JWT 使用分析

JWT 使用分析

• JWT 即(JSON WEB TOKEN)，用于前后端分离的web项目的身份验证。

• JWT计算方式

• JAVA实现依赖jar包

  <dependency>
          <groupId>io.jsonwebtoken</groupId>
          <artifactId>jjwt-api</artifactId>
          <version>0.10.7</version>
      </dependency>
      <dependency>
          <groupId>io.jsonwebtoken</groupId>
          <artifactId>jjwt-impl</artifactId>
          <version>0.10.7</version>
          <scope>runtime</scope>
      </dependency>
      <dependency>
          <groupId>io.jsonwebtoken</groupId>
          <artifactId>jjwt-jackson</artifactId>
          <version>0.10.7</version>
          <scope>runtime</scope>
      </dependency>
  

• JWT 工具类

  package com.example.demo.util;
  
  import io.jsonwebtoken.Claims;
  import io.jsonwebtoken.Jwts;
  import io.jsonwebtoken.SignatureAlgorithm;
  import io.jsonwebtoken.security.Keys;
  import io.jsonwebtoken.security.SignatureException;
  import org.slf4j.Logger;
  import org.slf4j.LoggerFactory;
  
  import java.security.Key;
  import java.util.*;
  
  public class JWTUtil {
  
      private static final Logger LOGGER = LoggerFactory.getLogger(JWTUtil.class);
  
      private static final char[] CHARS = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'};
  
      /**
       * secret key
       */
      private static final String SECRET_KEY = "bWtGpkmRgPEMd24XO0dl7BqspN5Dj9a5lPdgtBdj179PwxiRGYVzcdunZKw5PXFbs";
  
      /**
       * 过期时间，秒
       */
      private static final Long EXPIRED_TIME = 24 * 60 * 60L;
  
      /**
       * 生成token
       * @param username
       * @return
       */
      public static String generateToken(String username) {
          String jws = Jwts.builder().setSubject(username).signWith(SignatureAlgorithm.HS256, SECRET_KEY).setExpiration(new Date(System.currentTimeMillis() + EXPIRED_TIME * 1000)).compact();
          return jws;
      }
  
      /**
       * 根据token获取claims
       * @param token
       * @return
       */
      public static Claims getClaims(String token) {
          Claims claims = null;
          try {
              claims = Jwts.parser()
                      .setSigningKey(SECRET_KEY)
                      .parseClaimsJws(token)
                      .getBody();
          } catch (SignatureException e) {
              LOGGER.info("token validate sign fail.");
          }
          return claims;
      }
  
      /**
       * 获取用户名
       * @param token
       * @return
       */
      public static String getPrinciple(String token) {
          Claims claims = getClaims(token);
          return claims != null ? claims.getSubject() : null;
      }
  
      /**
       * 判断是否过期
       */
      public static boolean isExpired(String token) {
          Claims claims = getClaims(token);
          return claims.getExpiration().before(new Date()) ? true : false;
      }
  
      /**
       * 是否验证通过
       */
      public static boolean isValidated(String token) {
          Claims claims = getClaims(token);
          return getPrinciple(token) == null ? false : true;
      }
  
  
      /**
       * 生成256bit的签名key
       * 该key只生成一次，放在配置文件中
       *
       * @return
       */
      public static String generateSignKey() {
          StringBuilder sb = new StringBuilder();
          for (int i = 0; i < 65; i++) {
              int r = new Random().nextInt(62);
              sb.append(CHARS[r]);
          }
          return sb.toString();
      }
  
      public static void main(String[] args) {
          String token = generateToken("aaa");
          System.out.println(token);
          getClaims("eyJhbGciOiJIUzI1NiJ9.eyJzdddWIiOiJhYWEifQ._ed7iKUnqDqOuRRT8NLavaL_xRgJ-akm68h0KjWrkac");
  //        System.out.println(generateSignKey());
      }
  }