1 引言
JSON Web Token(缩写JWT)是目前流行的跨域认证解决方案,其本质上也是一种token,但是JWT通过纯算法验证合法性,因此无需在服务器存储token数据或者保存用户状态,降低了服务器消耗,也便于系统之间解耦。本章主要讲解使用JWT实现登录认证,并使用redis解决JWT无法主动失效的问题。
2 代码
下面列出关键代码进行介绍,源码链接在文章最后。
2.1 pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.zeroone</groupId>
<artifactId>zeroone</artifactId>
<version>1.0</version>
<properties>
<maven.compiler.source>17</maven.compiler.source>
<maven.compiler.target>17</maven.compiler.target>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
<!-- 为Spring Boot项目提供一系列默认的配置和依赖管理-->
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.3.2</version>
<relativePath/>
</parent>
<dependencies>
<!-- Spring Boot核心依赖-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
</dependency>
<!-- Spring Boot单元测试和集成测试的依赖-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<!-- Spring Boot构建Web应用程序的依赖-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<!-- redis -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<!-- mysql驱动-->
<dependency>
<groupId>com.mysql</groupId>
<artifactId>mysql-connector-j</artifactId>
</dependency>
<!-- mybatis-plus核心依赖-->
<dependency>
<groupId>com.baomidou</groupId>
<artifactId>mybatis-plus-spring-boot3-starter</artifactId>
<version>3.5.7</version>
</dependency>
<!-- 阿里数据库连接池 -->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid-spring-boot-3-starter</artifactId>
<version>1.2.23</version>
</dependency>
<!-- 阿里JSON解析库-->
<dependency>
<groupId>com.alibaba.fastjson2</groupId>
<artifactId>fastjson2</artifactId>
<version>2.0.52</version>
</dependency>
<!-- Jwt -->
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>4.4.0</version>
</dependency>
</dependencies>
</project>
2.2 TokenService.java
这个就是jwt管理token的类,为了解决JWT无法主动失效的问题,使用redis存储每个用户最后登录时生成的jwtId,然后每次访问都比较header中的token是否最新的。注意:在header中,key为Authorization,value为"Bearer "+token。
package com.zeroone.service;
import com.alibaba.fastjson2.JSON;
import com.alibaba.fastjson2.JSONObject;
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.Claim;
import com.zeroone.common.RedisKey;
import com.zeroone.entity.sys.User;
import jakarta.servlet.http.HttpServletRequest;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Service;
import java.util.Date;
import java.util.Map;
import java.util.UUID;
import java.util.concurrent.TimeUnit;
/**
* Jwt服务
*/
@Service("TokenService")
public class TokenService {
@Autowired
protected HttpServletRequest request;
@Autowired
RedisTemplate<String, String> redisTemplate;
/**
* 令牌秘钥
*/
public static final Algorithm algorithm = Algorithm.HMAC512("C9FEE9EAD0F74457B3438AB8CB9CA9A7C9FEE9EAD0F74457B3438AB8CB9CA9A7C9FEE9EAD0F74457B3438AB8CB9CA9A7");
/**
* 令牌有效期,毫秒
*/
public static final long EXPIRATION = 60 * 60 * 1000;
/**
* 用户信息存储标识
*/
public static final String USER_INFO = "USER_INFO";
/**
* 从header中解析出token
*
* @return token
*/
public String getTokenFromHeader() {
String token = request.getHeader("Authorization");
if (null != token) {
token = token.replace("Bearer ", "");
}
return token;
}
/**
* 生成token
*
* @param user 用户信息
* @return token
*/
public String createToken(User user) {
user.setPassword(null);//私密信息不放入token中
String jwtId = UUID.randomUUID().toString();
//存储当前用户最新的jwtId
redisTemplate.opsForValue().set(RedisKey.USER_JWTID + user.getId(), jwtId, EXPIRATION, TimeUnit.MILLISECONDS);
//设置JWTId,设置户信息,设置过期时间,返回token
return JWT.create().withJWTId(jwtId).withClaim(USER_INFO, JSON.toJSONString(user)).withExpiresAt(new Date(System.currentTimeMillis() + EXPIRATION)).sign(algorithm);
}
/**
* 验证token,并返回用户信息
*
* @return 用户信息
*/
public User verifyToken() {
try {
String token = getTokenFromHeader();
//获取claims
Map<String, Claim> claims = JWT.require(algorithm).build().verify(token).getClaims();
String jwtId = claims.get("jti").asString();//从claims中解析出jwtId
String userStr = claims.get(USER_INFO).asString();//从claims中解析出用户信息
User user = JSONObject.parseObject(userStr, User.class);
String jwtIdLast = redisTemplate.opsForValue().get(RedisKey.USER_JWTID + user.getId());//取出该用户最新的jwtId
//比较jwtId,如果不一致则说明该token已废弃。
if (null != jwtIdLast && jwtIdLast.equals(jwtId)) {
return user;
}
} catch (Exception e) {
return null;
}
return null;
}
/**
* 获取用户信息
*
* @return 用户信息
*/
public User getUserInfo() {
try {
String token = getTokenFromHeader();
String userStr = JWT.require(algorithm).build().verify(token).getClaims().get(USER_INFO).asString();
return JSONObject.parseObject(userStr, User.class);
} catch (Exception e) {
return null;
}
}
/**
* 使用户token失效
*/
public void deleteToken() {
User uer = getUserInfo();
if (null != uer) {
redisTemplate.delete(RedisKey.USER_JWTID + uer.getId());
}
}
}
2.3 LoginServiceImpl.java
登录和退出
package com.zeroone.service.sys;
import com.zeroone.entity.sys.User;
import com.zeroone.service.BaseService;
import com.zeroone.utils.Param;
import org.springframework.stereotype.Service;
@Service("UserService")
public class LoginServiceImpl extends BaseService implements LoginService {
@Override
public Object webLogin(Param info) {
String account = info.getStringNotNull("account").trim();
String password = info.getStringNotNull("password").trim();
//TODO 验证通过
User user = new User();
user.setId(1L);
user.setName("张三");
user.setAccount("12345678901@qq.com");
user.setPhone("12345678901");
String token = tokenService.createToken(user);
return token;
}
@Override
public void logout() {
tokenService.deleteToken();
}
}
2.4 WebMvcConfigurerImpl.java
注册组件类,如拦截器等。
package com.zeroone.config.spring;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import java.util.ArrayList;
import java.util.List;
/**
* SpringMvc(组件注册:拦截器、静态资源……)
*/
@Configuration
public class WebMvcConfigurerImpl implements WebMvcConfigurer {
@Autowired
private MyHandlerInterceptor myHandlerInterceptor;
@Override
public void addInterceptors(InterceptorRegistry registry) {
List<String> patterns = new ArrayList<>();
patterns.add("/download/**");
patterns.add("/upload/**");
patterns.add("/error");
patterns.add("/");
registry.addInterceptor(myHandlerInterceptor).addPathPatterns("/**").excludePathPatterns(patterns);
}
@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
}
}
2.4 MyHandlerInterceptor.java
拦截器类,在拦截器中验证token是否合法
package com.zeroone.config.spring;
import com.zeroone.common.HttpCode;
import com.zeroone.config.exception.MyRuntimeException;
import com.zeroone.service.TokenService;
import com.zeroone.entity.sys.User;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
/**
* SpringMvc 拦截器
*/
@Component
public class MyHandlerInterceptor implements HandlerInterceptor {
Logger log = LoggerFactory.getLogger(getClass());
@Autowired
TokenService tokenService;
/**
* 完成页面的render后调用
*/
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object object, Exception exception) throws Exception {
}
/**
* 在调用controller具体方法后拦截
*/
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object object, ModelAndView modelAndView) throws Exception {
}
/**
* 在调用controller具体方法前拦截
*/
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object object) throws Exception {
String origin = request.getHeader("Origin");
// 设置头信息,以支持跨域请求
response.setHeader("Access-Control-Allow-Origin", origin);
response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
response.setHeader("Access-Control-Max-Age", "3600");
response.setHeader("Access-Control-Allow-Headers", "Content-Type,token,Cookie");
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setContentType("text/html;charset=utf-8");
response.setCharacterEncoding("utf-8");
if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
return true;
}
String ip = request.getRemoteAddr();
String url = request.getRequestURI();
// 打印日志
log.info("[" + ip + "]" + url);
// 判断是否是开放的请求
if (isPassUrl(url)) {
return true;
}
User userInfo = tokenService.verifyToken();
// 判断是否已登录
if (null != userInfo) {
return true;
} else {
throw new MyRuntimeException(HttpCode.UNAUTHORIZED_CODE, "请重新登陆!");
}
}
/**
* 是否是开放的url
*/
private boolean isPassUrl(String url) {
switch (url) {
case "/web/login":// WEB登录
return true;
case "/web/logout":// WEB登出
return true;
}
return false;
}
}
3 测试
1 启动项目访问:http://localhost:8080/UserController/listAllMaster。可以看到提示"请重新登陆!"。
2 调用http://localhost:8080/web/login登录。将返回的token信息,放入前面接口的header中,可以看到正常返回了,说明认证成功。