虽然给定引用中未直接提及Spring Boot 3.4
整合Spring Security和JWT
Token实现权限认证的教程，但可以基于相关引用的通用思路来构建此教程。
### 准备工作
- **引入依赖**：在`pom.xml`文件中添加Spring Boot、Spring Security和JJWT等相关依赖。示例如下：
```xml
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonweb
token</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
</dependencies>
```
### 设计表结构
设计用户相关的数据库表，例如用户表包含用户名、密码、角色等字段，用于存储用户信息和权限信息。
###
生成基本代码
- **JWT的
生成和解析工具类**：创建一个工具类用于
生成和解析JWT
Token。示例代码如下：
```
java
import io.jsonweb
token.Jwts;
import io.jsonweb
token.SignatureAlgorithm;
import
java.util.Date;
public class JwtUtils {
private static final String SECRET_KEY = "yourSecretKey";
private static final long EXPIRATION_TIME = 86400000; // 24小时
public static String generate
Token(String username
) {
return Jwts.builder
()
.setSubject
(username
)
.setExpiration
(new Date
(System.currentTimeMillis
() + EXPIRATION_TIME
))
.signWith
(SignatureAlgorithm.HS512, SECRET_KEY
)
.compact
();
}
public static String getUsernameFrom
Token(String
token) {
return Jwts.parser
()
.setSigningKey
(SECRET_KEY
)
.parseClaimsJws
(token)
.getBody
()
.getSubject
();
}
}
```
- **Spring Security配置**：配置Spring Security，包括白名单、登录验证、JWT过滤器等。示例代码如下：
```
java
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain securityFilterChain
(HttpSecurity http
) throws Exception {
http
.csrf
().disable
()
.authorizeRequests
()
.antMatchers
("/login"
).permitAll
()
.anyRequest
().authenticated
()
.and
()
.addFilterBefore
(new JwtFilter
(), UsernamePasswordAuthenticationFilter.class
);
return http.build
();
}
}
```
- **JWT过滤器**：创建一个过滤器用于验证请求中的JWT
Token。示例代码如下：
```
java
import
javax.servlet.FilterChain;
import
javax.servlet.ServletException;
import
javax.servlet.http.HttpServletRequest;
import
javax.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.UsernamePasswordAuthentication
Token;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.web.filter.OncePerRequestFilter;
import
java.io.IOException;
public class JwtFilter extends OncePerRequestFilter {
private final UserDetailsService userDetailsService;
public JwtFilter
(UserDetailsService userDetailsService
) {
this.userDetailsService = userDetailsService;
}
@Override
protected void doFilterInternal
(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain
)
throws ServletException, IOException {
String
token = request.getHeader
("Authorization"
);
if
(token != null &&
token.startsWith
("Bearer "
)) {
token =
token.substring
(7
);
String username = JwtUtils.getUsernameFrom
Token(token);
UserDetails userDetails = userDetailsService.loadUserByUsername
(username
);
UsernamePasswordAuthentication
Token authentication = new UsernamePasswordAuthentication
Token(
userDetails, null, userDetails.getAuthorities
());
SecurityContextHolder.getContext
().setAuthentication
(authentication
);
}
filterChain.doFilter
(request, response
);
}
}
```
### 登录验证
- **登录接口**：创建一个登录接口，用于用户登录并
生成JWT
Token。示例代码如下：
```
java
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class LoginController {
@PostMapping
("/login"
)
public String login
(@RequestParam String username, @RequestParam String password
) {
// 验证用户名和密码
if
("admin".equals
(username
) && "password".equals
(password
)) {
return JwtUtils.generate
Token(username
);
}
return "Login failed";
}
}
```
### 启动查看接口
启动Spring Boot应用程序，测试登录接口和需要权限认证的接口。未登录时
访问需要权限的接口会被拦截，登录后携带有效的JWT
Token可以正常
访问。
### 总结
通过以上步骤，实现了Spring Boot 3.4
整合Spring Security和JWT
Token实现权限认证。利用Spring Security的强大功能进行权限管理，结合JWT的无状态特性实现
Token验证。
最低0.47元/天 解锁文章
扫一扫
1015
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
