使用Spring Boot和
Jwt进行身份验证可以保护您的应用程序免受未经授权的访问。下面是
使用Spring Boot和
Jwt进行身份验证的步骤：
1. 添加相关依赖
在 `pom.xml` 文件中添加以下依赖：
```xml
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 创建
JwtUtils类
创建一个 `
JwtUtils` 类，用于生成和解析
Jwt令牌。以下是一个示例实现：
```java
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.
Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.
springframework.beans.factory.annotation.Value;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.stereotype.Component;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;
@Component
public class
JwtUtils {
@Value("${
jwt.secret}")
private String secret;
@Value("${
jwt.expiration}")
private Long expiration;
public String generateToken(UserDetails userDetails) {
Map<String, Object> claims = new HashMap<>();
return createToken(claims, userDetails.getUsername());
}
private String createToken(Map<String, Object> claims, String subject) {
Date now = new Date();
Date expirationDate = new Date(now.getTime() + expiration);
return
Jwts.builder()
.setClaims(claims)
.setSubject(subject)
.setIssuedAt(now)
.setExpiration(expirationDate)
.signWith(SignatureAlgorithm.HS256, secret)
.compact();
}
public boolean validateToken(String token, UserDetails userDetails) {
final String username = extractUsername(token);
return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
}
public boolean isTokenExpired(String token) {
final Date expirationDate = extractExpiration(token);
return expirationDate.before(new Date());
}
public String extractUsername(String token) {
return extractClaim(token, Claims::getSubject);
}
public Date extractExpiration(String token) {
return extractClaim(token, Claims::getExpiration);
}
public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
final Claims claims = extractAllClaims(token);
return claimsResolver.apply(claims);
}
private Claims extractAllClaims(String token) {
return
Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
}
}
```
3. 创建
JwtRequestFilter
创建一个 `
JwtRequestFilter` 类，用于拦截所有安全请求并验证
Jwt令牌。以下是一个示例实现：
```java
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.
springframework.security.core.context.SecurityContextHolder;
import org.
springframework.security.core.userdetails.User;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.
springframework.stereotype.Component;
import org.
springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class
JwtRequestFilter extends OncePerRequestFilter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
JwtUtils
jwtUtils;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
final String authorizationHeader = request.getHeader("Authorization");
String username = null;
String
jwt = null;
if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
jwt = authorizationHeader.substring(7);
username =
jwtUtils.extractUsername(
jwt);
}
if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
if (
jwtUtils.validateToken(
jwt, userDetails)) {
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
userDetails, null, userDetails.getAuthorities());
usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
}
}
filterChain.doFilter(request, response);
}
}
```
4. 创建
JwtAuthenticationController
创建一个 `
JwtAuthenticationController` 类，用于处理用户身份验证请求并返回
Jwt令牌。以下是一个示例实现：
```java
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.http.ResponseEntity;
import org.
springframework.security.authentication.AuthenticationManager;
import org.
springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.
springframework.security.core.userdetails.UserDetails;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.crypto.password.PasswordEncoder;
import org.
springframework.web.bind.annotation.*;
@RestController
public class
JwtAuthenticationController {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private PasswordEncoder passwordEncoder;
@PostMapping("/authenticate")
public ResponseEntity<?> createAuthenticationToken(@RequestBody
JwtRequest
jwtRequest) throws Exception {
try {
authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
jwtRequest.getUsername(),
jwtRequest.getPassword()));
} catch (Exception e) {
throw new Exception("Incorrect username or password", e);
}
final UserDetails userDetails = userDetailsService.loadUserByUsername(
jwtRequest.getUsername());
final String token =
jwtUtils.generateToken(userDetails);
return ResponseEntity.ok(new
JwtResponse(token));
}
@PostMapping("/register")
public ResponseEntity<?> saveUser(@RequestBody UserDto userDto) {
User user = new User(userDto.getUsername(), passwordEncoder.encode(userDto.getPassword()));
userDetailsService.save(user);
return ResponseEntity.ok(user);
}
}
```
5. 配置WebSecurityConfigurerAdapter
最后，我们需要配置WebSecurityConfigurerAdapter以启用基于
Jwt的身份验证。以下是一个示例实现：
```java
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.context.annotation.Bean;
import org.
springframework.context.annotation.Configuration;
import org.
springframework.security.authentication.AuthenticationManager;
import org.
springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.
springframework.security.config.annotation.web.builders.HttpSecurity;
import org.
springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.
springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.
springframework.security.config.http.SessionCreationPolicy;
import org.
springframework.security.core.userdetails.UserDetailsService;
import org.
springframework.security.crypto.password.PasswordEncoder;
import org.
springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private
JwtRequestFilter
jwtRequestFilter;
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private PasswordEncoder passwordEncoder;
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests().antMatchers("/authenticate", "/register").permitAll()
.anyRequest().authenticated()
.and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(
jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
```
现在，您的
Spring Boot应用程序已经配置
使用Jwt进行身份验证。
本文介绍了如何在Spring Boot项目中使用JWT进行权限验证。内容包括引入JWT组件，创建JWT工具类，设置拦截器验证Token合法性，并讨论了密码修改后旧Token失效和单点登录的简单实现。拦截器利用自定义工具类验证前端传回的Token，并通过Redis存储敏感信息以确保安全性。
最低0.47元/天 解锁文章
4288
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
