Spring Boot和
Spring Security可以很好地结合使用来
实现RESTful API的认证。而
JWT（JSON Web Token）是一种用于认证和
授权的安全传输方式。
要在
Spring Boot中
实现JWT认证，可以遵循以下步骤：
1. 添加依赖：在`pom.xml`文件中添加以下依赖：
```xml
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-
security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 创建
JWT工具类：创建一个
JWT工具类来生成和解析
JWT。可以使用J
JWT库来简化这个过程。
3. 创建认证过滤器：创建一个继承自`OncePerRequestFilter`的认证过滤器，在该过滤器中检查请求中的
JWT，并进行认证。
4. 配置
Spring Security：将认证过滤器添加到
Spring Security的配置中，以便在每个请求到达之前进行
JWT认证。
5. 创建登录接口：创建一个登录接口，用于验证用户的身份并生成
JWT。
这是一个
简单的示例代码，说明如何在
Spring Boot中
实现JWT认证：
```java
//
JWT工具类
public class
JwtUtils {
private static final String SECRET_KEY = "your-secret-key";
private static final long EXPIRATION_TIME = 864_000_000; // 10天
public static String generateToken(Authentication authentication) {
UserDetailsImpl userPrincipal = (UserDetailsImpl) authentication.getPrincipal();
Date expirationDate = new Date(System.currentTimeMillis()
+ EXPIRATION_TIME);
return
Jwts.builder()
.setSubject(userPrincipal.getUsername())
.setIssuedAt(new Date())
.setExpiration(expirationDate)
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
}
public static String getUsernameFromToken(String token) {
return
Jwts.parser()
.setSigningKey(SECRET_KEY)
.parseClaimsJws(token)
.getBody()
.getSubject();
}
public static boolean validateToken(String token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
return true;
} catch (SignatureException | Malformed
JwtException | Expired
JwtException | Unsupported
JwtException | IllegalArgumentException e) {
return false;
}
}
}
// 认证过滤器
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
JwtUtils
jwtUtils;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
String authorizationHeader = request.getHeader("Authorization");
if (StringUtils.hasText(authorizationHeader) && authorizationHeader.startsWith("Bearer ")) {
String token = authorizationHeader.substring(7);
if (
jwtUtils.validateToken(token)) {
String username =
jwtUtils.getUsernameFromToken(token);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
filterChain.doFilter(request, response);
}
}
//
Spring Security配置类
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
JwtAuthenticationFilter
jwtAuthenticationFilter;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Override
protected void configure(Http
Security http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/login").permitAll()
.anyRequest().authenticated()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(
jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
}
}
// 登录接口
@RestController
public class AuthController {
@Autowired
private AuthenticationManager authenticationManager;
@PostMapping("/login")
public ResponseEntity<?> authenticateUser(@RequestBody LoginRequest loginRequest) {
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword())
);
SecurityContextHolder.getContext().setAuthentication(authentication);
String token =
JwtUtils.generateToken(authentication);
return ResponseEntity.ok(new
JwtResponse(token));
}
}
// 登录请求DTO
public class LoginRequest {
private String username;
private String password;
// getters and setters
}
//
JWT响应DTO
public class
JwtResponse {
private String token;
// constructor and getter
}
// 用户详情
实现类
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("User Not Found with username: "
+ username));
return UserDetailsImpl.build(user);
}
}
```
超级会员免费看
本文介绍了如何使用Spring Boot、Spring Security和JWT实现RESTful API的权限控制。通过设置过滤器，实现了用户注册、登录、JWT token的生成与验证，确保接口的安全访问。在Spring Security配置中，添加了自定义的JWTLoginFilter和JwtAuthenticationFilter，以完成登录认证和授权验证。JWT的无状态特性使其适用于分布式系统。
订阅专栏 解锁全文
扫一扫
1405
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
