Spring Boot和
Spring Security是非常常用的
Java框架和库，用于构建安全和可扩展的Web应用程序。JWT（JSON Web Token）是一种用于在网络应用间安全传递身份验证和声明信息的标准。
要在
Spring Boot中使用
Spring Security和JWT，你需要进行以下步骤：
1. 添加依赖：在你的项目的pom.xml文件中添加
Spring Security和JWT的依赖。
```xml
<dependency>
<groupId>org.
springframework.boot</groupId>
<artifactId>
spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 创建JWT工具类：编写一个JWT工具类，用于生成和解析JWT。
```
java
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.
springframework.security.core.userdetails.UserDetails;
import
java.util.Date;
import
java.util.HashMap;
import
java.util.Map;
public class JwtUtil {
private static final String SECRET_KEY = "your-secret-key";
private static final long EXPIRATION_TIME = 864_000_000; // 10 days
public static String generateToken(UserDetails userDetails) {
Map<String, Object> claims = new HashMap<>();
return Jwts.builder()
.setClaims(claims)
.setSubject(userDetails.getUsername())
.setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME))
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
}
public static String extractUsername(String token) {
return extractClaims(token).getSubject();
}
public static Date extractExpiration(String token) {
return extractClaims(token).getExpiration();
}
private static Claims extractClaims(String token) {
return Jwts.parser()
.setSigningKey(SECRET_KEY)
.parseClaimsJws(token)
.getBody();
}
}
```
3. 配置
Spring Security：创建一个继承自WebSecurityConfigurerAdapter的配置类，用于配置
Spring Security。
```
java
import org.
springframework.
beans.factory.annotation.Autowired;
import org.
springframework.context.annotation.
Bean;
import org.
springframework.context.annotation.Configuration;
import org.
springframework.security.authentication.AuthenticationManager;
import org.
springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.
springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.
springframework.security.config.annotation.web.builders.HttpSecurity;
import org.
springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.
springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.
springframework.security.config.http.SessionCreationPolicy;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.crypto.password.PasswordEncoder;
import org.
springframework.security.crypto.password.Pbkdf2PasswordEncoder;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/api/auth/**").permitAll()
.anyRequest().authenticated()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
@
Bean
public PasswordEncoder passwordEncoder() {
return new Pbkdf2PasswordEncoder();
}
@Override
@
Bean
public AuthenticationManager authenticationManager
Bean() throws Exception {
return super.authenticationManager
Bean();
}
}
```
4. 创建UserDetails实现类：实现
Spring Security的UserDetails接口，用于获取用户信息。
```
java
import org.
springframework.security.core.GrantedAuthority;
import org.
springframework.security.core.userdetails.UserDetails;
import
java.util.
Collection;
import
java.util.List;
public class CustomUserDetails implements UserDetails {
private String username;
private String password;
public CustomUserDetails(String username, String password) {
this.username = username;
this.password = password;
}
@Override
public
Collection<? extends GrantedAuthority> getAuthorities() {
return List.of(() -> "ROLE_USER");
}
@Override
public String getPassword() {
return password;
}
@Override
public String getUsername() {
return username;
}
// Other UserDetails methods...
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
```
5. 创建认证和授权的Controller：创建一个RestController，用于处理用户认证和授权的请求。
```
java
import org.
springframework.
beans.factory.annotation.Autowired;
import org.
springframework.http.ResponseEntity;
import org.
springframework.security.authentication.AuthenticationManager;
import org.
springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.web.bind.annotation.*;
@RestController
@RequestMapping("/api/auth")
public class AuthController {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private UserDetailsService userDetailsService;
@PostMapping("/login")
public ResponseEntity<String> login(@RequestBody AuthRequest authRequest) {
authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(authRequest.getUsername(), authRequest.getPassword())
);
UserDetails userDetails = userDetailsService.loadUserByUsername(authRequest.getUsername());
String token = JwtUtil.generateToken(userDetails);
return ResponseEntity.ok(token);
}
}
class AuthRequest {
private String username;
private String password;
// getters and setters...
}
```
这样，你就可以在
Spring Boot应用程序中使用
Spring Security和JWT来实现认证和授权了。当用户登录时，会生成一个JWT，并在以后的请求中使用该JWT进行身份验证。
请注意，以上代码只是一个简单的示例，你可能需要根据你的实际需求进行适当的修改和扩展。另外，确保保护敏感信息（如密钥）的安全。
851
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
