Spring Security可以使用
JWT（JSON Web Token）来验证
用户的身份和权限。
1.添加
JWT依赖项：在pom.xml文件中添加以下依赖项：
```
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2.创建
JWT工具类：创建一个
JWT工具类来生成和验证
JWT。
```
import io.jsonwebtoken.
Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.
springframework.
security.core.
Authentication;
import org.
springframework.
security.core.userdetails.User;
import org.
springframework.stereotype.Component;
import java.util.Date;
@Component
public class
JwtUtils {
private final String
JWT_SECRET = "mysecretkey";
private final int
JWT_EXPIRATION_MS = 86400000;
public String generate
JwtToken(
Authentication authentication) {
User user = (User)
authentication.getPrincipal();
return
Jwts.builder()
.setSubject((user.getUsername()))
.setIssuedAt(new Date())
.setExpiration(new Date((new Date()).getTime() +
JWT_EXPIRATION_MS))
.signWith(SignatureAlgorithm.HS512,
JWT_SECRET)
.compact();
}
public boolean validate
JwtToken(String authToken) {
try {
Jwts.parser().setSigningKey(
JWT_SECRET).parseClaimsJws(authToken);
return true;
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
public String getUsernameFrom
JwtToken(String token) {
return
Jwts.parser()
.setSigningKey(
JWT_SECRET)
.parseClaimsJws(token)
.getBody().getSubject();
}
}
```
3.创建
JWT过滤器：创建一个
JWT过滤器来验证
JWT并设置
用户的身份和权限。
```
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.
security.
authentication.UsernamePassword
AuthenticationToken;
import org.
springframework.
security.core.context.
SecurityContextHolder;
import org.
springframework.
security.core.userdetails.UserDetails;
import org.
springframework.
security.web.
authentication.Web
AuthenticationDetailsSource;
import org.
springframework.stereotype.Component;
import org.
springframework.web.filter.OncePerRequestFilter;
import com.example.demo.
security.services.UserDetailsServiceImpl;
import io.jsonwebtoken.Expired
JwtException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
@Component
public class
JwtAuthTokenFilter extends OncePerRequestFilter {
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
try {
String
jwt = parse
Jwt(request);
if (
jwt != null &&
jwtUtils.validate
JwtToken(
jwt)) {
String username =
jwtUtils.getUsernameFrom
JwtToken(
jwt);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePassword
AuthenticationToken
authentication = new UsernamePassword
AuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new Web
AuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().set
Authentication(
authentication);
}
} catch (Expired
JwtException e) {
logger.error("
JWT token is expired: {}", e.getMessage());
} catch (Exception e) {
logger.error("Cannot set user
authentication: {}", e.getMessage());
}
chain.doFilter(request, response);
}
private String parse
Jwt(HttpServletRequest request) {
String headerAuth = request.getHeader("
Authorization");
if (headerAuth != null && headerAuth.startsWith("Bearer ")) {
return headerAuth.substring(7, headerAuth.length());
}
return null;
}
}
```
4.配置
Spring Security：在
Spring Security配置中添加
JWT过滤器。
```
import org.
springframework.beans.factory.annotation.Autowired;
import org.
springframework.context.annotation.Bean;
import org.
springframework.context.annotation.Configuration;
import org.
springframework.
security.
authentication.
AuthenticationManager;
import org.
springframework.
security.
authentication.dao.Dao
AuthenticationProvider;
import org.
springframework.
security.config.annotation.
authentication.builders.
AuthenticationManagerBuilder;
import org.
springframework.
security.config.annotation.method.configuration.EnableGlobalMethod
Security;
import org.
springframework.
security.config.annotation.web.builders.Http
Security;
import org.
springframework.
security.config.annotation.web.configuration.EnableWeb
Security;
import org.
springframework.
security.config.annotation.web.configuration.Web
SecurityConfigurerAdapter;
import org.
springframework.
security.core.userdetails.UserDetailsService;
import org.
springframework.
security.crypto.bcrypt.BCryptPasswordEncoder;
import org.
springframework.
security.web.
authentication.UsernamePassword
AuthenticationFilter;
import com.example.demo.
security.
jwt.
JwtAuthTokenFilter;
import com.example.demo.
security.services.UserDetailsServiceImpl;
@Configuration
@EnableWeb
Security
@EnableGlobalMethod
Security(
// securedEnabled = true,
// jsr250Enabled = true,
prePostEnabled = true)
public class Web
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private
JwtAuthTokenFilter
jwtAuthTokenFilter;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
@Bean
public Dao
AuthenticationProvider
authenticationProvider() {
Dao
AuthenticationProvider authProvider = new Dao
AuthenticationProvider();
authProvider.setUserDetailsService(userDetailsService);
authProvider.setPasswordEncoder(bCryptPasswordEncoder);
return authProvider;
}
@Override
public void configure(
AuthenticationManagerBuilder
authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
}
@Bean
@Override
public
AuthenticationManager
authenticationManagerBean() throws Exception {
return super.
authenticationManagerBean();
}
@Bean
public BCryptPasswordEncoder bCryptPasswordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(Http
Security http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/api/auth/**").permitAll()
.anyRequest().authenticated();
http.addFilterBefore(
jwtAuthTokenFilter, UsernamePassword
AuthenticationFilter.class);
}
}
```
现在，
Spring Security将使用
JWT来验证
用户的身份和权限。您可以在需要身份验证和
授权的端点上使用
Spring Security注释，例如@PreAuthorize和@PostAuthorize。
超级会员免费看
订阅专栏 解锁全文
686
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
