header验证token的配置处理方案

package com.lenovo.common.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

import com.lenovo.user.interceptor.AuthorizationInterceptor;

/**
 * 配置类，添加自定义的拦截器
 *
 */
@Configuration
public class MvcConfigurer extends WebMvcConfigurerAdapter {

    @Autowired
    private AuthorizationInterceptor authorizationInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authorizationInterceptor);
    }
}

• 2

package com.lenovo.user.interceptor;

import java.lang.reflect.Method;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.lenovo.common.util.CDPConstants;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import com.alibaba.fastjson.JSONObject;
import com.lenovo.common.util.ResponseCode;
import com.lenovo.common.anotation.Authorization;
import com.lenovo.user.pojo.TokenModel;
import com.lenovo.user.service.TokenService;

/**
 * 自定义拦截器，判断此次请求是否有权限
 * 
 */
@Component
public class AuthorizationInterceptor extends HandlerInterceptorAdapter {

    @Autowired
    private TokenService tokenService;

    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response,
                             Object handler) 
                            		 throws Exception {
        // 如果不是映射到方法直接通过
        if (!(handler instanceof HandlerMethod)) {
            return true;
        }
        
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        Method method = handlerMethod.getMethod();
        //从 header 中得到 authorization
        String authorization = request.getHeader(CDPConstants.AUTHORIZATION);
        // 解析 token
        TokenModel model = tokenService.parseToken(authorization);
        if (tokenService.checkToken(model)) {
            // 如果token验证成功，将token对应的用户存在request中，便于之后注入
            request.setAttribute("username", model.getUserName());
            return true;
        }
        // 如果验证 token 失败，并且 controller 方法注明了Authorization，返回401错误
        if (method.getAnnotation(Authorization.class) != null) {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); 
            JSONObject jsonObject = new JSONObject(true);
            jsonObject.put("status", ResponseCode.NEED_LOGIN.getCode());
            jsonObject.put("msg", ResponseCode.NEED_LOGIN.getDesc());
            jsonObject.put("data", null);
            jsonObject.put("success", false);
            response.setCharacterEncoding("UTF-8");  
            response.setContentType("application/json; charset=utf-8"); 
            response.getWriter().write(jsonObject.toJSONString());
            return false;
        }
        return true;
    }
}