SpringCloud利用网关拦截做Token验证（JWT方式）

关于JWT的内容，请看以下链接，主要看它的原理，以及缺点！

https://blog.youkuaiyun.com/memmsc/article/details/78122931

步骤1：前端传userName+password到后端，后端为springcloud架构，经过网关的拦截器拦截请求，拦截器在项目启动的时候@Component进行加载。

步骤2：如果是第一次登陆，放行，进入JWT的加密生成Token阶段（还可以写入登陆用户的其他信息放在JWTmap中，之后可以利用Token来获取该用户信息），加密token需要一个随机数作为加密字段，将token的失效时间设置为一天，并且放到reids里面，设置该redis里面的token过期时间为30分钟，最后将Token返回给前端。

步骤3：以后任何的请求都带Token到后端去请求。

步骤4：拦截到非登陆请求，进行解密，鉴权，如果鉴权通过，更新redis里面token字段的失效时间，如果还有5分钟失效，再设置还有30分钟，目的就是让密码的过期时间变的活跃。

大致就是以上的过程，核心代码主要在网关拦截器解密鉴权和登陆接口的加密两部分

0，controller层的将得到的token做保存redis和设置过期时间的操作

1. compactJws = authService.generateJwt(username, password, userBean);

2. //将token存在redis里

3. stringRedisTemplate.opsForValue().set("token", compactJws);

4. //设置redis里面的数据失效时间为半小时

5. stringRedisTemplate.expire("token",1800,TimeUnit.SECONDS);

 

1，登陆接口的加密：

1. package com.movitech.user.service.imp;

2.  

3. import com.movitech.commons.entity.UserBean;

4. import com.movitech.commons.utils.CommonConstants;

5. import com.movitech.user.service.AuthService;

6. import io.jsonwebtoken.Jwts;

7. import io.jsonwebtoken.SignatureAlgorithm;

8. import org.joda.time.DateTime;

9. import org.springframework.stereotype.Service;

10.  

11. import java.util.Base64;

12. import java.util.HashMap;

13. import java.util.Map;

14.  

15. /**

16. * 用户身份验证Service

17. */

18. @Service(value = "authService")

19. public class AuthServiceImpl implements AuthService {

20. @Override

21. public String generateJwt(String userName, String userPassword, UserBean userBean) {

22. // Base64编码后的secretKey

23. byte[] secretKey = Base64.getEncoder().encode(CommonConstants.SECURITY_KEY.getBytes());

24. // 设置失效时间

25. DateTime expirationDate = new DateTime().plusDays(1);

26. //DateTime expirationDate = new DateTime().plusMinutes(30);

27. // Claims是需要保存到token中的信息，可以自定义，需要存什么就放什么，会保存到token的payload中

28. Map<String, Object> claims = new HashMap<>();

29. // 用户角色

30. claims.put("role", "user");

31. // 用户名

32. claims.put("userName", userName);

33. claims.put(CommonConstants.USER_ID, userBean.getId());

34. claims.put("uuid",UUID.randomUUID().toString());

35. String compactJws = Jwts.builder()

36. // 设置subject，一般是用户的唯一标识，比如用户对象的ID，用户名等，目前设置的是userCode

37. .setSubject(userName)

38. // 设置失效时间

39. .setExpiration(expirationDate.toDate())

40. .addClaims(claims)

41. // 加密算法是HS512，加密解密统一就可以

42. .signWith(SignatureAlgorithm.HS512, secretKey)

43. .compact();

44. return compactJws;

45. }

46.  

47. }

• 1

以上常量类和pojo此处省略。。。。

2，网关拦截器解密鉴权：

1. package com.movitech.gateway.filter;

2.  

3. import com.movitech.commons.dto.ErrorResponseMap;

4. import com.movitech.commons.enums.ErrorCode;

5. import com.movitech.commons.utils.CommonConstants;

6. import com.movitech.commons.utils.JsonUtil;

7. import com.movitech.commons.utils.ResponseUtil;

8. import com.netflix.zuul.ZuulFilter;

9. import com.netflix.zuul.context.RequestContext;

10. import io.jsonwebtoken.*;

11. import org.springframework.cloud.netflix.zuul.filters.support.FilterConstants;

12. import org.springframework.http.HttpHeaders;

13. import org.springframework.http.HttpMethod;

14. import org.springframework.stereotype.Component;

15. import org.springframework.util.StringUtils;

16.  

17. import javax.servlet.http.HttpServletRequest;

18. import java.util.Base64;

19.  

20. @Component

21. public class SecurityFilter extends ZuulFilter {

22. @Override

23. public String filterType() {

24. return FilterConstants.PRE_TYPE;

25. }

26.  

27. @Override

28. public int filterOrder() {

29. return FilterConstants.PRE_DECORATION_FILTER_ORDER - 1;

30. }

31.  

32. @Override

33. public boolean shouldFilter() {

34. RequestContext ctx = RequestContext.getCurrentContext();

35. HttpServletRequest request = ctx.getRequest();

36. if (request.getRequestURL().toString().contains("loginInfo") || request.getRequestURL().toString().contains("info")) {

37. return false;

38. }

39. // TODO

40. return true;

41. }

42.  

43. @Override

44. public Object run() {

45. RequestContext ctx = RequestContext.getCurrentContext();

46. HttpServletRequest request = ctx.getRequest();

47. final String authorizationHeader = request.getHeader(HttpHeaders.AUTHORIZATION);

48.  

49. if (HttpMethod.OPTIONS.name().equals(request.getMethod())) {

50. return null;

51. } else {

52. if (StringUtils.isEmpty(authorizationHeader) || !authorizationHeader.startsWith(CommonConstants.BEARER)) {

53. // Missing or invalid Authorization header

54. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Missing or invalid Authorization header!",

55. ErrorCode.INVALID_AUTHORIZATION_HEADER, request, null);

56. denyAccess(ctx,errorResponseMap);

57. return JsonUtil.serializeToString(errorResponseMap);

58. }

59. final String token = authorizationHeader.substring(7);

60. try {

61. byte[] secretKey = Base64.getEncoder().encode(CommonConstants.SECURITY_KEY.getBytes());

62. Claims claims = Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token).getBody();

63. if (claims != null) {

64. //获取redis里面数据的存活时间

65. Long expirationDate = stringRedisTemplate.getExpire("token",TimeUnit.SECONDS);

66. //如果还剩余5分钟，重置redis里面数据的存活时间

67. if(expirationDate > 300){

68. stringRedisTemplate.expire("token",1800,TimeUnit.SECONDS);

69. }else {

70. ErrorResponseMap errorResponseMap = new ErrorResponseMap();

71. Error error = new Error(null, "Token expired!", "", 1003,"");

72. errorResponseMap.setSuccess(false);

73. errorResponseMap.setMessage(null);

74. errorResponseMap.setError(error);

75. denyAccess(ctx,errorResponseMap);

76. return JsonUtil.serializeToString(errorResponseMap);

77. }

78. String userName = (String) claims.get(CommonConstants.USER_CODE);

79. Integer userId = (Integer) claims.get(CommonConstants.USER_ID);

80. ctx.addZuulRequestHeader(CommonConstants.USER_CODE, userName);

81. ctx.addZuulRequestHeader(CommonConstants.USER_ID, String.valueOf(userId));

82. }

83. } catch (MalformedJwtException ex) {

84. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Invalid token!",

85. ErrorCode.INVALID_AUTHORIZATION_HEADER, request, ex);

86. denyAccess(ctx,errorResponseMap);

87. return JsonUtil.serializeToString(errorResponseMap);

88. } catch (SignatureException ex) {

89. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Token Signature error!",

90. ErrorCode.SIGNATURE_EXCEPTION, request, ex);

91. denyAccess(ctx,errorResponseMap);

92. return JsonUtil.serializeToString(errorResponseMap);

93. } catch (ExpiredJwtException ex) {

94. ErrorResponseMap errorResponseMap = ResponseUtil.createErrorResponse(null, "Token expired!",

95. ErrorCode.EXPIRED_JWT_EXCEPTION, request, ex);

96. denyAccess(ctx,errorResponseMap);

97. return JsonUtil.serializeToString(errorResponseMap);

98. }

99. }

100. return null;

101. }

102.  

103. private void denyAccess(RequestContext ctx, ErrorResponseMap authResult) {

104. String result = JsonUtil.serializeToString(authResult);

105. ctx.setSendZuulResponse(false);

106. ctx.setResponseStatusCode(401);

107. try {

108. ctx.getResponse().getWriter().write(result);

109. }catch (Exception e){}

110. }

111. }

• 1

以上代码是核心代码，下面是自己项目中涉及到的异常包装类，以及util类，可以不管下面的，直接去封装

 

以上涉及到的类：

（1）ErrorResponseMap

1. package com.movitech.commons.dto;

2.  

3. import com.fasterxml.jackson.annotation.JsonProperty;

4. import com.movitech.commons.exception.Error;

5. import lombok.Getter;

6. import lombok.Setter;

7.  

8. @Getter

9. @Setter

10. public class ErrorResponseMap extends ResponseMap {

11. @JsonProperty(value = "error")

12. private Error error;

13. @JsonProperty(value = "stackTrace")

14. private String stackTrace;

15. }

• 1

（1.1）Error

1. package com.movitech.commons.exception;

2.  

3. import lombok.AllArgsConstructor;

4. import lombok.Getter;

5. import lombok.NoArgsConstructor;

6. import lombok.Setter;

7.  

8. @Getter

9. @Setter

10. @NoArgsConstructor

11. @AllArgsConstructor

12. public class Error {

13. // 标准的 Http status code

14. private Integer httpStatusCode;

15. // 自定义的错误说明

16. private String errorMsg;

17. // 异常信息

18. private String exceptionMsg;

19. // 自定义的错误代码

20. private Integer errorCode;

21. // 异常的类名

22. private String exceptionClassName;

23. }

• 1

（2）ErrorCode

1. package com.movitech.commons.enums;

2.  

3. /**

4. * 自定义的错误代码的枚举

5. */

6. public enum ErrorCode {

7. // Token 签名错误

8. SIGNATURE_EXCEPTION(1000),

9. // Token 过期

10. EXPIRED_JWT_EXCEPTION(1001),

11. // 无效的Authorization header

12. INVALID_AUTHORIZATION_HEADER(1002);

13. private Integer errorCode;

14. ErrorCode(Integer errorCode) {

15. this.errorCode = errorCode;

16. }

17.  

18. @Override

19. public String toString() {

20. return errorCode.toString();

21. }

22.  

23. public Integer value() {

24. return errorCode;

25. }

26. }

• 1

（3）JsonUtil

1. package com.movitech.commons.utils;

2.  

3. import com.fasterxml.jackson.core.JsonProcessingException;

4. import com.fasterxml.jackson.databind.*;

5. import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;

6. import org.springframework.stereotype.Component;

7. import org.springframework.util.StringUtils;

8.  

9. import java.io.IOException;

10.  

11. /**

12. * Json序列化和反序列化

13. */

14. @Component

15. public class JsonUtil

16. {

17. public static ObjectMapper mapper;

18. /* static {

19. dao = new ObjectMapper();

20. dao.configure(SerializationFeature.WRAP_ROOT_VALUE,true);

21. dao.configure(DeserializationFeature.UNWRAP_ROOT_VALUE, true);

22. }*/

23.  

24. public JsonUtil(Jackson2ObjectMapperBuilder jackson2ObjectMapperBuilder) {

25. mapper = jackson2ObjectMapperBuilder.build();

26. }

27.  

28. public static String serializeToString(Object object) {

29. return serializeToString(object,false);

30. }

31.  

32. public static String serializeToString(Object object,Boolean rootValueState) {

33. SerializationConfig serializationConfig = mapper.getSerializationConfig();

34. mapper.configure(SerializationFeature.WRAP_ROOT_VALUE,rootValueState);

35. if (object != null) {

36. try {

37. return mapper.writeValueAsString(object);

38. } catch (JsonProcessingException e) {

39. e.printStackTrace();

40. } finally {

41. mapper.setConfig(serializationConfig);

42. }

43. }

44. return "";

45. }

46.  

47. public static byte[] serializeToBytes(Object object) {

48. if (object != null) {

49. try {

50. return mapper.writeValueAsBytes(object);

51. } catch (JsonProcessingException e) {

52. e.printStackTrace();

53. }

54. }

55. return null;

56. }

57.  

58. /**

59. * 反序列化Json数据

60. * @param jsonData Json数据字符串

61. * @param valueType 反序列化的类型

62. * @param rootValueState 是否解析Json root name

63. * @param <T>

64. * @return 反序列化后的POJO

65. */

66. public static <T> T deserialize(String jsonData,Class<T> valueType,Boolean rootValueState) {

67. if (StringUtils.isEmpty(jsonData) || rootValueState == null) {

68. return null;

69. }

70. DeserializationConfig deserializationConfig = mapper.getDeserializationConfig();

71. mapper.configure(DeserializationFeature.UNWRAP_ROOT_VALUE,rootValueState);

72. try {

73. return mapper.readValue(jsonData, valueType);

74. } catch (IOException e) {

75. e.printStackTrace();

76. } finally {

77. mapper.setConfig(deserializationConfig);

78. }

79. return null;

80. }

81.  

82. /**

83. * 反序列化Json数据,默认解析Json root name

84. * @param jsonData Json数据字符串

85. * @param valueType 反序列化的类型

86. * @param <T>

87. * @return 反序列化后的POJO

88. */

89. public static <T> T deserialize(String jsonData,Class<T> valueType) {

90. return deserialize(jsonData, valueType, true);

91. }

92.  

93. public static JavaType getCollectionType(Class<?> collectionClass, Class<?>... elementClasses) {

94. return mapper.getTypeFactory().constructParametricType(collectionClass, elementClasses);

95. }

96.  

97. /**

98. * 用Json数据中的key获取对应的value

99. * @param jsonString json数据字符串

100. * @param field 需要取值的字段

101. * @param rootValueState 是否解析Json root name

102. * @return 字段对应的值

103. */

104. public static String getValue(String jsonString,String field,Boolean rootValueState) {

105. JsonNode node = getJsonNode(jsonString,field,rootValueState);

106. return node == null ? "" : node.toString();

107. }

108.  

109. /**

110. * 用Json数据中的key获取对应的value, 默认解析Json root name

111. * @param jsonString json数据字符串

112. * @param field 需要取值的字段

113. * @return 字段对应的值

114. */

115. public static String getValue(String jsonString,String field) {

116. return getValue(jsonString,field,true);

117. }

118.  

119. /**

120. * 用Json数据中的key获取对应的value

121. * @param jsonString json数据字符串

122. * @param field 需要取值的字段

123. * @param rootValueState 是否解析Json root name

124. * @return 字段对应的值

125. */

126. public static JsonNode getJsonNode(String jsonString, String field, Boolean rootValueState) {

127. if (StringUtils.isEmpty(jsonString) || StringUtils.isEmpty(field) || rootValueState == null) {

128. return null;

129. }

130. // 准备工作 传入vo请参照第一篇里面的实体。此处不再重新贴上代码 浪费大家时间

131. JsonNode node = null;// 这里的JsonNode和XML里面的Node很像

132. // 默认的反序列化配置

133. DeserializationConfig deserializationConfig = mapper.getDeserializationConfig();

134. mapper.configure(DeserializationFeature.UNWRAP_ROOT_VALUE,rootValueState);

135. try {

136. node = mapper.readTree(jsonString);

137. } catch (IOException e) {

138. e.printStackTrace();

139. return null;

140. } finally {

141. mapper.setConfig(deserializationConfig);

142. }

143. return node.get(field) == null ? null : node.get(field);

144. }

145. }

• 1

（4）ResponseUtil

1. package com.movitech.commons.utils;

2.  

3. import com.movitech.commons.dto.ErrorResponseMap;

4. import com.movitech.commons.enums.ErrorCode;

5. import com.movitech.commons.exception.Error;

6. import org.springframework.http.HttpStatus;

7. import org.springframework.http.ResponseEntity;

8.  

9. import javax.servlet.http.HttpServletRequest;

10.  

11. public class ResponseUtil {

12. public static ResponseEntity createResponseEntity(String errorMsg, ErrorCode errorCode, HttpServletRequest request, Throwable ex) {

13. HttpStatus status = getStatus(request);

14. ErrorResponseMap errorResponseMap = createErrorResponse(status, errorMsg, errorCode, request, ex);

15. return new ResponseEntity<>(errorResponseMap, status);

16. }

17.  

18. public static ErrorResponseMap createErrorResponse(HttpStatus status, String errorMsg, ErrorCode errorCode, HttpServletRequest request, Throwable ex) {

19. if (status == null) {

20. status = getStatus(request);

21. }

22. ErrorResponseMap errorResponseMap = new ErrorResponseMap();

23. Error error = new Error(status.value(), errorMsg, ex == null ? "" : ex.getMessage(),

24. errorCode == null ? HttpStatus.INTERNAL_SERVER_ERROR.value() : errorCode.value(), ex == null ? "" : ex.getClass().getCanonicalName());

25. errorResponseMap.setSuccess(false);

26. errorResponseMap.setMessage(ex.getMessage());

27. errorResponseMap.setError(error);

28. // String stackTrace = StringUtils.arrayToDelimitedString(ex.getStackTrace(), "hahaha");

29. // errorResponseMap.setStackTrace(stackTrace);

30. return errorResponseMap;

31. }

32.  

33. public static HttpStatus getStatus(HttpServletRequest request) {

34. Integer statusCode = (Integer) request.getAttribute("javax.servlet.error.status_code");

35. if (statusCode == null) {

36. return HttpStatus.INTERNAL_SERVER_ERROR;

37. }

38. return HttpStatus.valueOf(statusCode);

39. }

40. }

• 1