JWTUtils--SpringBoot整合JWT

本文介绍了一种使用JWT(JSON Web Tokens)进行用户身份验证的方法。通过示例代码展示了如何生成包含用户ID和登录名的JWT令牌,并设置了过期时间。同时,提供了验证JWT令牌合法性的方法,用于获取和解析令牌中的用户信息。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

        <!--引入JWT依赖-->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.4.0</version>
        </dependency>
public class JWTUtils {

    //秘钥 盐
    private static final String SECRET = "SmyC47re$ML%F72x6koqyUQ0XLQOasdsad";

    /**
     * 生成token header.payload.sing
     * @param map
     * @param expired
     * @return
     */
    public static String getToken(Map<String,String> map, Integer expired){
        Calendar instance = Calendar.getInstance();
        //设置过期时间单位:秒
        instance.add(Calendar.SECOND,expired);
        //创建jwt builder
        JWTCreator.Builder builder = JWT.create();
        //payload
        map.forEach((k,v)->{
            builder.withClaim(k,v);
        });
        //制定令牌过期时间
        String token = builder.withExpiresAt(instance.getTime())
                //sign
                .sign(Algorithm.HMAC256(SECRET));
        return token;
    }

    /**
     * 验证token 合法性 || 获取token信息方法
     * @param token
     */
    public static DecodedJWT verify(String token){
        return JWT.require(Algorithm.HMAC256(SECRET)).build().verify(token);
    }

    public static void main(String[] args) {
        Map<String,String> map = new HashMap<>();
        map.put("userId","1");
        map.put("loginName","admin");
        String token = getToken(map,60);
        System.out.println(token);

        DecodedJWT tokenInfo = verify("eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbk5hbWUiOiJhZG1pbiIsImV4cCI6MTU5NzE5ODI1MywidXNlcklkIjoiMSJ9.jTcL_PFAbn_AT05alHGv3kzEI_vsAf5RiCDJEqLH30A");
        String userId = tokenInfo.getClaim("userId").asString();
        String loginName = tokenInfo.getClaim("loginName").asString();

        System.out.println(userId);
        System.out.println(loginName);
    }
}
可以通过以下步骤在Spring Boot中集成JWT: 1. 添加java-jwt依赖包到pom.xml文件中: ```xml <dependency> <groupId>com.auth0</groupId> <artifactId>java-jwt</artifactId> <version>3.18.1</version> </dependency> ``` 2. 创建一个JWT工具类来生成和验证JWT令牌: ```java import com.auth0.jwt.JWT; import com.auth0.jwt.algorithms.Algorithm; import com.auth0.jwt.exceptions.JWTVerificationException; import com.auth0.jwt.interfaces.DecodedJWT; import java.util.Date; public class JwtUtils { private static final long EXPIRATION_TIME = 86400000; // 24 hours private static final String SECRET = "mySecret"; private static final String ISSUER = "myIssuer"; public static String generateToken(String username) { Date now = new Date(); Date expiryDate = new Date(now.getTime() + EXPIRATION_TIME); return JWT.create() .withSubject(username) .withIssuer(ISSUER) .withIssuedAt(now) .withExpiresAt(expiryDate) .sign(Algorithm.HMAC512(SECRET)); } public static String getUsernameFromToken(String token) throws JWTVerificationException { DecodedJWT jwt = JWT.require(Algorithm.HMAC512(SECRET)) .withIssuer(ISSUER) .build() .verify(token); return jwt.getSubject(); } } ``` 3. 在Spring Security配置中添加JWT过滤器,以验证JWT令牌: ```java import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.core.annotation.Order; import org.springframework.http.HttpStatus; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.config.annotation.SecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.authentication.HttpStatusEntryPoint; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; @Configuration @Order(1) public class JwtConfig extends SecurityConfigurerAdapter<javax.servlet.Filter, HttpSecurity> { @Autowired private JwtAuthenticationProvider jwtAuthenticationProvider; @Override public void configure(HttpSecurity http) throws Exception { JwtAuthenticationFilter jwtAuthenticationFilter = new JwtAuthenticationFilter(); jwtAuthenticationFilter.setAuthenticationManager(http.getSharedObject(AuthenticationManager.class)); jwtAuthenticationFilter.setAuthenticationFailureHandler(new JwtAuthenticationFailureHandler()); http.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class); } private class JwtAuthenticationFilter extends UsernamePasswordAuthenticationFilter { @Override public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException { String token = request.getHeader("Authorization"); if (token == null || !token.startsWith("Bearer ")) { throw new JwtAuthenticationException("Invalid JWT token"); } String username = JwtUtils.getUsernameFromToken(token.substring(7)); if (username == null) { throw new JwtAuthenticationException("Invalid JWT token"); } return jwtAuthenticationProvider.authenticate(new UsernamePasswordAuthenticationToken(username, "")); } @Override protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException { super.successfulAuthentication(request, response, chain, authResult); chain.doFilter(request, response); } } private class JwtAuthenticationFailureHandler extends HttpStatusEntryPoint { @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException { response.setStatus(HttpStatus.UNAUTHORIZED.value()); } } } ``` 4. 创建一个JwtAuthenticationProvider来验证用户名和密码: ```java import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Component; @Component public class JwtAuthenticationProvider implements AuthenticationProvider { @Autowired private UserDetailsService userDetailsService; @Autowired private PasswordEncoder passwordEncoder; @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { String username = authentication.getName(); String password = (String) authentication.getCredentials(); UserDetails userDetails = userDetailsService.loadUserByUsername(username); if (!passwordEncoder.matches(password, userDetails.getPassword())) { throw new JwtAuthenticationException("Invalid username or password"); } return new UsernamePasswordAuthenticationToken(username, password, userDetails.getAuthorities()); } @Override public boolean supports(Class<?> authentication) { return authentication.equals(UsernamePasswordAuthenticationToken.class); } } ``` 5. 在Spring Security配置中添加JwtConfig: ```java import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.core.annotation.Order; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private JwtAuthenticationProvider jwtAuthenticationProvider; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.authenticationProvider(jwtAuthenticationProvider); } @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .antMatcher("/**") .authorizeRequests() .antMatchers("/login").permitAll() .anyRequest().authenticated() .and() .apply(new JwtConfig()); } } ``` 现在你就可以在Spring Boot应用程序中使用JWT进行身份验证了。
评论 2
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值