在Spring Boot中，可以使用以下步骤将
JWT集成到应用程序中以
实现token认证：
1. 添加依赖项
在pom.xml文件中添加以下依赖项：
```
<dependency>
<groupId>io.jsonweb
token</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 创建
Token工具类
创建一个
JwtTokenUtil工具类，该类将用于
生成和
验证JWT令牌。以下是一个基本的
JwtTokenUtil类：
```java
public class
JwtTokenUtil {
private static final String SECRET_KEY = "secret";
public static String generate
Token(String username) {
Date now = new Date();
Date expiryDate = new Date(now.getTime() + 3600000);
return
Jwts.builder()
.setSubject(username)
.setIssuedAt(now)
.setExpiration(expiryDate)
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
}
public static String getUsernameFrom
Token(String
token) {
return
Jwts.parser()
.setSigningKey(SECRET_KEY)
.parseClaimsJws(
token)
.getBody()
.getSubject();
}
public static boolean validate
Token(String
token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(
token);
return true;
} catch (SignatureException ex) {
System.out.println("Invalid
JWT signature");
} catch (Malformed
JwtException ex) {
System.out.println("Invalid
JWT token");
} catch (Expired
JwtException ex) {
System.out.println("Expired
JWT token");
} catch (Unsupported
JwtException ex) {
System.out.println("Unsupported
JWT token");
} catch (IllegalArgumentException ex) {
System.out.println("
JWT claims string is empty.");
}
return false;
}
}
```
3. 创建安全
配置类
创建一个SecurityConfig类，该类将用于
配置Spring Security以使用
JWT进行认证。以下是一个基本的SecurityConfig类：
```java
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private
JwtAuthenticationEntryPoint
jwtAuthenticationEntryPoint;
@Autowired
private
JwtUserDetailsService
jwtUserDetailsService;
@Autowired
public void configureGlobal(
AuthenticationManagerBuilder
auth) throws Exception {
auth.userDetailsService(
jwtUserDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public
JwtAuthenticationFilter
jwtAuthenticationFilter() {
return new
JwtAuthenticationFilter();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
@Bean
public
AuthenticationManager
authenticationManagerBean() throws Exception {
return super.
authenticationManagerBean();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.
authorizeRequests().antMatchers("/
authenticate").permitAll()
.anyRequest().
authenticated().and()
.exceptionHandling().
authenticationEntryPoint(
jwtAuthenticationEntryPoint).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(
jwtAuthenticationFilter(), UsernamePassword
AuthenticationFilter.class);
}
}
```
4. 创建
用户详细信息服务类
创建一个
JwtUserDetailsService类，该类将用于从数据库或其他存储中获取
用户信息以进行身份
验证。以下是一个基本的
JwtUserDetailsService类：
```java
@Service
public class
JwtUserDetailsService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
// 在这里获取
用户信息并返回UserDetails对象
return null;
}
}
```
5. 创建身份
验证过滤
器
创建一个
JwtAuthenticationFilter类，该类将用于
拦截所有
请求，并进行
JWT身份
验证。以下是一个基本的
JwtAuthenticationFilter类：
```java
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private
JwtUserDetailsService
jwtUserDetailsService;
@Autowired
private
JwtTokenUtil
jwtTokenUtil;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
final String request
TokenHeader = request.getHeader("
Authorization");
String username = null;
String
jwtToken = null;
//
JWT Token is in the form "Bearer
token". Remove Bearer word and get only the
Token
if (request
TokenHeader != null && request
TokenHeader.startsWith("Bearer ")) {
jwtToken = request
TokenHeader.substring(7);
try {
username =
jwtTokenUtil.getUsernameFrom
Token(
jwtToken);
} catch (IllegalArgumentException e) {
System.out.println("Unable to get
JWT Token");
} catch (Expired
JwtException e) {
System.out.println("
JWT Token has expired");
}
} else {
logger.warn("
JWT Token does not begin with Bearer String");
}
// Once we get the
token validate it.
if (username != null && SecurityContextHolder.getContext().get
Authentication() == null) {
UserDetails userDetails = this.
jwtUserDetailsService.loadUserByUsername(username);
// if
token is valid configure Spring Security to manually set
authentication
if (
jwtTokenUtil.validate
Token(
jwtToken)) {
UsernamePassword
Authentication
Token usernamePassword
Authentication
Token = new UsernamePassword
Authentication
Token(
userDetails, null, userDetails.get
Authorities());
usernamePassword
Authentication
Token
.setDetails(new Web
AuthenticationDetailsSource().buildDetails(request));
// After setting the
Authentication in the context, we specify
// that the current user is
authenticated. So it passes the
// Spring Security Configurations successfully.
SecurityContextHolder.getContext().set
Authentication(usernamePassword
Authentication
Token);
}
}
chain.doFilter(request, response);
}
}
```
6. 创建身份
验证控制
器
创建一个
JwtAuthenticationController类，该类将用于处理身份
验证请求，
生成JWT令牌并返回给客户端。以下是一个基本的
JwtAuthenticationController类：
```java
@RestController
public class
JwtAuthenticationController {
@Autowired
private
AuthenticationManager
authenticationManager;
@Autowired
private
JwtTokenUtil
jwtTokenUtil;
@Autowired
private
JwtUserDetailsService
jwtUserDetailsService;
@RequestMapping(value = "/
authenticate", method = RequestMethod.POST)
public ResponseEntity<?> create
Authentication
Token(@RequestBody
JwtRequest
authenticationRequest) throws Exception {
authenticate(
authenticationRequest.getUsername(),
authenticationRequest.getPassword());
final UserDetails userDetails =
jwtUserDetailsService
.loadUserByUsername(
authenticationRequest.getUsername());
final String
token =
jwtTokenUtil.generate
Token(userDetails.getUsername());
return ResponseEntity.ok(new
JwtResponse(
token));
}
private void
authenticate(String username, String password) throws Exception {
try {
authenticationManager.
authenticate(new UsernamePassword
Authentication
Token(username, password));
} catch (DisabledException e) {
throw new Exception("USER_DISABLED", e);
} catch (BadCredentialsException e) {
throw new Exception("INVALID_CREDENTIALS", e);
}
}
}
```
现在，您的Spring Boot应用程序已经
集成了
JWT以进行身份
验证。
超级会员免费看
订阅专栏 解锁全文
8201
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
