使用
Spring Boot和Jwt进行身份
验证可以保护您的应用程序免受未经授权的访问。下面是使用
Spring Boot和Jwt进行身份
验证的步骤：
1. 添加相关依赖
在 `pom.xml` 文件中添加以下依赖：
```xml
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 创建JwtUtils类
创建一个 `JwtUtils` 类，用于生成和解析Jwt令牌。以下是一个示例实现：
```java
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.
springframework.beans.factory.annotation.Value;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.stereotype.Component;
import java.util.D
ate;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;
@Component
public class JwtUtils {
@Value("${jwt.secret}")
priv
ate String secret;
@Value("${jwt.expiration}")
priv
ate Long expiration;
public String gener
ateToken(UserDetails userDetails) {
Map<String, Object> claims = new HashMap<>();
return cre
ateToken(claims, userDetails.getUsername());
}
priv
ate String cre
ateToken(Map<String, Object> claims, String subject) {
D
ate now = new D
ate();
D
ate expirationD
ate = new D
ate(now.getTime() + expiration);
return Jwts.builder()
.setClaims(claims)
.setSubject(subject)
.setIssuedAt(now)
.setExpiration(expirationD
ate)
.signWith(SignatureAlgorithm.HS256, secret)
.compact();
}
public boolean
validateToken(String token, UserDetails userDetails) {
final String username = extractUsername(token);
return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
}
public boolean isTokenExpired(String token) {
final D
ate expirationD
ate = extractExpiration(token);
return expirationD
ate.before(new D
ate());
}
public String extractUsername(String token) {
return extractClaim(token, Claims::getSubject);
}
public D
ate extractExpiration(String token) {
return extractClaim(token, Claims::getExpiration);
}
public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
final Claims claims = extractAllClaims(token);
return claimsResolver.apply(claims);
}
priv
ate Claims extractAllClaims(String token) {
return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
}
}
```
3. 创建JwtRequestFilter
创建一个 `JwtRequestFilter` 类，用于
拦截所有安全请求并
验证Jwt令牌。以下是一个示例实现：
```java
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.
springframework.security.core.context.SecurityContextHolder;
import org.
springframework.security.core.userdetails.User;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.
springframework.stereotype.Component;
import org.
springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class JwtRequestFilter extends OncePerRequestFilter {
@Autowired
priv
ate UserDetailsService userDetailsService;
@Autowired
priv
ate JwtUtils jwtUtils;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
final String authorizationHeader = request.getHeader("Authorization");
String username = null;
String jwt = null;
if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
jwt = authorizationHeader.substring(7);
username = jwtUtils.extractUsername(jwt);
}
if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
if (jwtUtils.
validateToken(jwt, userDetails)) {
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
userDetails, null, userDetails.getAuthorities());
usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
}
}
filterChain.doFilter(request, response);
}
}
```
4. 创建JwtAuthenticationController
创建一个 `JwtAuthenticationController` 类，用于处理用户身份
验证请求并返回Jwt令牌。以下是一个示例实现：
```java
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.http.ResponseEntity;
import org.
springframework.security.authentication.AuthenticationManager;
import org.
springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.crypto.password.PasswordEncoder;
import org.
springframework.web.bind.annotation.*;
@RestController
public class JwtAuthenticationController {
@Autowired
priv
ate AuthenticationManager authenticationManager;
@Autowired
priv
ate UserDetailsService userDetailsService;
@Autowired
priv
ate JwtUtils jwtUtils;
@Autowired
priv
ate PasswordEncoder passwordEncoder;
@PostMapping("/authentic
ate")
public ResponseEntity<?> cre
ateAuthenticationToken(@RequestBody JwtRequest jwtRequest) throws Exception {
try {
authenticationManager.authentic
ate(
new UsernamePasswordAuthenticationToken(jwtRequest.getUsername(), jwtRequest.getPassword()));
} catch (Exception e) {
throw new Exception("Incorrect username or password", e);
}
final UserDetails userDetails = userDetailsService.loadUserByUsername(jwtRequest.getUsername());
final String token = jwtUtils.gener
ateToken(userDetails);
return ResponseEntity.ok(new JwtResponse(token));
}
@PostMapping("/register")
public ResponseEntity<?> saveUser(@RequestBody UserDto userDto) {
User user = new User(userDto.getUsername(), passwordEncoder.encode(userDto.getPassword()));
userDetailsService.save(user);
return ResponseEntity.ok(user);
}
}
```
5. 配置WebSecurityConfigurerAdapter
最后，我们需要配置WebSecurityConfigurerAdapter以启用基于Jwt的身份
验证。以下是一个示例实现：
```java
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.context.annotation.Bean;
import org.
springframework.context.annotation.Configuration;
import org.
springframework.security.authentication.AuthenticationManager;
import org.
springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.
springframework.security.config.annotation.web.builders.HttpSecurity;
import org.
springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.
springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.
springframework.security.config.http.SessionCreationPolicy;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.crypto.password.PasswordEncoder;
import org.
springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
priv
ate JwtRequestFilter jwtRequestFilter;
@Autowired
priv
ate UserDetailsService userDetailsService;
@Autowired
priv
ate PasswordEncoder passwordEncoder;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests().antMatchers("/authentic
ate", "/register").permitAll()
.anyRequest().authentic
ated()
.and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.ST
ATELESS);
http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
```
现在，您的
Spring Boot应用程序已经配置使用Jwt进行身份
验证。
本文介绍了如何在Spring Boot中实现全局拦截验证，包括启动配置MethodValidationPostProcessor，添加全局异常处理流程，自定义异常返回信息ValidateResult，并在方法参数上使用@Valid进行校验。同时展示了在待校验类上设置校验规则。
最低0.47元/天 解锁文章
扫一扫
4228
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
