使用Interceptor拦截器+jwt身份令牌完成用户登录和校验登录状态功能

1.引入依赖

	//jwt身份校验令牌
    implementation 'io.jsonwebtoken:jjwt-api:0.10.1'
    implementation 'io.jsonwebtoken:jjwt-impl:0.10.1'
    implementation 'io.jsonwebtoken:jjwt-jackson:0.10.1'
    //阿里巴巴json转换
    implementation 'com.alibaba:fastjson:1.2.83'

2.创建Interceptor配置类,自动拦截或放行配置好的路径

package com.yuzai.config;

import com.yuzai.interceptor.LoginCheckInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
    @Autowired
    private LoginCheckInterceptor loginCheckInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        String[] excludePatterns = new String[]{
                "/login",
                "/swagger-resources/**",
                "/swagger-ui/**",
                "/swagger-ui.html",
                "/swagger-ui.html/**",
                "/swagger-resources/**",
                "/api",
                "/api-docs",
                "/api-docs/**",
                "/webjars/**",
                "/doc.html/**",
                "/v2/**",
                "/v3/api-docs/**"};
        registry.addInterceptor(loginCheckInterceptor)
                .addPathPatterns("/**")//配置要拦截的路径
                .excludePathPatterns(excludePatterns);//配置不拦截的路径
    }
}

3.编写jwt工具类，负责生成和解析令牌

package com.yuzai.utils;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

import java.util.Date;
import java.util.Map;


public class JwtUtils {

    //秘钥
    private static String signKey = "yuzai798yuzai798yuzai798yuzai798yuzai798yuzai798yuzai798yuzai798";
    //有效期毫秒
    private static Long expire = 43200000L;

    /**
     * 生成JWT令牌
     * @param claims JWT第二部分负载 payload 中存储的内容
     * @return
     */
    public static String generateJwt(Map<String, Object> claims){
        String jwt = Jwts.builder()
                .addClaims(claims)
                .signWith(SignatureAlgorithm.HS256, signKey)
                .setExpiration(new Date(System.currentTimeMillis() + expire))
                .compact();
        return jwt;
    }

    /**
     * 解析JWT令牌
     * @param jwt JWT令牌
     * @return JWT第二部分负载 payload 中存储的内容
     */
    public static Claims parseJWT(String jwt){
        Claims claims = Jwts.parser()
                .setSigningKey(signKey)
                .parseClaimsJws(jwt)
                .getBody();
        return claims;
    }
}

4.编写登录校验类，使用jwt令牌校验当前是否为用户登录状态

package com.yuzai.interceptor;

import com.alibaba.fastjson.JSONObject;
import com.yuzai.pojo.Result;
import com.yuzai.utils.JwtUtils;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

@Component
@Slf4j
public class LoginCheckInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest req, HttpServletResponse resp, Object handler) throws Exception {
        System.out.println("LoginCheckInterceptor.preHandle");
        //1.获取请求url。
        String url = req.getRequestURL().toString();
        log.info("请求的url: {}",url);

        //2.判断请求url中是否包含login，如果包含，说明是登录操作，放行。可省略，可在配置类中添加拦截白名单
        if(url.contains("login")){
            return true;
        }

        //3.获取请求头中的令牌（token）。
        String jwt = req.getHeader("token");

        //4.判断令牌是否存在，如果不存在，返回错误结果（未登录）。
        if(jwt==null){
            log.info("请求头token为空,返回未登录的信息");
            Result error = Result.error("NOT_LOGIN");
            //手动转换 对象--json --------> 阿里巴巴fastJSON
            String notLogin = JSONObject.toJSONString(error);
            resp.getWriter().write(notLogin);
            return false;
        }

        //5.解析token，如果解析失败，返回错误结果（未登录）。
        try {
            JwtUtils.parseJWT(jwt);
        } catch (Exception e) {//jwt解析失败
            e.printStackTrace();
            log.info("解析令牌失败, 返回未登录错误信息");
            Result error = Result.error("NOT_LOGIN");
            //手动转换 对象--json --------> 阿里巴巴fastJSON
            String notLogin = JSONObject.toJSONString(error);
            resp.getWriter().write(notLogin);
            return false;
        }
        //6.放行。
        log.info("令牌合法, 放行");
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        System.out.println("LoginCheckInterceptor.postHandle");
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        System.out.println("LoginCheckInterceptor.afterCompletion");
    }
}

5.编写登录控制器

package com.yuzai.controller;

import com.yuzai.pojo.Emp;
import com.yuzai.pojo.Result;
import com.yuzai.service.EmpService;
import com.yuzai.utils.JwtUtils;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

@Slf4j
@RestController
public class LoginController {

    @Autowired
    private EmpService empServiceImpl;

    @PostMapping("/login")
    public Result login(@RequestBody Emp emp) {
        log.info("员工登录");
        Emp e = empServiceImpl.getEmpByUsernameAndPassword(emp);
        if (e != null){
            //创建jwt的载荷
            Map<String, Object> claims = new HashMap<>();
            claims.put("id", e.getId());
            claims.put("name", e.getName());
            claims.put("username", e.getUsername());
            //生成jwt令牌
            String jwt = JwtUtils.generateJwt(claims);
            //将jwt令牌按标准响应格式返回
            return Result.success(jwt);
        }
        return Result.error("用户名或密码错误");
    }
}