Springboot整合jwt，实现登录验证

最新推荐文章于 2024-05-09 11:50:53 发布

coolxiaoqi

最新推荐文章于 2024-05-09 11:50:53 发布

阅读量2.4k

点赞数 1

文章标签： spring boot Powered by 金山文档

本文链接：https://blog.csdn.net/coolxiaoqi/article/details/129149391

版权

一、JWT简介

1.JWT是什么

JSON Web Token (JWT)，它是目前最流行的跨域身份验证解决方案

例：jwt就相当于学校的出入证，只有持有出入证的人才能进行出入

2. 为什么使用JWT

JWT的精髓在于：“去中心化”，数据是保存在客户端的。

以session来举例，session是储存在服务器的，如果是按服务器来储存数据的话，那么服务器会占用很大的一个内存，而存储在客户端就解决了这个问题

3.jwt工作原理

用户登录时，输入账号密码，后端拿上账号密码去数据库里查是否正确并返回查询结果，在查询结果不为空（账号、密码正确）的前提下，将用户的id和账户名username拿上，并用JWT工具生成指定的token（登录凭证，并设置了过期时间）返回给前端，前端拿到token后存到localstorage或sessionstorage中，当用户再次访问服务器中需要登录才可访问的资源时，前端将存储的token设置在请求头中与前端请求一并发送到服务器，服务器通过设置的拦截器获得token并校验，若校验无误则放行；若校验发生异常则说明token有误，响应给前端提醒用户登录，返回false，不执行controller。

二、代码结构

三、实现

3.1、准备SQL语句

CREATE TABLE user (
  id int(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
  username varchar(255) DEFAULT NULL,
  password varchar(255) DEFAULT NULL
)
INSERT INTO `user` VALUES (1, 'chenxin', '123');
INSERT INTO `user` VALUES (2, 'jiandouluo', '123');

3.2、创建SpringBoot项目，添加相关依赖

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
        <groupId>com.auth0</groupId>
        <artifactId>java-jwt</artifactId>
        <version>3.19.2</version>
    </dependency>

    <dependency>
        <groupId>com.alibaba</groupId>
        <artifactId>druid-spring-boot-starter</artifactId>
        <version>1.1.17</version>
    </dependency>

    <dependency>
        <groupId>org.mybatis.spring.boot</groupId>
        <artifactId>mybatis-spring-boot-starter</artifactId>
        <version>2.2.2</version>
    </dependency>

    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
    </dependency>

    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
</dependencies>

3.3、application.yml

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/jwt?useSSL=false&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
    username: root
    password: root
    driver-class-name: com.mysql.cj.jdbc.Driver
mybatis:
  type-aliases-package: com.chenxin.springboot.jwt.bean
  mapper-locations: classpath:mapper/*.xml
logging:
  level:
    sql: debug

3.4、实体类

@Data
public class User {    
    private String id;    
    private String username;    
    private String password;
}

3.5、Jwt工具类（生成和校验token）

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTCreator;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.util.Calendar;
import java.util.Map;

public class JWTUtils {
    private static final String SING = "chenxin";
    /**
     * 生成token
     */
    public static String getToken(Map<String,String> map){
        Calendar instance = Calendar.getInstance();
        //默认7天过期
        instance.add(Calendar.DATE,7);
        //创建jwt builder
        JWTCreator.Builder builder = JWT.create();

        map.forEach((k,v)->{
            builder.withClaim(k,v);
        });

        String token = builder.withExpiresAt(instance.getTime())
                .sign(Algorithm.HMAC256(SING));
        return token;
    }

    /**
     * 验证token合法性,解析没有异常说明校验成功
     */
    public static DecodedJWT verify(String token){
        return JWT.require(Algorithm.HMAC256(SING)).build().verify(token);
    }
}

3.6、service & serviceImpl

public interface UserService {
    User login (User user);
}

3.7、Mapper

@Mapper
public interface UserMapper {
    User login(User user);
}

3.8、Handler

@RestController
@Slf4j
public class UserHandler {
    @Autowired
    private UserService userService;

    @GetMapping("/user/login")
    public Map<String,Object> login(User user){
        log.info("用户名：[{}]",user.getUsername());
        log.info("密码：[{}]",user.getPassword());

        Map<String, Object> map = new HashMap<>();

        try {
            User userDB = userService.login(user);
            Map<String,String> payload = new HashMap<>();
            payload.put("id",userDB.getId());
            payload.put("username",userDB.getUsername());
            //生成JWT令牌
            String token = JWTUtils.getToken(payload);
            map.put("state",true);
            map.put("token",token);
            map.put("msg","认证成功");
        }catch (Exception e){
            map.put("state",false);
            map.put("msg",e.getMessage());
        }
        return map;
    }

    @PostMapping("/user/test")
    public Map<String,Object> test(){
        log.info("看到这一句说明token校验通过了...");
        Map<String, Object> map = new HashMap<>();
        map.put("state",true);
        map.put("msg","请求成功");
        return map;
    }
}

3.9、UserMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<!-- 用户自己完善 -->
<mapper namespace="com.chenxin.springboot.jwt.mapper.UserMapper">
    <select id="login" parameterType="com.chenxin.springboot.jwt.bean.User" resultType="com.chenxin.springboot.jwt.bean.User">
        SELECT * FROM user WHERE username = #{username} AND password = #{password}
    </select>
</mapper>

3.10、配置拦截器

配置拦截器，这样得到jwt后，再次请求时把jwt放到请求头中，就可以不用当参数传递。

import com.auth0.jwt.exceptions.AlgorithmMismatchException;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.chenxin.springboot.jwt.util.JWTUtils;
import com.fasterxml.jackson.databind.ObjectMapper;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashMap;
import java.util.Map;
@Slf4j
public class JWTInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // 预检请求放行
        if ("OPTIONS".equalsIgnoreCase(request.getMethod())){
            return true;
        }
        Map<String, Object> map = new HashMap<>();
        // 获取请求头中的令牌
        String token = request.getHeader("token");
        log.info("请求头中的token是:{}",token);
        try {
            if("".equls(token)){
                // 抛出异常，被catch捕获
                throw new Exception();    
             }
            //验证令牌
            DecodedJWT verify = JWTUtils.verify(token);
            return true;
        } catch (SignatureVerificationException e){
            e.printStackTrace();
            map.put("msg","无效签名");
        } catch (TokenExpiredException e){
            e.printStackTrace();
            map.put("msg","token过期");
        } catch (AlgorithmMismatchException e){
            e.printStackTrace();
            map.put("msg","token算法不一致");
        } catch (Exception e){
            e.printStackTrace();
            map.put("msg","token无效");
        }
        map.put("state","flase");

        //将map转为json
        String json = new ObjectMapper().writeValueAsString(map);
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().println(json);
        return false;

    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {

    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {

    }
}

3.11、注册拦截器

import com.chenxin.springboot.jwt.interceptor.JWTInterceptor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new JWTInterceptor())
                //拦截
                .addPathPatterns("/user/test")
                //放行
                .excludePathPatterns("/user/login");
    }
}