以下是
一个基本的
Java代码
实现JWT单点登录的示例：
1. 添加依赖
在 Maven 项目中添加以下依赖：
```
<dependency>
<groupId>io.jsonweb
token</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 生成
JWT Token
```
import io.jsonweb
token.
Jwts;
import io.jsonweb
token.SignatureAlgorithm;
import
java.util.Date;
public class
JwtUtils {
private static final String SECRET_KEY = "YOUR_SECRET_KEY";
private static final long EXPIRATION_TIME = 86400000; // 24小时
public static String generate
Token(String username) {
Date now = new Date();
Date expiration = new Date(now.getTime() + EXPIRATION_TIME);
return
Jwts.builder()
.setSubject(username)
.setIssuedAt(now)
.setExpiration(expiration)
.signWith(SignatureAlgorithm.HS256, SECRET_KEY)
.compact();
}
//
验证 Token 是否有效
public static boolean validate
Token(String
token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(
token);
return true;
} catch(Exception ex) {
return false;
}
}
// 从
Token 中获取
用户名
public static String getUsernameFrom
Token(String
token) {
return
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(
token).getBody().getSubject();
}
}
```
3.
验证 JWT Token
在需要
验证用户身份的地方，可以
使用以下代码
验证 JWT Token：
```
import
javax.servlet.http.HttpServletRequest;
import org.
springframework.web.filter.OncePerRequestFilter;
import io.jsonweb
token.
Jwts;
import io.jsonweb
token.Claims;
import io.jsonweb
token.SignatureException;
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
private static final String SECRET_KEY = "YOUR_SECRET_KEY";
private static final String
TOKEN_PREFIX = "Bearer";
private static final String HEADER_STRING = "Authorization";
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
String header = request.getHeader(HEADER_STRING);
if(header == null || !header.startsWith(
TOKEN_PREFIX)) {
chain.doFilter(request, response);
return;
}
String
token = header.replace(
TOKEN_PREFIX, "").trim();
try {
Claims claims =
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(
token).getBody();
request.setAttribute("username", claims.getSubject());
} catch(SignatureException ex) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
return;
}
chain.doFilter(request, response);
}
}
```
4. 配置
Spring Security
在
Spring Security 配置类中添加以下配置：
```
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.context.annotation.Bean;
import org.
springframework.context.annotation.Configuration;
import org.
springframework.
security.authentication.AuthenticationManager;
import org.
springframework.
security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.
springframework.
security.config.annotation.method.configuration.EnableGlobalMethod
Security;
import org.
springframework.
security.config.annotation.web.builders.Http
Security;
import org.
springframework.
security.config.annotation.web.configuration.EnableWeb
Security;
import org.
springframework.
security.config.annotation.web.configuration.Web
SecurityConfigurerAdapter;
import org.
springframework.
security.config.http.SessionCreationPolicy;
import org.
springframework.
security.crypto.bcrypt.BCryptPasswordEncoder;
import org.
springframework.
security.crypto.password.PasswordEncoder;
import org.
springframework.
security.web.authentication.UsernamePasswordAuthenticationFilter;
@Configuration
@EnableWeb
Security
@EnableGlobalMethod
Security(prePostEnabled = true)
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private
JwtAuthenticationFilter
jwtAuthenticationFilter;
@Override
protected void configure(Http
Security http) throws Exception {
http.csrf().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/login").permitAll()
.anyRequest().authenticated()
.and()
.addFilterBefore(
jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("admin").password(passwordEncoder().encode("admin123")).roles("ADMIN");
}
@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
```
以上就是
一个基本的
Java代码
实现JWT单点登录的示例。需要注意的是，SECRET_KEY 应该是
一个随机的字符串，不要泄露给其他人。此外，在实际应用中，应该
使用数据库或其他存储来保存
用户信息，而不是在配置文件中硬编码。
2321
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
