简介
json web token（缩写 jwt）是目前最流行的跨域认证解决方案。json web token 入门教程 这篇文章可以帮你了解jwt的概念。本文重点讲解spring boot 结合 jwt ，来实现前后端分离中，接口的安全调用。
spring security，这是一种基于 spring aop 和 servlet 过滤器的安全框架。它提供全面的安全性解决方案，同时在 web 请求级和方法调用级处理身份确认和授权。
快速上手
之前的文章已经对 spring security 进行了讲解，这一节对涉及到 spring security 的配置不详细讲解。若不了解 spring security 先移步到 spring boot security 详解。
建表
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
drop table if exists `user`;drop table if exists `role`;drop table if exists `user_role`;drop table if exists `role_permission`;drop table if exists `permission`;create table `user` (`id` bigint(11) not null auto_increment,`username` varchar(255) not null,`password` varchar(255) not null,primary key (`id`) );create table `role` (`id` bigint(11) not null auto_increment,`name` varchar(255) not null,primary key (`id`) );create table `user_role` (`user_id` bigint(11) not null,`role_id` bigint(11) not null);create table `role_permission` (`role_id` bigint(11) not null,`permission_id` bigint(11) not null);create table `permission` (`id` bigint(11) not null auto_increment,`url` varchar(255) not null,`name` varchar(255) not null,`description` varchar(255) null,`pid` bigint(11) not null,primary key (`id`) );insert into user (id, username, password) values (1,'user','e10adc3949ba59abbe56e057f20f883e'); insert into user (id, username , password) values (2,'admin','e10adc3949ba59abbe56e057f20f883e'); insert into role (id, name) values (1,'user');insert into role (id, name) values (2,'admin');insert into permission (id, url, name, pid) values (1,'/user/hi','',0);insert into permission (id, url, name, pid) values (2,'/admin/hi','',0);insert into user_role (user_id, role_id) values (1, 1);insert into user_role (user_id, role_id) values (2, 1);insert into user_role (user_id, role_id) values (2, 2);insert into role_permission (role_id, permission_id) values (1, 1);insert into role_permission (role_id, permission_id) values (2, 1);insert into role_permission (role_id, permission_id) values (2, 2); |
项目结构
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
resources|___application.ymljava|___com| |____gf| | |____springbootjwtapplication.java| | |____config| | | |____.ds_store| | | |____securityconfig.java| | | |____myfiltersecurityinterceptor.java| | | |____myinvocationsecuritymetadatasourceservice.java| | | |____myaccessdecisionmanager.java| | |____entity| | | |____user.java| | | |____rolepermisson.java| | | |____role.java| | |____mapper| | | |____permissionmapper.java| | | |____usermapper.java| | | |____rolemapper.java| | |____utils| | | |____jwttokenutil.java| | |____controller| | | |____authcontroller.java| | |____filter| | | |____jwttokenfilter.java| | |____service| | | |____impl| | | | |____authserviceimpl.java| | | | |____userdetailsserviceimpl.java| | | |____authservice.java |
关键代码
pom.xml
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
<dependency> <groupid>org.springframework.boot</groupid> <artifactid>spring-boot-starter-web</artifactid></dependency><dependency> <groupid>org.springframework.boot</groupid> <artifactid>spring-boot-starter-security</artifactid></dependency><dependency> <groupid>io.jsonwebtoken</groupid> <artifactid>jjwt</artifactid> <version>0.9.0</version></dependency><dependency> <groupid>mysql</groupid> <artifactid>mysql-connector-java</artifactid> <scope>runtime</scope></dependency><dependency> <groupid>org.mybatis.spring.boot</groupid> <artifactid>mybatis-spring-boot-starter</artifactid> <version>2.0.0</version></dependency> |
application.yml
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
spring: datasource: driver-class-name: com.mysql.cj.jdbc.driver url: jdbc:mysql://localhost:3306/spring-security-jwt?useunicode=true&characterencoding=utf-8&usessl=false username: root password: rootsecurityconfig@configuration@enablewebsecuritypublic class securityconfig extends websecurityconfigureradapter { @autowired private userdetailsservice userdetailsservice; @autowired public void configureglobal(authenticationmanagerbuilder auth) throws exception { //校验用户 auth.userdetailsservice( userdetailsservice ).passwordencoder( new passwordencoder() { //对密码进行加密 @override public string encode(charsequence charsequence) { system.out.println(charsequence.tostring()); return digestutils.md5digestashex(charsequence.tostring().getbytes()); } //对密码进行判断匹配 @override public boolean matches(charsequence charsequence, string s) { string encode = digestutils.md5digestashex(charsequence.tostring().getbytes()); boolean res = s.equals( encode ); return res; } } ); } @override protected void configure(httpsecurity http) throws exception { http.csrf().disable() //因为使用jwt，所以不需要httpsession .sessionmanagement().sessioncreationpolicy( sessioncreationpolicy.stateless).and() .authorizerequests() //options请求全部放行 .antmatchers( httpmethod.options, "/**").permitall() //登录接口放行 .antmatchers("/auth/login").permitall() //其他接口全部接受验证 .anyrequest().authenticated(); //使用自定义的 token过滤器 验证请求的token是否合法 http.addfilterbefore(authenticationtokenfilterbean(), usernamepasswordauthenticationfilter.class); http.headers().cachecontrol(); } @bean public jwttokenfilter authenticationtokenfilterbean() throws exception { return new jwttokenfilter(); } @bean @override public authenticationmanager authenticationmanagerbean() throws exception { return super.authenticationmanagerbean(); }} |
jwttokenutil
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
/** * jwt 工具类 */@componentpublic class jwttokenutil implements serializable { private static final string claim_key_username = "sub"; /** * 5天(毫秒) */ private static final long expiration_time = 432000000; /** * jwt密码 */ private static final string secret = "secret"; /** * 签发jwt */ public string generatetoken(userdetails userdetails) { map<string, object> claims = new hashmap<>(16); claims.put( claim_key_username, userdetails.getusername() ); return jwts.builder() .setclaims( claims ) .setexpiration( new date( instant.now().toepochmilli() + expiration_time ) ) .signwith( signaturealgorithm.hs512, secret ) .compact(); } /** * 验证jwt */ public boolean validatetoken(string token, userdetails userdetails) { user user = (user) userdetails; string username = getusernamefromtoken( token ); return (username.equals( user.getusername() ) && !istokenexpired( token )); } /** * 获取token是否过期 */ public boolean istokenexpired(string token) { date expiration = getexpirationdatefromtoken( token ); return expiration.before( new date() ); } /** * 根据token获取username */ public string getusernamefromtoken(string token) { string username = getclaimsfromtoken( token ).getsubject(); return username; } /** * 获取token的过期时间 */ public date getexpirationdatefromtoken(string token) { date expiration = getclaimsfromtoken( token ).getexpiration(); return expiration; } /** * 解析jwt */ private claims getclaimsfromtoken(string token) { claims claims = jwts.parser() .setsigningkey( secret ) .parseclaimsjws( token ) .getbody(); return claims; }} |
jwttokenfilter
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
|
@componentpublic class jwttokenfilter extends onceperrequestfilter { @autowired private userdetailsservice userdetailsservice; @autowired private jwttokenutil jwttokenutil; /** * 存放token的header key */ public static final string header_string = "authorization"; @override protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain chain) throws servletexception, ioexception { string token = request.getheader( header_string ); if (null != token) { string username = jwttokenutil.getusernamefromtoken(token); if (username != null && securitycontextholder.getcontext().getauthentication() == null) { userdetails userdetails = this.userdetailsservice.loaduserbyusername(username); if (jwttokenutil.validatetoken(token, userdetails)) { usernamepasswordauthenticationtoken authentication = new usernamepasswordauthenticationtoken( userdetails, null, userdetails.getauthorities()); authentication.setdetails(new webauthenticationdetailssource().builddetails( request)); securitycontextholder.getcontext().setauthentication(authentication); } } } chain.dofilter(request, response); }} |
authserviceimpl
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
@servicepublic class authserviceimpl implements authservice { @autowired private authenticationmanager authenticationmanager; @autowired private userdetailsservice userdetailsservice; @autowired private jwttokenutil jwttokenutil; @override public string login(string username, string password) { usernamepasswordauthenticationtoken uptoken = new usernamepasswordauthenticationtoken( username, password ); authentication authentication = authenticationmanager.authenticate(uptoken); securitycontextholder.getcontext().setauthentication(authentication); userdetails userdetails = userdetailsservice.loaduserbyusername( username ); string token = jwttokenutil.generatetoken(userdetails); return token; }} |
关键代码就是这些，其他类代码参照后面提供的源码地址。
验证
登录，获取token
curl -X POST -d "username=admin&password=123456" http://127.0.0.1:8080/auth/login返回
eyjhbgcioijiuzuxmij9.eyjzdwiioijhzg1pbiisimv4cci6mtu1ndq1mzuwmx0.sglveqndgul9ph1op3lh9xrdzjis42vkbapd2npjt7e1tkhcey7aufixnzg9vc885_jtq4-h8r6yctrrjzl8fq
不带token访问资源
curl -X POST -d "name=zhangsan" http://127.0.0.1:8080/admin/hi
返回，拒绝访问
|
1
2
3
4
5
6
7
|
{ "timestamp": "2019-03-31t08:50:55.894+0000", "status": 403, "error": "forbidden", "message": "access denied", "path": "/auth/login"} |
携带token访问资源
|
1
|
curl -x post -h "authorization: eyjhbgcioijiuzuxmij9.eyjzdwiioijhzg1pbiisimv4cci6mtu1ndq1mzuwmx0.sglveqndgul9ph1op3lh9xrdzjis42vkbapd2npjt7e1tkhcey7aufixnzg9vc885_jtq4-h8r6yctrrjzl8fq" -d "name=zhangsan" http://127.0.0.1:8080/admin/hi |
返回正确
|
1
|
hi zhangsan , you have 'admin' role |
源码
https://github.com/gf-huanchupk/springbootlearning/tree/master/springboot-jwt
总结
以上所述是小编给大家介绍的spring boot security 结合 jwt 实现无状态的分布式api接口，希望对大家有所帮助，如果大家有任何疑问请给我留言，小编会及时回复大家的。在此也非常感谢大家对服务器之家网站的支持！
