Springboot实现JWT Token自动续期

Spirit_NKlaus

于 2025-04-16 10:34:29 发布

阅读量442

点赞数 3

分类专栏： SpringBoot 文章标签： spring boot 后端 java

本文链接：https://blog.youkuaiyun.com/LittleMangoYX/article/details/147270688

版权

SpringBoot 专栏收录该内容

27 篇文章

订阅专栏

为什么需要自动续期？我们的签发一个JWT，在到期之前就会始终有效，无法中途废弃。也就是说JWT是一次性的。想修改里面的内容，就必须签发一个新的JWT，那么如果我签发了一个Token他的过期时间是半小时，在这半小时中即使当前用户一直处于活跃状态，然而时间到了它仍然会失效，会需要我们重新登录，那么我们能不能在判断当前用户一直处于活跃状态的情况下去自动给当前用户的token刷新过期时间呢？这就是JWT Token的自动续期，下面我们结合redis来实现此方案，为了不频繁操作redis，只有当离过期时间只有10分钟时才更新过期时间。

一，首先需要引入JWT和redis的依赖，并在yml中配置好redis的支持

<dependency>
	<groupId>com.auth0</groupId>
	<artifactId>java-jwt</artifactId>
</dependency>
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>

spring:
  redis:
    host: localhost
    port: 6379
    password:
    timeout: 5000

二，编写JWT工具类，实现token的生成和解析

import com.alibaba.fastjson.JSONObject;
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.yx.analyze.demo.dto.UserLoginDTO;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.util.HashMap;
import java.util.Map;

/**
 * JWT工具类
 */
public class JWTUtil {

    private static final Logger logger = LoggerFactory.getLogger(JWTUtil.class);
    //私钥
    private static final String TOKEN_SECRET = "yyds_97";

    /**
     * 生成token，不设置过期时间（由redis进行管理）
     *
     * @param dto 用户登录信息
     * @return token
     */
    public static String generateToken(UserLoginDTO dto) {
        try {
            // 私钥和加密算法
            Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
            // 设置头部信息
            Map<String, Object> header = new HashMap<>(2);
            header.put("Type", "Jwt");
            header.put("alg", "HS256");
            //生成token但不设置过期时间
            return JWT.create()
                    .withHeader(header)
                    .withClaim("token", JSONObject.toJSONString(dto))
                    .sign(algorithm);
        } catch (Exception e) {
            logger.error("generate token occur error, error is: ", e);
            return null;
        }
    }

    /**
     * 转换token
     *
     * @param token token信息
     * @return 用户登录信息
     */
    public static UserLoginDTO parseToken(String token) {
        Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
        JWTVerifier verifier = JWT.require(algorithm).build();
        DecodedJWT jwt = verifier.verify(token);
        String jsonStr = jwt.getClaim("token").asString();
        return JSONObject.parseObject(jsonStr, UserLoginDTO.class);
    }
}

三，编写redis组件来操作redis

import lombok.extern.slf4j.Slf4j;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.core.ValueOperations;
import org.springframework.data.redis.serializer.StringRedisSerializer;
import org.springframework.stereotype.Component;

import javax.annotation.PostConstruct;
import javax.annotation.Resource;
import java.util.concurrent.TimeUnit;

/**
 * redis通用组件
 */
@Component
@Slf4j
public class RedisComponent {

    private ValueOperations<String, String> valueOperations;

    @Resource
    private RedisTemplate redisTemplate;

    @PostConstruct
    public void init() {
        StringRedisSerializer redisSerializer = new StringRedisSerializer();
        redisTemplate.setKeySerializer(redisSerializer);
        redisTemplate.setValueSerializer(redisSerializer);
        redisTemplate.setHashKeySerializer(redisSerializer);
        redisTemplate.setHashValueSerializer(redisSerializer);
        valueOperations = redisTemplate.opsForValue();
    }

    /**
     * 设置key-value，默认过期时间
     *
     * @param key   key值
     * @param value value值
     */
    public void set(String key, String value) {
        //30分钟的毫秒数
        long duration = 30 * 60 * 1000L;
        valueOperations.set(key, value, duration, TimeUnit.MILLISECONDS);
        log.info("key={}, value is: {} into redis cache", key, value);
    }

    /**
     * 设置key-value，自定义过期时间
     *
     * @param key      key值
     * @param value    value值
     * @param duration 过期时间，单位毫秒
     */
    public void set(String key, String value, long duration) {
        valueOperations.set(key, value, duration, TimeUnit.MILLISECONDS);
        log.info("key={}, value is: {},  duration is: {} into redis cache", key, value, duration);
    }

    /**
     * 根据key获取value
     *
     * @param key key值
     * @return value值
     */
    public String get(String key) {
        String redisValue = valueOperations.get(key);
        log.info("get from redis, value is: {}", redisValue);
        return redisValue;
    }

    /**
     * 根据key删除value
     *
     * @param key key值
     * @return 删除结果
     */
    public boolean delete(String key) {
        boolean result = redisTemplate.delete(key);
        log.info("delete from redis, key is: {}", key);
        return result;
    }

    /**
     * 根据key获取过期时间
     *
     * @param key key值
     * @return 过期时间
     */
    public Long getExpireTime(String key) {
        return valueOperations.getOperations().getExpire(key);
    }
}

四，全局异常处理简单拦截token相关异常

import cn.hutool.extra.tokenizer.TokenizerException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;

/**
 * 全局异常处理
 */
@RestControllerAdvice
@Slf4j
public class ExceptionAdvice {

    @ExceptionHandler(value = TokenizerException.class)
    public String tokenizerExceptionHandler(TokenizerException e) {
        log.error("发生业务异常！原因是{}", e.getMessage());
        return e.getMessage();
    }

    @ExceptionHandler(value = TokenExpiredException.class)
    public String tokenExpiredExceptionHandler(TokenExpiredException e) {
        log.error("发生业务异常！原因是{}", e.getMessage());
        return e.getMessage();
    }

    /**
     * 处理其他异常
     *
     * @param e
     * @return
     */
    @ExceptionHandler(value = Exception.class)
    public String exceptionHandler(Exception e) {
        log.error("未知异常！原因是: ", e);
        return "系统内部异常!";
    }
}

五，设计拦截器，拦截系统的http请求并判断token是否过期，或者需要自动续期

import cn.hutool.extra.tokenizer.TokenizerException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.yx.analyze.demo.component.RedisComponent;
import com.yx.analyze.demo.dto.UserLoginDTO;
import com.yx.analyze.demo.utils.JWTUtil;
import lombok.AllArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang.StringUtils;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * token拦截器
 */
@Component
@AllArgsConstructor
@Slf4j
public class TokenInterceptor implements HandlerInterceptor {

    private final RedisComponent redisComponent;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String token = request.getHeader("Authorization");
        if (StringUtils.isBlank(token)) {
            throw new TokenizerException("token is null");
        }
        UserLoginDTO dto = JWTUtil.parseToken(token);
        String userId = dto.getUserId();
        //请求是否有效
        if (redisComponent.get(userId) == null || !token.equals(redisComponent.get(userId))) {
            throw new TokenExpiredException("token expired");
        }
        //是否需要续期
        if (redisComponent.getExpireTime(userId) < 60 * 10) {
            redisComponent.set(userId, token);
            log.error("update token info, id is:{}, user info is:{}", userId, token);
        }
        return true;
    }
}

import com.yx.analyze.demo.interceptor.TokenInterceptor;
import lombok.AllArgsConstructor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

/**
 * 拦截器配置
 */
@Configuration
@AllArgsConstructor
public class InterceptorConfig implements WebMvcConfigurer {

    private final TokenInterceptor tokenInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(tokenInterceptor)
                .excludePathPatterns("/loginOut/**")
                .excludePathPatterns("/login/**")
                .addPathPatterns("/**");
    }
}

六，编写controller简单测试下

import lombok.Data;

/**
 * 用户登录数据传输实体
 */
@Data
public class UserLoginDTO {
    private String userId;
    private String userName;
    private String password;
}

import com.yx.analyze.demo.component.RedisComponent;
import com.yx.analyze.demo.dto.UserLoginDTO;
import com.yx.analyze.demo.utils.JWTUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

import javax.servlet.http.HttpServletRequest;

/**
 * 用户接口控制器
 */
@RestController
public class UserController {

    @Autowired
    private RedisComponent redisComponent;

    @PostMapping("/login")
    public String login(@RequestBody UserLoginDTO dto) {
        //模拟查库判断账号密码是否匹配
        String userId = "2";
        boolean exist = false;
        if ("admin".equals(dto.getUserName()) && "123456".equals(dto.getPassword())) {
            exist = true;
            userId = "1";
        }
        if (!exist) {
            return "账号或密码错误";
        }
        dto.setPassword(null);
        dto.setUserId(userId);
        String token = JWTUtil.generateToken(dto);
        redisComponent.set(userId, token);
        return token;
    }

    @PostMapping("/loginOut")
    public String loginOut(@RequestBody UserLoginDTO dto) {
        //模拟查库判断账号是否匹配
        String userId = "2";
        if ("admin".equals(dto.getUserName())) {
            userId = "1";
        }
        boolean flag = redisComponent.delete(userId);
        return flag ? "登出成功" : "登出失败";
    }

    @PostMapping("/updatePassword")
    public String updatePassword(@RequestBody UserLoginDTO dto) {
        //模拟查库判断账号是否匹配
        String userId = "2";
        if ("admin".equals(dto.getUserName())) {
            userId = "1";
        }
        //TODO 修改库用户表中的密码
        dto.setUserId(userId);
        dto.setPassword(null);
        String token = JWTUtil.generateToken(dto);
        redisComponent.set(userId, token);
        return token;
    }

    @GetMapping("/index")
    public String index(HttpServletRequest request) {
        //模拟查库判断账号是否匹配
        String token = request.getHeader("Authorization");
        UserLoginDTO dto = JWTUtil.parseToken(token);
        if (dto == null) {
            return "非法用户";
        }
        return "欢迎：" + dto.getUserName();
    }
}