好的，下面是
一个基于
Spring Boot、
Spring Security和
JWT的
权限管理系统的代码框架。
1. 首先，引入相关的依赖：
```xml
<dependencies>
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-
security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
</dependencies>
```
2. 编写
JWT工具类：
```java
@Component
public class
JwtUtils {
private static final String SECRET_KEY = "my_secret_key";
private static final long EXPIRATION_TIME = 864_000_000L;
public String generateToken(String username) {
Date expirationDate = new Date(System.currentTimeMillis() + EXPIRATION_TIME);
String token =
Jwts.builder()
.setSubject(username)
.setExpiration(expirationDate)
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
return token;
}
public String getUsernameFromToken(String token) {
try {
Claims claims =
Jwts.parser()
.setSigningKey(SECRET_KEY)
.parseClaimsJws(token)
.getBody();
return claims.getSubject();
} catch (Exception e) {
return null;
}
}
public boolean isValidToken(String token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
return true;
} catch (Exception e) {
return false;
}
}
}
```
3. 编写自定义UserDetailsService：
```java
@Service
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException {
User user = userRepository.findByUsername(username);
if (user == null) {
throw new UsernameNotFoundException("User not found with username: " + username);
}
return new org.
springframework.
security.core.userdetails.User(
user.getUsername(),
user.getPassword(),
new ArrayList<>()
);
}
}
```
4. 配置
Spring Security：
```java
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService userDetailsService;
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private UnauthorizedHandler unauthorizedHandler;
@Override
protected void configure(Http
Security http) throws Exception {
http.csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, "/users/login").permitAll()
.anyRequest().authenticated()
.and()
.exceptionHandling()
.authenticationEntryPoint(unauthorizedHandler)
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(
jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}
@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public
JwtAuthenticationFilter
jwtAuthenticationFilter() {
return new
JwtAuthenticationFilter(
jwtUtils, userDetailsService);
}
}
```
在这个配置中，我们使用了
JwtAuthenticationFilter来处理
JWT的校验和授权。UnauthorizedHandler则用来处理未授权的情况。
5. 编写
JwtAuthenticationFilter：
```java
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private CustomUserDetailsService userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {
String authorizationHeader = request.getHeader("Authorization");
String username = null;
String token = null;
if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
token = authorizationHeader.substring(7);
username =
jwtUtils.getUsernameFromToken(token);
}
if (username != null &&
SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
if (
jwtUtils.isValidToken(token)) {
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
chain.doFilter(request, response);
}
}
```
6. 编写UnauthorizedHandler：
```java
@Component
public class UnauthorizedHandler implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
throws IOException, ServletException {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
}
```
7. 编写UserController：
```java
@RestController
@RequestMapping("/users")
public class UserController {
@Autowired
private UserRepository userRepository;
@Autowired
private
JwtUtils
jwtUtils;
@PostMapping("/signup")
public ResponseEntity<?> signUp(@RequestBody User user) {
User existingUser = userRepository.findByUsername(user.getUsername());
if (existingUser != null) {
return new ResponseEntity<>("Username already exists", HttpStatus.BAD_REQUEST);
}
user.setPassword(new BCryptPasswordEncoder().encode(user.getPassword()));
userRepository.save(user);
return ResponseEntity.ok("User created successfully");
}
@PostMapping("/login")
public ResponseEntity<?> login(@RequestBody User user) {
try {
Authentication authentication =
SecurityContextHolder.getContext().getAuthentication();
if (authentication != null && authentication.isAuthenticated()) {
return ResponseEntity.ok("User already authenticated");
}
authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(
user.getUsername(), user.getPassword()));
final String token =
jwtUtils.generateToken(user.getUsername());
return ResponseEntity.ok(token);
} catch (BadCredentialsException e) {
return new ResponseEntity<>("Invalid username/password supplied", HttpStatus.UNAUTHORIZED);
}
}
}
```
这里的User类是
一个简单的POJO，包含了username和password字段。
现在，就可以使用这个
权限管理系统了。在前端请求中，需要在Header中传递
一个Authorization的键值对，键是Bearer加上空格，值是
JWT Token。这样就可以在
Spring Security中进行授权了。
1338
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
