Spring Security可以
使用JWT（JSON Web
Token）来
验证用户的身份和权限。
1.添加JWT依赖项：在pom.xml文件中添加以下依赖项：
```
<dependency>
<groupId>io.jsonweb
token</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2.创建JWT工具类：创建一个JWT工具类来生成和
验证JWT。
```
import io.jsonweb
token.Jwts;
import io.jsonweb
token.SignatureAlgorithm;
import org.springframework.security.core.
Authentication;
import org.springframework.security.core.userdetails.User;
import org.springframework.stereotype.Component;
import java.util.Date;
@Component
public class JwtUtils {
private final String JWT_SECRET = "mysecretkey";
private final int JWT_EXPIRATION_MS = 86400000;
public String generateJwt
Token(
Authentication
authentication) {
User user = (User)
authentication.getPrincipal();
return Jwts.builder()
.setSubject((user.getUsername()))
.setIssuedAt(new Date())
.setExpiration(new Date((new Date()).getTime() + JWT_EXPIRATION_MS))
.signWith(SignatureAlgorithm.HS512, JWT_SECRET)
.compact();
}
public boolean validateJwt
Token(String
authToken) {
try {
Jwts.parser().setSigningKey(JWT_SECRET).parseClaimsJws(
authToken);
return true;
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
public String getUsernameFromJwt
Token(String
token) {
return Jwts.parser()
.setSigningKey(JWT_SECRET)
.parseClaimsJws(
token)
.getBody().getSubject();
}
}
```
3.创建JWT过滤器：创建一个JWT过滤器来
验证JWT并设置
用户的身份和权限。
```
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.
authentication.UsernamePassword
Authentication
Token;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.
authentication.Web
AuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import com.example.demo.security.services.UserDetailsServiceImpl;
import io.jsonweb
token.ExpiredJwtException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class Jwt
AuthTokenFilter extends OncePerRequestFilter {
@Autowired
private JwtUtils jwtUtils;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
try {
String jwt = parseJwt(request);
if (jwt != null && jwtUtils.validateJwt
Token(jwt)) {
String username = jwtUtils.getUsernameFromJwt
Token(jwt);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePassword
Authentication
Token authentication = new UsernamePassword
Authentication
Token(userDetails, null, userDetails.get
Authorities());
authentication.setDetails(new Web
AuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().set
Authentication(
authentication);
}
} catch (ExpiredJwtException e) {
logger.error("JWT
token is expired: {}", e.getMessage());
} catch (Exception e) {
logger.error("Cannot set user
authentication: {}", e.getMessage());
}
chain.doFilter(request, response);
}
private String parseJwt(HttpServletRequest request) {
String header
Auth = request.getHeader("
Authorization");
if (header
Auth != null && header
Auth.startsWith("Bearer ")) {
return header
Auth.substring(7, header
Auth.length());
}
return null;
}
}
```
4.配置Spring Security：在Spring Security配置中添加JWT过滤器。
```
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.
authentication.
AuthenticationManager;
import org.springframework.security.
authentication.dao.Dao
AuthenticationProvider;
import org.springframework.security.config.annotation.
authentication.builders.
AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.
authentication.UsernamePassword
AuthenticationFilter;
import com.example.demo.security.jwt.Jwt
AuthTokenFilter;
import com.example.demo.security.services.UserDetailsServiceImpl;
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(
// securedEnabled = true,
// jsr250Enabled = true,
prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private Jwt
AuthTokenFilter jwt
AuthTokenFilter;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
@Bean
public Dao
AuthenticationProvider
authenticationProvider() {
Dao
AuthenticationProvider
authProvider = new Dao
AuthenticationProvider();
authProvider.setUserDetailsService(userDetailsService);
authProvider.setPasswordEncoder(bCryptPasswordEncoder);
return
authProvider;
}
@Override
public void configure(
AuthenticationManagerBuilder
authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
}
@Bean
@Override
public
AuthenticationManager
authenticationManagerBean() throws Exception {
return super.
authenticationManagerBean();
}
@Bean
public BCryptPasswordEncoder bCryptPasswordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.
authorizeRequests()
.antMatchers("/api/
auth/**").permitAll()
.anyRequest().
authenticated();
http.addFilterBefore(jwt
AuthTokenFilter, UsernamePassword
AuthenticationFilter.class);
}
}
```
现在，Spring Security将
使用JWT来
验证用户的身份和权限。您可以在需要身份
验证和授权的端点上
使用Spring Security注释，例如@Pre
Authorize和@Post
Authorize。
最低0.47元/天 解锁文章
1万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
