跟着JHipster学做项目 (6) 安全访问控制（上）JWT的Spring Boot应用

最新推荐文章于 2025-07-25 14:26:57 发布

原创

最新推荐文章于 2025-07-25 14:26:57 发布 · 1.4k 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#jwt #spring boot #java #jhipster

本文详细介绍使用JHipster框架结合JWT实现用户认证与授权的过程，包括依赖引入、过滤器设计、token生成与验证，以及核心配置类实现。

通过配置可以生成JHipster运用JWT进行访问控制的一套代码，主要是通过JWTFilter过滤器，并把它置于UsernamePasswordAuthenticationFilter前端对用户进行Authentication(认证)和Authorization(授权)控制，此外对于认证或者授权失败是采用前文提到的异常处理。

这里需要引入的依赖如下：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
<dependency>
    <groupId>org.zalando</groupId>
    <artifactId>problem-spring-web</artifactId>
    <version>${problem-spring-web.version}</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>${io.jsonwebtoken.version}</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>${io.jsonwebtoken.version}</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>${io.jsonwebtoken.version}</version>
    <scope>runtime</scope>
</dependency>

首先创建JWT过滤器JWTFilter:

public class JWTFilter extends GenericFilterBean {

    public static final String AUTHORIZATION_HEADER = "Authorization";

    private final TokenProvider tokenProvider;

    public JWTFilter(TokenProvider tokenProvider) {
        this.tokenProvider = tokenProvider;
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
        throws IOException, ServletException {
        HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
        String jwt = resolveToken(httpServletRequest);
        if (StringUtils.hasText(jwt) && this.tokenProvider.validateToken(jwt)) {
            Authentication authentication = this.tokenProvider.getAuthentication(jwt);
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
        filterChain.doFilter(servletRequest, servletResponse);
    }

    private String resolveToken(HttpServletRequest request) {
        String bearerToken = request.getHeader(AUTHORIZATION_HEADER);
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            return bearerToken.substring(7

最低0.47元/天解锁文章