<think>
我们基于
Spring Boot集成
Spring Security和JWT实现通用登录注册功能，主要步骤包括：
1. 添加相关依赖
2. 配置
Spring Security
3. 实现用户注册
4. 实现用户登录（生成JWT）
5. 实现JWT认证过滤器
6. 配置跨域等
下面详细说明：
### 1. 添加依赖
在`pom.xml`中添加
Spring Security和JWT相关依赖：
```xml
<dependencies>
<!--
Spring Security -->
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-
security</artifactId>
</dependency>
<!-- JWT支持，例如jjwt -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<!-- 其他依赖，如
Spring Boot Web、数据库驱动等 -->
</dependencies>
```
### 2. 配置
Spring Security
创建一个配置类`
SecurityConfig`，继承`Web
SecurityConfigurerAdapter`（对于
Spring Security 5.7及以下）或使用组件配置（对于6.0以上，此处以5.7为例）：
```
java
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private JwtAuthenticationFilter jwtAuthenticationFilter;
@Override
protected void configure(Http
Security http) throws Exception {
http
//
关闭csrf
.csrf().disable()
// 跨域配置
.cors().and()
// 认证请求
.authorizeRequests()
// 允许注册和登录接口匿名访问
.antMatchers("/api/auth/register", "/api/auth/login").permitAll()
// 其他请求需要认证
.anyRequest().authenticated()
.and()
// 添加JWT过滤器
.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
}
// 密码编码器
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
```
### 3. 实现用户注册
创建用户注册接口，通常包括：
- 用户实体类（User）
- 用户数据访问层（UserRepository）
- 用户服务（UserService）
- 注册控制器（AuthController）
注册接口示例：
```
java
@RestController
@RequestMapping("/api/auth")
public class AuthController {
@Autowired
private UserService userService;
@PostMapping("/register")
public ResponseEntity<?> registerUser(@RequestBody UserRegistrationDto registrationDto) {
// 检查用户名或邮箱是否已存在
if (userService.existsByUsername(registrationDto.getUsername())) {
return ResponseEntity.badRequest().body("用户名已存在");
}
if (userService.existsByEmail(registrationDto.getEmail())) {
return ResponseEntity.badRequest().body("邮箱已存在");
}
// 创建用户
User user = new User();
user.setUsername(registrationDto.getUsername());
user.setEmail(registrationDto.getEmail());
user.setPassword(userService.encodePassword(registrationDto.getPassword()));
userService.save(user);
return ResponseEntity.ok("注册成功");
}
}
```
### 4. 实现用户登录（生成JWT）
在登录接口中，验证用户凭证，成功后生成JWT返回。
首先，创建登录请求DTO和响应DTO：
```
java
public class LoginRequest {
private String username;
private String password;
// getters and setters
}
public class JwtResponse {
private String token;
// getters and setters
}
```
然后，在`AuthController`中添加登录接口：
```
java
@PostMapping("/login")
public ResponseEntity<?> authenticateUser(@RequestBody LoginRequest loginRequest) {
// 认证用户
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword()));
// 设置认证信息到上下文
SecurityContextHolder.getContext().setAuthentication(authentication);
// 生成JWT
String jwt = jwtUtils.generateJwtToken(authentication);
// 返回JWT
return ResponseEntity.ok(new JwtResponse(jwt));
}
```
### 5. 实现JWT工具类
创建`JwtUtils`类，用于生成和解析JWT：
```
java
@Component
public class JwtUtils {
private static final String SECRET_KEY = "yourSecretKey"; // 应存储在配置文件中
private static final long EXPIRATION_TIME = 86400000; // 24小时
public String generateJwtToken(Authentication authentication) {
UserDetailsImpl userPrincipal = (UserDetailsImpl) authentication.getPrincipal();
return Jwts.builder()
.setSubject(userPrincipal.getUsername())
.setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME))
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
}
public String getUsernameFromJwtToken(String token) {
return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody().getSubject();
}
public boolean validateJwtToken(String token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
return true;
} catch (Exception e) {
// 处理异常
}
return false;
}
}
```
### 6. 实现JWT认证过滤器
创建`JwtAuthenticationFilter`，用于在请求中拦截并验证JWT：
```
java
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private JwtUtils jwtUtils;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
try {
String jwt = parseJwt(request);
if (jwt != null && jwtUtils.validateJwtToken(jwt)) {
String username = jwtUtils.getUsernameFromJwtToken(jwt);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
} catch (Exception e) {
logger.error("Cannot set user authentication: {}", e);
}
filterChain.doFilter(request, response);
}
private String parseJwt(HttpServletRequest request) {
String headerAuth = request.getHeader("Authorization");
if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer ")) {
return headerAuth.substring(7);
}
return null;
}
}
```
### 7. 实现UserDetailsService
自定义`UserDetailsServiceImpl`实现`UserDetailsService`接口，用于加载用户信息：
```
java
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));
return UserDetailsImpl.build(user);
}
}
```
以及`UserDetailsImpl`类，实现`UserDetails`接口：
```
java
public class UserDetailsImpl implements UserDetails {
private static final long serialVersionUID = 1L;
private Long id;
private String username;
private String email;
private String password;
private Collection<? extends GrantedAuthority> authorities;
// 构造方法、getter方法
public static UserDetailsImpl build(User user) {
List<GrantedAuthority> authorities = user.getRoles().stream()
.map(role -> new SimpleGrantedAuthority(role.getName().name()))
.collect(Collectors.toList());
return new UserDetailsImpl(
user.getId(),
user.getUsername(),
user.getEmail(),
user.getPassword(),
authorities);
}
// 实现UserDetails接口的方法
}
```
### 8. 跨域配置
如果前端与
后端分离，需要配置跨域。可以在`
SecurityConfig`中配置：
```
java
@Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("http://localhost:3000")); // 允许的源
configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
configuration.setAllowedHeaders(Arrays.asList("*"));
configuration.setAllowCredentials(true);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
```
### 总结
以上步骤实现了
Spring Boot集成
Spring Security和JWT的登录注册功能。关键点包括：
- 配置
Spring Security，开放注册登录接口
- 实现用户注册逻辑
- 实现登录接口并生成JWT
- 实现JWT认证过滤器，用于后续请求的认证
- 自定义用户详情服务
注意：在实际项目中，需要更完善的异常处理、日志记录、密码加密存储等。
§§相关问题§§
1. 如何刷新JWT令牌？
2. 如何实现角色
权限控制？
3. 如何处理JWT令牌过期问题？
4.
Spring Security 6.0以上版本如何配置？
</think>以下是
Spring Boot集成
Spring Security和JWT实现通用登录注册功能的完整方法，基于行业最佳实践和引用内容整理：
### 一、整体实现流程
```mermaid
graph TD
A[用户注册] --> B[密码加密存储]
C[用户登录] --> D[JWT生成]
D --> E[请求
鉴权]
E --> F[资源访问]
G[
Spring Security配置] --> H[JWT过滤器]
```
### 二、核心实现步骤
#### 1. 添加依赖 (`pom.xml`)
```xml
<dependencies>
<!--
Spring Security -->
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-
security</artifactId>
</dependency>
<!-- JWT支持 -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.11.5</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.11.5</version>
<scope>runtime</scope>
</dependency>
<!-- 数据库支持（示例使用
Spring Data JPA） -->
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<scope>runtime</scope>
</dependency>
</dependencies>
```
#### 2. JWT工具类
```
java
@Component
public class JwtUtils {
private static final String SECRET_KEY = "yourSecretKey"; // 应配置在application.properties
private static final long EXPIRATION_MS = 86400000; // 24小时
public String generateToken(UserDetails userDetails) {
return Jwts.builder()
.setSubject(userDetails.getUsername())
.setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_MS))
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
}
public String extractUsername(String token) {
return Jwts.parser().setSigningKey(SECRET_KEY)
.parseClaimsJws(token).getBody().getSubject();
}
public boolean validateToken(String token, UserDetails userDetails) {
final String username = extractUsername(token);
return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
}
private boolean isTokenExpired(String token) {
return Jwts.parser().setSigningKey(SECRET_KEY)
.parseClaimsJws(token).getBody().getExpiration().before(new Date());
}
}
```
#### 3.
Spring Security配置类
```
java
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private JwtAuthEntryPoint unauthorizedHandler;
@Autowired
private JwtUtils jwtUtils;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Bean
public JwtAuthFilter jwtAuthenticationFilter() {
return new JwtAuthFilter(jwtUtils, userDetailsService);
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(Http
Security http) throws Exception {
http
.cors().and().csrf().disable()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
.authorizeRequests()
.antMatchers("/api/auth/**").permitAll()
.anyRequest().authenticated();
http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}
}
```
#### 4. JWT认证过滤器
```
java
public class JwtAuthFilter extends OncePerRequestFilter {
private final JwtUtils jwtUtils;
private final UserDetailsService userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain)
throws ServletException, IOException {
try {
String jwt = parseJwt(request);
if (jwt != null && jwtUtils.validateToken(jwt)) {
String username = jwtUtils.extractUsername(jwt);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePasswordAuthenticationToken authentication =
new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
} catch (Exception e) {
logger.error("Cannot set user authentication: {}", e);
}
filterChain.doFilter(request, response);
}
private String parseJwt(HttpServletRequest request) {
String headerAuth = request.getHeader("Authorization");
if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer ")) {
return headerAuth.substring(7);
}
return null;
}
}
```
#### 5. 用户注册实现
```
java
@RestController
@RequestMapping("/api/auth")
public class AuthController {
@Autowired
private UserRepository userRepository;
@Autowired
private PasswordEncoder passwordEncoder;
@PostMapping("/register")
public ResponseEntity<?> registerUser(@Valid @RequestBody UserRegistrationDto registrationDto) {
if (userRepository.existsByUsername(registrationDto.getUsername())) {
return ResponseEntity.badRequest().body("用户名已存在");
}
User user = new User();
user.setUsername(registrationDto.getUsername());
user.setPassword(passwordEncoder.encode(registrationDto.getPassword()));
user.setEmail(registrationDto.getEmail());
userRepository.save(user);
return ResponseEntity.ok("注册成功");
}
}
```
#### 6. 用户登录实现
```
java
@PostMapping("/login")
public ResponseEntity<?> authenticateUser(@Valid @RequestBody LoginRequest loginRequest) {
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
loginRequest.getUsername(),
loginRequest.getPassword()
)
);
SecurityContextHolder.getContext().setAuthentication(authentication);
String jwt = jwtUtils.generateToken((UserDetails) authentication.getPrincipal());
return ResponseEntity.ok(new JwtResponse(jwt));
}
```
### 三、关键配置说明
1. **跨域配置**（引用[1][^1]）
```
java
@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("*");
config.addAllowedHeader("*");
config.addAllowedMethod("*");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
```
2. **JWT数据结构**（引用[3][^3]）
```
Header: {
"alg": "HS512",
"typ": "JWT"
}
Payload: {
"sub": "username",
"iat": 1516239022,
"exp": 1516242622
}
Signature: HMACSHA512(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
```
### 四、数据库设计示例
```sql
CREATE TABLE users (
id BIGINT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) UNIQUE NOT NULL,
password VARCHAR(100) NOT NULL,
email VARCHAR(100) UNIQUE NOT NULL
);
```
### 五、测试流程
1. 注册用户：`POST /api/auth/register`
```json
{
"username": "test",
"password": "123456",
"email": "test@example.com"
}
```
2. 登录获取JWT：`POST /api/auth/login`
```json
{
"username": "test",
"password": "123456"
}
```
3. 访问受保护资源（在Header中添加）：
```
Authorization: Bearer <your_jwt_token>
```
### 六、最佳实践建议
1. 使用HTTPS传输JWT
2. 将JWT密钥存储在环境变量中
3. 实现令牌刷新机制
4. 添加
权限控制注解（如`@PreAuthorize`）
5. 使用Redis管理令牌黑名单
Spring Boot关闭Security鉴权
扫一扫
1715
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
