // 1 day in seconds
    private static final String JWT_HEADER_NAME = "Authorization";

    public String generateToken(String username) {
        Map claims = new HashMap<>();
        claims.put("username", username);

        Date now = new Date();
        Date expiration = new Date(now.getTime() + EXPIRATION_TIME_IN_SECONDS * 1000L);

        return Jwts.builder()
                .setClaims(claims)
                .setSubject(username)
                .setIssuedAt(now)
                .setExpiration(expiration)
                .signWith(SignatureAlgorithm.HS256, SECRET_KEY)
                .compact();
    }

    public String getTokenFromRequest(HttpServletRequest request) {
        String headerValue = request.getHeader(JWT_HEADER_NAME);
        if (headerValue != null && headerValue.startsWith("Bearer ")) {
            return headerValue.substring(7); // Remove "Bearer " prefix
        }
        return null;
    }

    public boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
            return true;
        } catch (Exception e) {
            return false;
        }
    }

    public Authentication getAuthentication(String token) {
        Claims claims = Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();

        return new UsernamePasswordAuthenticationToken(claims.getString("username"), null, Collections.emptyList());
    }
}

注意：这里的SECRET_KEY是硬编码的，并且签名算法使用的是HS256，这在生产环境中并不安全。你应该考虑使用环境变量或密钥管理服务来存储秘钥，并可能使用更安全的签名算法。

要将此过滤器应用到Spring Security配置中，你需要在主配置类中注册它：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public JwtTokenProvider jwtTokenProvider() {
        return new JwtTokenProvider();
    }

    @Bean
    public JwtAuthenticationWebFilter jwtAuthenticationWebFilter(JwtTokenProvider jwtTokenProvider) {
        return new JwtAuthenticationWebFilter(jwtTokenProvider);
    }

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http
            .authorizeExchange()
                .anyExchange().authenticated()
                .and()
            .addFilterBefore(jwtAuthenticationWebFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
            .csrf().disable(); // Depending on your application needs, consider enabling CSRF protection

        return http.build();
    }
}

这段代码告诉Spring Security使用你定义的 JwtAuthenticationWebFilter 进行身份验证。同时，你也应该为其他资源设置适当的访问控制规则。

这就是创建一个基于JWT的身份验证Web过滤器的基本过程。根据你的具体需求，你可能需要对这些类进行修改和扩展。