springcloud springboot 基于token的登录认证,redis存放token,filter统一验证登录状态 项目完善04

实现思路:用户ajax登录后生成token存在redis,前端把token存储到localstorage/sessionStorage或其他地方,
后续的请求ajax header头部每次需携带token访问后台。

基于token的好处:放弃cookie,session的会话保持方式,方便非WEB端(没有cookie,session技术的场景),如APP端使用。
之前web端采用cookie,session的会话保持方式,app端还得单独写一套基于token的会话保持机制,WEB端也采用token技术可以兼容一套会话技术同时支持Web端,app端,小程序端。而且没使用cookie的话在前后端分离项目中跨域问题也好解决。

一.代码

我是先功能写好在记录到博客的,方便备用

1.创建用户表 system_user

使用的mysql数据库

CREATE TABLE `system_user` (
  `TID` int(255) NOT NULL COMMENT '主键',
  `USERID` varchar(20) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '用户账号 ',
  `USERNAME` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '用户姓名',
  `USERPASSWORD` varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '用户密码',
  PRIMARY KEY (`TID`),
  UNIQUE KEY `USERID_INDEX_3175324` (`USERID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

2.编写SystemUserEntity

package com.wying.myspringbootframework.entity;

import java.io.Serializable;

/**
 * description:系统用户表entity
 * date: 2022/5/1
 * author: gaom
 * version: 1.0
 */
public class SystemUserEntity implements Serializable {
   


    private static final long serialVersionUID = 5103817236007281546L;

    private int tid;

    private String userId;

    private String userName;

    private  String userPassword;



    public int getTid() {
   
        return tid;
    }

    public void setTid(int tid) {
   
        this.tid = tid;
    }

    public String getUserId() {
   
        return userId;
    }

    public void setUserId(String userId) {
   
        this.userId = userId;
    }

    public String getUserName() {
   
        return userName;
    }

    public void setUserName(String userName) {
   
        this.userName = userName;
    }

    public String getUserPassword() {
   
        return userPassword;
    }

    public void setUserPassword(String userPassword) {
   
        this.userPassword = userPassword;
    }


    @Override
    public String toString() {
   
        return "SystemUserEntity{" +
                "tid=" + tid +
                ", userId='" + userId + '\'' +
                ", userName='" + userName + '\'' +
                ", userPassword='" + userPassword + '\'' +
                '}';
    }
}

3.编写SystemUserDTO

关于entiry和DTO

Entity:通常来说一个entiry一般对应一个实体表,但是我们业务中经常多表联查,select 几张表的字段,此时一个entiey的字段就是对应几个表了。总之entiry用于接收mybatis sql查询的结果,大部分查询都是返回一个表的数据。
DTO:数据传输对象,select查询出的结果对应entity,但是实际业务中还有其他属性需要传递。
如SystemUserDTO 还包含userToken,而SystemUserEntity 对应实体表system_user没userToken字段,我们强行在SystemUserEntity增加userToken属性显然不规范,所以还需要有DTO的存在,虽然DTO的属性和Entiry很多重复,但是还是有必要单独存在。在service层查询出数据放到entiry了,
通过BeanUtils等工具类把entiry数据拷贝到DTO,然后其他附加的属性全在DTO增加。

package com.wying.myspringbootframework.dto;

import java.io.Serializable;

/**
 * description:系统用户表DTO
 * date: 2022/5/1
 * author: gaom
 * version: 1.0
 */
public class SystemUserDTO implements Serializable {
   
    private static final long serialVersionUID = -3260007298544023624L;

    private int tid;

    private String userId;

    private String userName;

    private  String userPassword;

    private  String userToken;

    public int getTid() {
   
        return tid;
    }

    public void setTid(int tid) {
   
        this.tid = tid;
    }

    public String getUserId() {
   
        return userId;
    }

    public void setUserId(String userId) {
   
        this.userId = userId;
    }

    public String getUserName() {
   
        return userName;
    }

    public void setUserName(String userName) {
   
        this.userName = userName;
    }

    public String getUserPassword() {
   
        return userPassword;
    }

    public void setUserPassword(String userPassword) {
   
        this.userPassword = userPassword;
    }

    public String getUserToken() {
   
        return userToken;
    }

    public void setUserToken(String userToken) {
   
        this.userToken = userToken;
    }

    @Override
    public String toString() {
   
        return "SystemUserDTO{" +
                "tid=" + tid +
                ", userId='" + userId + '\'' +
                ", userName='" + userName + '\'' +
                ", userPassword='" + userPassword + '\'' +
                ", userToken='" + userToken + '\'' +
                '}';
    }
}

4.DAO层

package com.wying.myspringbootframework.dao;

import com.wying.myspringbootframework.entity.SystemUserEntity;
import org.apache.ibatis.annotations.Mapper;

import java.util.List;

/**
 * description:登录服务 DAO层
 * date: 2022/4/30
 * author: gaom
 * version: 1.0
 */
@Mapper
public interface LogonDao {
   

     List<SystemUserEntity> findUserByUserId(String userId);

}

5. mapper xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.wying.myspringbootframework.dao.LogonDao">
    <resultMap id="BaseResultMap" type="com.wying.myspringbootframework.entity.SystemUserEntity">
        <id column="TID" jdbcType="INTEGER" property="tid" />
        <result column="USERID" <
  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
Spring Boot中实现JWT登录验证可以结合Shiro和Redis来实现。下面是一个简单的示例代码: 1. 首先,需要添加相关依赖: ```xml <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring-boot-starter</artifactId> <version>1.7.1</version> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt</artifactId> <version>0.9.1</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-redis</artifactId> </dependency> ``` 2. 创建一个JWT工具类,用于生成和解析JWT: ```java import io.jsonwebtoken.Claims; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Component; import java.util.Date; @Component public class JwtUtils { @Value("${jwt.secret}") private String secret; @Value("${jwt.expiration}") private Long expiration; public String generateToken(String username) { Date now = new Date(); Date expireDate = new Date(now.getTime() + expiration * 1000); return Jwts.builder() .setSubject(username) .setIssuedAt(now) .setExpiration(expireDate) .signWith(SignatureAlgorithm.HS512, secret) .compact(); } public String getUsernameFromToken(String token) { Claims claims = Jwts.parser() .setSigningKey(secret) .parseClaimsJws(token) .getBody(); return claims.getSubject(); } public boolean validateToken(String token) { try { Jwts.parser().setSigningKey(secret).parseClaimsJws(token); return true; } catch (Exception e) { return false; } } } ``` 3. 创建一个自定义的Realm类,用于处理登录验证和权限控制: ```java import org.apache.shiro.authc.*; import org.apache.shiro.realm.AuthenticatingRealm; import org.springframework.beans.factory.annotation.Autowired; public class JwtRealm extends AuthenticatingRealm { @Autowired private JwtUtils jwtUtils; @Override public boolean supports(AuthenticationToken token) { return token instanceof JwtToken; } @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { JwtToken jwtToken = (JwtToken) authenticationToken; String token = jwtToken.getToken(); if (!jwtUtils.validateToken(token)) { throw new IncorrectCredentialsException("Token无效"); } String username = jwtUtils.getUsernameFromToken(token); // TODO: 根据用户名查询用户信息 return new SimpleAuthenticationInfo(username, token, getName()); } } ``` 4. 创建一个自定义的Filter类,用于处理JWT的验证和授权: ```java import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.HttpStatus; import org.springframework.web.bind.annotation.RequestMethod; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class JwtFilter extends BasicHttpAuthenticationFilter { @Autowired private JwtUtils jwtUtils; @Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { HttpServletRequest httpServletRequest = (HttpServletRequest) request; String token = httpServletRequest.getHeader("Authorization"); if (token != null && token.startsWith("Bearer ")) { token = token.substring(7); } if (jwtUtils.validateToken(token)) { return true; } throw new UnauthorizedException("Token无效"); } @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { HttpServletResponse httpServletResponse = (HttpServletResponse) response; httpServletResponse.setStatus(HttpStatus.UNAUTHORIZED.value()); return false; } } ``` 5. 在Spring Boot的配置文件中配置相关参数: ```properties # JWT配置 jwt.secret=your_secret_key jwt.expiration=3600 ``` 6. 在Spring Boot的配置类中配置Shiro和Redis: ```java import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.realm.Realm; import org.apache.shiro.session.mgt.SessionManager; import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO; import org.apache.shiro.session.mgt.eis.SessionDAO; import org.apache.shiro.session.mgt.eis.SessionIdGenerator; import org.apache.shiro.session.mgt.eis.SimpleSessionIdGenerator; import org.apache.shiro.session.mgt.eis.SessionIdCookie; import org.apache.shiro.session.mgt.eis.SessionIdCookieEnabled; import org.apache.shiro.session.mgt.eis.SessionIdCookieSessionFactory; import org.apache.shiro.session.mgt.eis.SessionIdUrlRewritingEnabled; import org.apache.shiro.session.mgt.eis.SessionManagerEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationScheduler; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerFactory; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactory; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionManager; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionManagerEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabledEnabled; import org.apache.shiro.session.mgt.eis.SessionValidationSchedulerSessionFactoryEnabledEnabledEnabledEnabled

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值