JWT入门

什么是JWT

JSON Web Token，通过数字签名的方式，以JSON对象为载体，在不同的服务终端之间安全的输出信息。

JWT有什么用？

JWT最常见的场景就是授权认证，一旦用户登录，后续每个请求都将包含JWT，系统在每次处理用户请求之前，都要先进行JWT安全校验，通过之后再进行处理。

JWT的组成

JWT由3部分组成，用.拼接：

eyJ0eXBlIjoiand0IiwiYWxnIjoiSFMyNTYifQ.eyJqdGkiOiIxMTYxMjAxMC1lYTU4LTRmODYtOWNjNS05YmYyOTZmYjUzY2EiLCJzdWIiOiJhZG1pbi1zdWJqZWN0IiwidXNlcm5hbWUiOiJ0b20iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE2NTkxODc3MTh9.YNwwm6X–5BNkUscrjiD90J-sQe8J1aszQsxZrJE4Jo

这三部分分别是：

• Header

{
	"type":  "jwt",
	"alg": "HS256"
}

• Payload

{
	"id": "123456789",
	"subject":  "abc",
	"username": "paul",
	"role": "aaaa",
	"expiration": 100000000000
}

• Signature

var encodeString = base64UrlEncode(header)  +  "."  + base64UrlEncode(payload);

var  signature = HMACSHA256(encodeString, "secret");

入门代码

pom.xml

<dependencies>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.1</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-core</artifactId>
            <version>2.3.0</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>activation</artifactId>
            <version>1.1.1</version>
        </dependency>
    </dependencies>

public class Test {
    private long time = 1000 * 60 * 60 * 24;
    private String signature = "admin";

    @org.junit.Test
    public void jwt() {
        JwtBuilder jwtBuilder = Jwts.builder();
        Map headerMap = new HashMap();
        headerMap.put("type", "jwt");
        headerMap.put("alg", "HS256");
        String jwtToken = jwtBuilder
                //header
                .setHeaderParams(headerMap)
                //payload
                .setId(UUID.randomUUID().toString())
                .setSubject("admin-subject")
                .claim("username", "tom")
                .claim("role", "admin")
                .setExpiration(new Date(System.currentTimeMillis() + time))
                //signature
                .signWith(SignatureAlgorithm.HS256, signature)
                .compact();
        System.out.println(jwtToken);
    }

    @org.junit.Test
    public void parse() {
        String token = "eyJ0eXBlIjoiand0IiwiYWxnIjoiSFMyNTYifQ.eyJqdGkiOiIxMTYxMjAxMC1lYTU4LTRmODYtOWNjNS05YmYyOTZmYjUzY2EiLCJzdWIiOiJhZG1pbi1zdWJqZWN0IiwidXNlcm5hbWUiOiJ0b20iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE2NTkxODc3MTh9.YNwwm6X--5BNkUscrjiD90J-sQe8J1aszQsxZrJE4Jo";
        JwtParser jwtParser = Jwts.parser();
        Jws<Claims> claimsJws = jwtParser.setSigningKey(signature).parseClaimsJws(token);
        Claims claims = claimsJws.getBody();
        System.out.println(claims.get("username"));
        System.out.println(claims.get("role"));
        System.out.println(claims.getSubject());
        System.out.println(claims.getExpiration());
        System.out.println(claims.getId());
    }
}