实战篇-29_登录优化_redis_主动失效

令牌主动生效机制

• 登录成功后，给浏览器响应令牌的同时，把该令牌存储到redis中
• LoginInterceptor拦截器中，需要验证浏览器携带的令牌，并同时需要获取到redis中存储的
• 当用户修改密码成功后，删除redis存储的旧令牌。

实现步骤

1.在UserController中

1.@Atuowired注入StringRedisTemplate

    @Autowired
    private StringRedisTemplate stringRedisTemplate;

2. /login路径方法把token存储到redis中

    @PostMapping("/login")
    public Result<String> login(@Pattern(regexp = "^\\S{5,16}$") String username, @Pattern(regexp = "^\\S{5,16}$") String password) {
        //根据用户名查询用户
        User loginUser = userService.findUserByUsername(username);

        //判断用户是否存在
        if (loginUser == null) {
            return Result.error("用户名不存在");
        }
        //判断密码是否正确
        if (Md5Util.getMD5String(password).equals(loginUser.getPassword())) {
            Map<String, Object> claims = new HashMap<>();
            claims.put("id", loginUser.getId());
            claims.put("username", loginUser.getUsername());
            String token = JwtUtil.genToken(claims);
            //把token存储到redis中
            ValueOperations<String, String> operations = stringRedisTemplate.opsForValue();
            operations.set(token, token, 1, TimeUnit.HOURS);
            return Result.success(token);
        } else {
            return Result.error("密码错误");
        }

    }

说明：在JwtUtil.java中定义JWT令牌生效的时间，工具类里面设置的是1小时。UserController设置的也是1小时。

    public static String genToken(Map<String, Object> claims) {
        return JWT.create()
                .withClaim("claims", claims)
                .withExpiresAt(new Date(System.currentTimeMillis() + 1000 * 60 * 60 ))
                .sign(Algorithm.HMAC256(KEY));
    }

3.@PatchMapping("updatePwd")对应方法删除redis的token

   @PatchMapping("updatePwd")
    public Result updatePwd(@RequestBody Map<String, String> params, @RequestHeader("Authorization") String token) {
        //1.获取信息
        String oldPwd = params.get("old_pwd");
        String newPwd = params.get("new_pwd");
        String rePwd = params.get("re_pwd");
        //判断原密码是否正确
        Map<String, Object> map = ThreadLocalUtil.get();
        String username = (String) map.get("username");
        User loginUser = userService.findUserByUsername(username);
        if (!StringUtils.hasLength(oldPwd) || !StringUtils.hasLength(newPwd) || !StringUtils.hasLength(rePwd)) {

            return Result.error("请输入完整信息");
        }
        if (!loginUser.getPassword().equals(Md5Util.getMD5String(oldPwd))) {
            return Result.error("原密码错误");
        }
        //判断两次输入密码是否一致
        if (!newPwd.equals(rePwd)) {
            return Result.error("两次输入密码不一致");
        }

        //2调取service方法进行密码修改
        userService.updatePwd(newPwd);
        //删除redis中对应的token
        ValueOperations<String, String> operations = stringRedisTemplate.opsForValue();
        operations.getOperations().delete(token);
        return Result.success("密码修改成功");
    }

2.LoginInterceptor中修改验证token

   @Autowired
    private StringRedisTemplate stringRedisTemplate;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String token = request.getHeader("Authorization");
        try {
            //验证token
            ValueOperations<String, String> operations = stringRedisTemplate.opsForValue();
            String redisToken = operations.get(token);
            if (redisToken == null) {
                //token失效了
                throw new RuntimeException();
            }
            Map<String, Object> claims = JwtUtil.parseToken(token);
            //放行
            //创建一个线程
            ThreadLocalUtil.set(claims);

            return true;
        } catch (Exception e) {
            //http响应状态码为401
            response.setStatus(401);
            return false;
        }
        //不放行
    }

3.Postman验证

1.登录

2.把jwt验证码复制到用户相关接口的Scripts-Pre-request中

3更改密码

4.获取用户详细信息

出现401未授权，验证结束。