SpringSecurity整合JWT权限验证实现前后端分离，配合使用 Redis实现token超时的刷新机制

项目使用SpringSecurity整合JWT实现权限验登陆，下面简单描述下整个流程。

1.登陆成功后生成JWT token 返回给前端，前端再次访问时携带这个jwt token，服务端收到后解析这个token，判断这个token是否超过最大有效期，如没有超过最大有效期但这个token过期了，就返回刷新后的jwt给前端，但超过了最大有效期就要用户重新登陆了，下面是具体的代码实现，有 不足之处多多指导哦。

1.配置验证过期以及刷新JWT的过滤器

@Component
public class JwtCheckTokenFilter extends OncePerRequestFilter {

//	@Autowired
//	UserDetailsService userservice;
	
	@Autowired
	UserService userService;

	@Autowired
	RedisUtil redisUtil;

	@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
			throws ServletException, IOException {
		String token = request.getHeader("jwt_token");
		if (StringUtils.isEmpty(token))
			token = CookieUtil.getcookie(request, "jwt_token");
		if (!StringUtils.isEmpty(token)) {
			String username = JwtTokenUtil.getUsernameFromToken(token);
			if (username != null) {
				if (SecurityContextHolder.getContext().getAuthentication() == null) {
					//UserDetails userDetails = userservice.loadUserByUsername(username);
					UserMsg userMsg = userService.findByUsername(username);
					UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
					userMsg,token,getAuthorities(userMsg));
					authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
					SecurityContextHolder.getContext().setAuthentication(authentication);
				}
			} else {
				String user_key = redisUtil.getKeyByToken(token,"token");
				if (user_key != null) {
					UserMsg userMsg = userService.findByUsername(user_key);
					//UserDetails userDetails = userservice.loadUserByUsername(username2);
                     //返回刷新后的JWT
					String new_token = JwtTokenUtil.generateToken(userMsg);
                    //刷新redis中的JWT
					redisUtil.set("token"+redis_username,new_token,60*60*24*10);
					CookieUtil.addcookie(ImmutableMap.of("jwt_token", new_token), request, response);
				} else {
					SecurityContextHolder.clearContext();
				}
			}
		}else SecurityContextHolder.clearContext();
		filterChain.doFilter(request, response);
	}
	
	private Collection<GrantedAuthority> getAuthorities(UserMsg userMsg) {
		Stream<String> roles = 
				Objects.equals(1,userMsg.getIsadmin())?
				Stream.of("ROLE_admin","select","update","insert","delete")
				:Stream.of("ROLE_user","select","update","insert");
		return roles.map(SimpleGrantedAuthority::new).collect(Collectors.toList());
	}
}

 2.SpringSecurity的配置类

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled=true)
public class SecurityCo