springboot如何使用jwt进行token的验证

最新推荐文章于 2024-08-25 21:28:18 发布

zhige@

最新推荐文章于 2024-08-25 21:28:18 发布

阅读量2.7w

点赞数

CC 4.0 BY-SA版权

文章标签： jwt springboot token

本文链接：https://blog.youkuaiyun.com/nyasm/article/details/109399707

本文档详细介绍了如何在Spring Boot应用中集成JWT，用于实现用户认证和权限管理。首先，通过添加Auth0的java-jwt库作为依赖来支持JWT的生成和验证。然后，创建了一个JWTUtils工具类，用于生成和解析JWT，以及验证其合法性。接着，实现了一个JWTInterceptor拦截器，处理JWT的验证，并在验证失败时返回相应的错误信息。最后，配置了InterceptorConfig，将拦截器应用到指定的API路径上，实现了对JWT的拦截验证。现在，应用能够有效地进行JWT token的验证，确保了安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

引入pom依赖

<dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.10.3</version>
</dependency>

2.编写JWTUtils工具类

package com.ran.utils;

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTCreator;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.util.Calendar;
import java.util.Map;

public class JWTUtils {
    private static final String signature = "xxxxxxxxxxx";

    /**
     * 生成token header.payload.signature
     */
    public static String getToken(Map<String, String> map) {
        Calendar instance = Calendar.getInstance();
        instance.add(Calendar.DATE, 30);
        //创建JWT builder
        JWTCreator.Builder builder = JWT.create();
        //payload
        map.forEach(builder::withClaim);
        String token = builder.withExpiresAt(instance.getTime()).sign(Algorithm.HMAC256(signature));
        return token;
    }
    /**
     * 验证token 合法性
     * 验证失败则会抛出异常 验证成功则不抛出异常
     * AlgorithmMismatchException 算法不匹配
     * TokenExpiredException token过期
     * SignatureVerificationException 签名验证失败异常
     * Exception token无效
     */
    public static void verify(String token){
        JWT.require(Algorithm.HMAC256(signature)).build().verify(token);
    }
    /**
     * 获取token方法
     */
    public static DecodedJWT getTokenInfo(String token){
        DecodedJWT verify = JWT.require(Algorithm.HMAC256(signature)).build().verify(token);
        return verify;
    }
}

3.为了减少代码冗余在springboot中添加拦截器

package com.ran.interceptor;

import com.auth0.jwt.exceptions.AlgorithmMismatchException;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.ran.utils.JWTUtils;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashMap;

public class JWTInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        HashMap<String, Object> map = new HashMap<>();
        //获取请求头中的token令牌
        String token = request.getHeader("Authorization");
        try {
            JWTUtils.verify(token);
            return true;
        }catch (AlgorithmMismatchException e){
            e.printStackTrace();
            map.put("msg","算法不匹配");
        }catch (TokenExpiredException e){
            e.printStackTrace();
            map.put("msg","token过期");
        }catch (SignatureVerificationException e){
            e.printStackTrace();
            map.put("msg","签名验证失败异常");
        } catch (Exception e) {
            e.printStackTrace();
            map.put("msg","token无效");
        }
        map.put("state",false);//设置状态
//        将map转为json Jackson
        String json = new ObjectMapper().writeValueAsString(map);
        response.setContentType("application/json;charset=utf-8");
//        response.getWriter().write(json);
        response.getWriter().println(json);
        return false;
    }
}

4.配置InterceptorConfig

package com.ran.config;

import com.ran.interceptor.JWTInterceptor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new JWTInterceptor())
            .addPathPatterns("/**")//其他接口进行保护拦截验证
            .excludePathPatterns("/user/**");//关于用户的接口放行
    }
}

5.现在就可以完美使用JWTtoken验证了