SpringBoot 整合JWT 实现认证授权服务

1. 引入JWT依赖

		<dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.4.1</version>
     	</dependency>

2. 创建生成Token工具类

@Service
public class TokenUtil {

    /**
     * 获取token
     * @param user 用户名密码
     * @return token
     */
    public String getToken(UserVO user) {

        /**
         * withAudience()可以存放多个值
         * Algorithm.HMAC256()数据加密
         */
        return JWT.create().withAudience(user.getCUserName()).sign(Algorithm.HMAC256(user.getCPwd()));
    }

}

3. 创建拦截器配置

/**
 * 拦截配置
 */
@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authenticationInterceptor())
                // 配置拦截地址
                .addPathPatterns("/**")
                // 配置不拦截地址
                .excludePathPatterns("/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**");
    }

    /**
     * 自定义拦截器
     * @return AuthenticationInterceptor
     */
    @Bean
    public AuthenticationInterceptor authenticationInterceptor() {
        return new AuthenticationInterceptor();
    }
}

4. 创建自定义拦截器

/**
 * @author qingpiwen
 */
public class AuthenticationInterceptor extends HandlerInterceptorAdapter {

    @Autowired
    UserService userService;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception 				{	

        // 如果不是映射到方法直接通过
        if (!(handler instanceof HandlerMethod)) {
            return true;
        }

        // 从 http 请求头中取出 token
        String token = request.getHeader("token");

        // 获取方法
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        Method method = handlerMethod.getMethod();

        //检查是否有passtoken注释，有则跳过认证
        if (method.isAnnotationPresent(PassToken.class)) {
            PassToken passToken = method.getAnnotation(PassToken.class);
            if (passToken.required()) {
                return true;
            }
        }

        //检查是否有UserLoginToken注释，有则需要认证
        if (method.isAnnotationPresent(UserLoginToken.class)) {
            UserLoginToken userLoginToken = method.getAnnotation(UserLoginToken.class);

            if (userLoginToken.required()) {

                // 校验token值是否为空
                if (StringUtils.isEmpty(token)) {
                    throw new RuntimeException("无效token,请登录");
                }

                List<String> audience = null;

                try {
                    // 解析token获取用户数据
                    audience = JWT.decode(token).getAudience();
                } catch (Exception e) {
                    e.getStackTrace();
                    throw new RuntimeException("无效token,请登录");
                }

                // 得到用户账号
                String userId = audience.get(0);

                // 查找用户根据用户账号
                UserVO user = userService.getUserByName(userId);

                // 校验用户是否为空
                if (user == null) {
                    throw new RuntimeException("用户不存在");
                }

                // 校验token的正确性
                JWTVerifier jwtVerifier = JWT.require(Algorithm.HMAC256(user.getCPwd())).build();

                try {
                    jwtVerifier.verify(token);
                    return true;
                } catch (Exception e) {
                    e.printStackTrace();
                    throw new RuntimeException("无效token");
                }
            }
        }

        return true;
    }
}

5. 创建注解

/**
 * 需要认证注解
 * @author qingpiwen
 */
@Target({ElementType.TYPE,ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
public @interface UserLoginToken {

    // 默认值为需要认证
    boolean required() default true;
}

/**
 * 跳过认证注解
 * @author qingpiwen
 */
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface PassToken {

    // 默认值为跳过认证
    boolean required() default true;
}

6. 使用

@Autowired
    TokenUtil tokenUtil;

UserVO userForBase = userService.getUserByName(user.getCUserName());
// 生成Token
String token = tokenUtil.getToken(userForBase);