一、JWT简介
1.JWT是什么
JSON Web Token (JWT),它是目前最流行的跨域身份验证解决方案
例:jwt就相当于学校的出入证,只有持有出入证的人才能进行出入
2. 为什么使用JWT
JWT的精髓在于:“去中心化”,数据是保存在客户端的。
以session来举例,session是储存在服务器的,如果是按服务器来储存数据的话,那么服务器会占用很大的一个内存,而存储在客户端就解决了这个问题
3.jwt工作原理
用户登录时,输入账号密码,后端拿上账号密码去数据库里查是否正确并返回查询结果,在查询结果不为空(账号、密码正确)的前提下,将用户的id和账户名username拿上,并用JWT工具生成指定的token(登录凭证,并设置了过期时间)返回给前端,前端拿到token后存到localstorage或sessionstorage中,当用户再次访问服务器中需要登录才可访问的资源时,前端将存储的token设置在请求头中与前端请求一并发送到服务器,服务器通过设置的拦截器获得token并校验,若校验无误则放行;若校验发生异常则说明token有误,响应给前端提醒用户登录,返回false,不执行controller。
二、代码结构
三、实现
3.1、准备SQL语句
CREATE TABLE user (
id int(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
username varchar(255) DEFAULT NULL,
password varchar(255) DEFAULT NULL
)
INSERT INTO `user` VALUES (1, 'chenxin', '123');
INSERT INTO `user` VALUES (2, 'jiandouluo', '123');
3.2、创建SpringBoot项目,添加相关依赖
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.19.2</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid-spring-boot-starter</artifactId>
<version>1.1.17</version>
</dependency>
<dependency>
<groupId>org.mybatis.spring.boot</groupId>
<artifactId>mybatis-spring-boot-starter</artifactId>
<version>2.2.2</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
3.3、application.yml
spring:
datasource:
url: jdbc:mysql://localhost:3306/jwt?useSSL=false&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
username: root
password: root
driver-class-name: com.mysql.cj.jdbc.Driver
mybatis:
type-aliases-package: com.chenxin.springboot.jwt.bean
mapper-locations: classpath:mapper/*.xml
logging:
level:
sql: debug
3.4、实体类
@Data
public class User {
private String id;
private String username;
private String password;
}
3.5、Jwt工具类(生成和校验token)
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTCreator;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import java.util.Calendar;
import java.util.Map;
public class JWTUtils {
private static final String SING = "chenxin";
/**
* 生成token
*/
public static String getToken(Map<String,String> map){
Calendar instance = Calendar.getInstance();
//默认7天过期
instance.add(Calendar.DATE,7);
//创建jwt builder
JWTCreator.Builder builder = JWT.create();
map.forEach((k,v)->{
builder.withClaim(k,v);
});
String token = builder.withExpiresAt(instance.getTime())
.sign(Algorithm.HMAC256(SING));
return token;
}
/**
* 验证token合法性,解析没有异常说明校验成功
*/
public static DecodedJWT verify(String token){
return JWT.require(Algorithm.HMAC256(SING)).build().verify(token);
}
}
3.6、service & serviceImpl
public interface UserService {
User login (User user);
}
3.7、Mapper
@Mapper
public interface UserMapper {
User login(User user);
}
3.8、Handler
@RestController
@Slf4j
public class UserHandler {
@Autowired
private UserService userService;
@GetMapping("/user/login")
public Map<String,Object> login(User user){
log.info("用户名:[{}]",user.getUsername());
log.info("密码:[{}]",user.getPassword());
Map<String, Object> map = new HashMap<>();
try {
User userDB = userService.login(user);
Map<String,String> payload = new HashMap<>();
payload.put("id",userDB.getId());
payload.put("username",userDB.getUsername());
//生成JWT令牌
String token = JWTUtils.getToken(payload);
map.put("state",true);
map.put("token",token);
map.put("msg","认证成功");
}catch (Exception e){
map.put("state",false);
map.put("msg",e.getMessage());
}
return map;
}
@PostMapping("/user/test")
public Map<String,Object> test(){
log.info("看到这一句说明token校验通过了...");
Map<String, Object> map = new HashMap<>();
map.put("state",true);
map.put("msg","请求成功");
return map;
}
}
3.9、UserMapper.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<!-- 用户自己完善 -->
<mapper namespace="com.chenxin.springboot.jwt.mapper.UserMapper">
<select id="login" parameterType="com.chenxin.springboot.jwt.bean.User" resultType="com.chenxin.springboot.jwt.bean.User">
SELECT * FROM user WHERE username = #{username} AND password = #{password}
</select>
</mapper>
3.10、配置拦截器
配置拦截器,这样得到jwt后,再次请求时把jwt放到请求头中,就可以不用当参数传递。
import com.auth0.jwt.exceptions.AlgorithmMismatchException;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.chenxin.springboot.jwt.util.JWTUtils;
import com.fasterxml.jackson.databind.ObjectMapper;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashMap;
import java.util.Map;
@Slf4j
public class JWTInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
// 预检请求放行
if ("OPTIONS".equalsIgnoreCase(request.getMethod())){
return true;
}
Map<String, Object> map = new HashMap<>();
// 获取请求头中的令牌
String token = request.getHeader("token");
log.info("请求头中的token是:{}",token);
try {
if("".equls(token)){
// 抛出异常,被catch捕获
throw new Exception();
}
//验证令牌
DecodedJWT verify = JWTUtils.verify(token);
return true;
} catch (SignatureVerificationException e){
e.printStackTrace();
map.put("msg","无效签名");
} catch (TokenExpiredException e){
e.printStackTrace();
map.put("msg","token过期");
} catch (AlgorithmMismatchException e){
e.printStackTrace();
map.put("msg","token算法不一致");
} catch (Exception e){
e.printStackTrace();
map.put("msg","token无效");
}
map.put("state","flase");
//将map转为json
String json = new ObjectMapper().writeValueAsString(map);
response.setContentType("application/json;charset=UTF-8");
response.getWriter().println(json);
return false;
}
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
}
}
3.11、注册拦截器
import com.chenxin.springboot.jwt.interceptor.JWTInterceptor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new JWTInterceptor())
//拦截
.addPathPatterns("/user/test")
//放行
.excludePathPatterns("/user/login");
}
}
四、测试
4.1、使用APIPost测试登录请求
请求方式:get
请求路径:http://localhost:8080/user/login?username=chenxin&password=123
4.2、使用APIPost测试放行请求
请求方式:post
请求路径:http://localhost:8080/user/test