springBoot+shiro+jwt

引入pom

 <dependencies>
        <!--spring整合shiro-->
        <!--三大shiro对象
         Subject 用户
         SecurityManager 管理所有用户
          Realms 连接数据
        -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.1</version>
        </dependency>
        <!--JWT-->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.4.0</version>
        </dependency>
    </dependencies>

配置shiro

package com.cnki.config;

import com.cnki.filter.JWTFilter;
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
import org.apache.shiro.mgt.DefaultSubjectDAO;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;

import javax.servlet.Filter;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

/**
 * Description: Shiro配置类
 *
 * @author BaiGe
 * @date: 2021/8/27 15:04
 * @Version 1.0
 */
@Configuration
public class ShiroConfig {

    //TODO 最主要的三步:1:创建realm对象  2:创建安全管理器   3:Shiro过滤器配置

    /**
     * 由Spring管理 Shiro的生命周期
     */
    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }


    //创建realm对象:1  需自定义
    @Bean
    public MyRealm getMyRealm(){
        MyRealm userRealm = new MyRealm();
        return userRealm;
    }
    //DefaultWebSecurityManager:2      创建安全管理器（会自动设置到SecurityUtils中设置这个安全管理器）
    @Bean(name = "mySecurityManager")
    public DefaultWebSecurityManager  getDefaultWebSecurityManager(@Qualifier("getMyRealm") MyRealm userRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //关联UserRealm
        securityManager.setRealm(userRealm);

        //关闭shiro的session（无状态的方式使用shiro）
        DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
        DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();
        defaultSessionStorageEvaluator.setSessionStorageEnabled(false);
        subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);
        securityManager.setSubjectDAO(subjectDAO);

        return securityManager;
    }

    //ShiroFilterFactoryBean:3 工厂对象 -->Shiro过滤器配置
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("mySecurityManager")DefaultWebSecurityManager securityManager){
                ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        //设置安全管理器
        factoryBean.setSecurityManager(securityManager);

        // 添加自己的过滤器并且取名为jwt
        Map<String, Filter> filterMap = new HashMap<>();
        filterMap.put("jwt", new JWTFilter());
        factoryBean.setFilters(filterMap);


        //TODO 添加shiro的内置过滤器
        Map<String, String> ruleMap  =new LinkedHashMap<>();

        //放行登录接口和其他不需要权限的接口
        ruleMap.put("/login", "anon");
        ruleMap.put("/unauthorized/**", "anon");
        ruleMap .put("/user/*", "authc");
        ruleMap.put("/**", "jwt");  // /**，一般放在最下，表示对所有资源起作用，使用JwtFilter
        /*
         anno:无需认证就可以访问
         authc:必须认证才能访问
         user:必须拥有 记住我 功能才能访问
         role:拥有某个角色权限才能访问
         */
        factoryBean.setFilterChainDefinitionMap(ruleMap);
//        factoryBean.setLoginUrl("/toLogin");
        // 设置无权限时跳转的 url;
        factoryBean.setUnauthorizedUrl("/unauthorized/无权限");
        return factoryBean;
    }


    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        // 强制使用cglib，防止重复代理和可能引起代理出错的问题
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
        return defaultAdvisorAutoProxyCreator;
    }


    /**
     * 开启对 Shiro 注解的支持
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }

}

配置Filter

package com.cnki.filter;

import com.cnki.utils.JwtToken;
import org.apache.shiro.authz.UnauthorizedException;
import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.RequestMethod;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.net.URLEncoder;

/**
 * Description: 自定义过滤器  对token进行处理
 *
 * @author BaiGe
 * @date: 2021/8/27 15:04
 * @Version 1.0
 */
public class JWTFilter extends BasicHttpAuthenticationFilter {
    private Logger logger = LoggerFactory.getLogger(this.getClass());

    /**
     * 如果带有 token，则对 token 进行检查，否则直接通过
     */
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws UnauthorizedException {
        //判断请求的请求头是否带上 "token"
        if (isLoginAttempt(request, response)) {
            //如果存在，则进入 executeLogin 方法执行登入，检查 token 是否正确
            try {
                executeLogin(request, response);
                return true;
            } catch (Exception e) {
                //token 错误
                responseError(response, e.getMessage());
            }
        }
        //如果请求头不存在 token，则可能是执行登陆操作或者是游客状态访问，无需检查 token，直接返回 true
        return true;
    }

    /**
     * 判断用户是否想要登入。
     * 检测 header 里面是否包含 token 字段
     */
    @Override
    protected boolean isLoginAttempt(ServletRequest request, ServletResponse response) {
        HttpServletRequest req = (HttpServletRequest) request;
        String token = req.getHeader("token");
        return token != null;
    }

    /**
     * 执行登陆操作
     */
    @Override
    protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        String token = httpServletRequest.getHeader("token");
        JwtToken jwtToken = new JwtToken(token);
        // 提交给realm进行登入，如果错误它会抛出异常并被捕获
        getSubject(request, response).login(jwtToken);
        // 如果没有抛出异常则代表登入成功，返回true
        return true;
    }

    /**
     * 对跨域提供支持
     */
    @Override
    protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
        httpServletResponse.setHeader("Access-control-Allow-Origin", httpServletRequest.getHeader("Origin"));
        httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,PUT,DELETE");
        httpServletResponse.setHeader("Access-Control-Allow-Headers", httpServletRequest.getHeader("Access-Control-Request-Headers"));
        // 跨域时会首先发送一个option请求，这里我们给option请求直接返回正常状态
        if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
            httpServletResponse.setStatus(HttpStatus.OK.value());
            return false;
        }
        return super.preHandle(request, response);
    }

    /**
     * 将非法请求跳转到 /unauthorized/**
     */
    private void responseError(ServletResponse response, String message) {
        try {
            HttpServletResponse httpServletResponse = (HttpServletResponse) response;
            //设置编码，否则中文字符在重定向时会变为空字符串
            message = URLEncoder.encode(message, "UTF-8");
            httpServletResponse.sendRedirect("/unauthorized/" + message);
        } catch (IOException e) {
            logger.error(e.getMessage());
        }
    }
}

自定义Realm

package com.cnki.config;

import com.cnki.pojo.UserPoji;
import com.cnki.service.IUserService;
import com.cnki.utils.JwtToken;
import com.cnki.utils.JwtUtils_auth0_jwt;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

/**
 * Description: 自定义Realm,实现Shiro安全认证
 *
 * @author BaiGe
 * @date: 2021/8/27 15:29
 * @Version 1.0
 */
public class MyRealm extends AuthorizingRealm {
    @Autowired
    private IUserService userService;

    /**
     * 限定这个realm只能处理JwtToken（不加的话会报错）
     */
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof JwtToken;
    }

    //TODO 授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了-->授权操作");
        return null;
    }

    //TODO 认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了-->认证操作");
        String token = (String) authenticationToken.getCredentials();  //JwtToken中重写了这个方法了
        String jobNum = JwtUtils_auth0_jwt.getUsername(token);   // 获得username
        UserPoji user = userService.findUserByJobNum(jobNum);//数据库中查询用户
        if (user == null) { //没有此用户
            return null;//抛出异常--用户名不存在  UnknownAccountException
        }
        //密码错误(这里获取到password，就是3件套处理后的保存到数据库中的凭证，作为密钥)
        if (! JwtUtils_auth0_jwt.verifyToken(token, jobNum, user.getPwd())) {
            throw new IncorrectCredentialsException();   //抛出异常,密码错误
        }
        //toke过期
        if(JwtUtils_auth0_jwt.isExpire(token)){
            throw new ExpiredCredentialsException();
        }

        //参数1:当前用户的认证  参数2:密码   参数3:认证名
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user,token, this.getName());

        return simpleAuthenticationInfo;
    }
}

配置token 实体bean进行扩展

package com.cnki.utils;

import org.apache.shiro.authc.AuthenticationToken;



//TODO  自定义的shiro接口token，可以通过这个类将string的token转型成AuthenticationToken，可供shiro使用
//TODO  注意：需要重写getPrincipal和getCredentials方法，因为是进行三件套处理的，没有特殊配置shiro无法通过这两个         
//TODO 方法获取到用户名和密码，需要直接返回token，之后交给JwtUtil去解析获取。（当然了，可以对realm进行配置HashedCredentialsMatcher，这里就不这么处理了）   

/**
 * Description: 对token进行扩展
 *
 * @author BaiGe
 * @date: 2021/8/27 15:29
 * @Version 1.0
 */
public class JwtToken implements AuthenticationToken {
    private String token;

    public JwtToken(String token) {
        this.token = token;
    }

    @Override
    public Object getPrincipal() {
        return token;
    }
    @Override
    public Object getCredentials() {
        return token;
    }
}

token工具类

package com.cnki.utils;

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.util.Date;


/**
 * Description: jwt工具，用来生成、校验token以及提取token中的信息
 *               基于com.auth0 java-jwt
 * @author BaiGe
 * @date: 2021/8/27 15:04
 * @Version 1.0
 */
public class JwtUtils_auth0_jwt {
    //指定一个token过期时间（毫秒）
    private static final long EXPIRE_TIME = 7 * 24 * 60 * 60 * 1000;  //7天
    

    /**
     * 生成token
     * secret:秘钥
     */
    //注意这里的sercet不是密码，而是进行三件套（salt+MD5+1024Hash）处理密码后得到的凭证
    //这里为什么要这么做，在controller中进行说明
    public static String getJwtToken(String username, String secret) {
        Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
        Algorithm algorithm = Algorithm.HMAC256(secret);    //使用密钥进行哈希
        // 附带username信息的token
        return JWT.create()
                .withClaim("username", username)
                .withExpiresAt(date)  //过期时间
                .sign(algorithm);     //签名算法
    }

    /**
     * 校验token是否正确
     */
    public static boolean verifyToken(String token, String username, String secret) {
        try {
            //根据密钥生成JWT效验器
            Algorithm algorithm = Algorithm.HMAC256(secret);
            JWTVerifier verifier = JWT.require(algorithm)
                    .withClaim("username", username)
                    .build();
            //效验TOKEN（其实也就是比较两个token是否相同）
            DecodedJWT jwt = verifier.verify(token);
            return true;
        } catch (Exception exception) {
            return false;
        }
    }

    /**
     * 在token中获取到username信息
     */
    public static String getUsername(String token) {
        try {
            DecodedJWT jwt = JWT.decode(token);
            return jwt.getClaim("username").asString();
        } catch (JWTDecodeException e) {
            return null;
        }
    }

    /**
     * 判断是否过期
     */
    public static boolean isExpire(String token) {
        DecodedJWT jwt = JWT.decode(token);
        return jwt.getExpiresAt().getTime() < System.currentTimeMillis();
    }
}

接口

package com.cnki.config;

import com.cnki.filter.JWTFilter;
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
import org.apache.shiro.mgt.DefaultSubjectDAO;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;

import javax.servlet.Filter;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

/**
 * Description: Shiro配置类
 *
 * @author BaiGe
 * @date: 2021/8/27 15:04
 * @Version 1.0
 */
@Configuration
public class ShiroConfig {

    //TODO 最主要的三步:1:创建realm对象  2:创建安全管理器   3:Shiro过滤器配置

    /**
     * 由Spring管理 Shiro的生命周期
     */
    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }


    //创建realm对象:1  需自定义
    @Bean
    public MyRealm getMyRealm(){
        MyRealm userRealm = new MyRealm();
        return userRealm;
    }
    //DefaultWebSecurityManager:2      创建安全管理器（会自动设置到SecurityUtils中设置这个安全管理器）
    @Bean(name = "mySecurityManager")
    public DefaultWebSecurityManager  getDefaultWebSecurityManager(@Qualifier("getMyRealm") MyRealm userRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //关联UserRealm
        securityManager.setRealm(userRealm);

        //关闭shiro的session（无状态的方式使用shiro）
        DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
        DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();
        defaultSessionStorageEvaluator.setSessionStorageEnabled(false);
        subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);
        securityManager.setSubjectDAO(subjectDAO);

        return securityManager;
    }

    //ShiroFilterFactoryBean:3 工厂对象 -->Shiro过滤器配置
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("mySecurityManager")DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        //设置安全管理器
        factoryBean.setSecurityManager(securityManager);

        // 添加自己的过滤器并且取名为jwt
        Map<String, Filter> filterMap = new HashMap<>();
        filterMap.put("jwt", new JWTFilter());
        factoryBean.setFilters(filterMap);


        //TODO 添加shiro的内置过滤器
        Map<String, String> ruleMap  =new LinkedHashMap<>();

        //放行登录接口和其他不需要权限的接口
        ruleMap.put("/login", "anon");
        ruleMap.put("/unauthorized/**", "anon");
        ruleMap .put("/user/*", "authc");
        ruleMap.put("/**", "jwt");  // /**，一般放在最下，表示对所有资源起作用，使用JwtFilter
        /*
         anno:无需认证就可以访问
         authc:必须认证才能访问
         user:必须拥有 记住我 功能才能访问
         role:拥有某个角色权限才能访问
         */
        factoryBean.setFilterChainDefinitionMap(ruleMap);
//        factoryBean.setLoginUrl("/toLogin");
        // 设置无权限时跳转的 url;
        factoryBean.setUnauthorizedUrl("/unauthorized/无权限");
        return factoryBean;
    }


    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        // 强制使用cglib，防止重复代理和可能引起代理出错的问题
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
        return defaultAdvisorAutoProxyCreator;
    }


    /**
     * 开启对 Shiro 注解的支持
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }

}