可以
使用Spring Security和
JWT（JSON Web
Token）来实现基于
token的登录
验证接口。下面是一个简单的示例：
1. 添加依赖
在pom.xml中添加以下依赖：
```
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonweb
token</groupId>
<artifactId>
jjwt</artifactId>
<version>0.9.0</version>
</dependency>
```
2. 配置Spring Security
在Spring Boot的配置类中添加以下代码：
```
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/api/auth/**").permitAll()
.anyRequest().authenticated()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(authentication
JwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public
JwtAuthenticationFilter authentication
JwtTokenFilter() {
return new
JwtAuthenticationFilter();
}
}
```
这个配置类禁用了CSRF保护，允许所有用户访问“/api/auth/**”接口，其余接口需要进行认证。它还
使用“
JwtAuthenticationFilter”类来
验证token。
3. 实现UserDetailsService
创建一个UserDetailsService的实现类，用于从数据库或其他数据源中获取用户信息。例如：
```
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
@Transactional
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("User Not Found with username: " + username));
return UserDetailsImpl.build(user);
}
}
```
这里的“UserDetailsImpl”类是一个自定义的实现了UserDetails接口的类，用于封装用户信息。
4. 实现
JwtUtils
创建一个
JwtUtils类，用于生成和
验证token。例如：
```
@Component
public class
JwtUtils {
@Value("${
jwt.secret}")
private String
jwtSecret;
@Value("${
jwt.expirationMs}")
private int
jwtExpirationMs;
public String generate
JwtToken(Authentication authentication) {
UserDetailsImpl userPrincipal = (UserDetailsImpl) authentication.getPrincipal();
return
Jwts.builder()
.setSubject((userPrincipal.getUsername()))
.setIssuedAt(new Date())
.setExpiration(new Date((new Date()).getTime() +
jwtExpirationMs))
.signWith(SignatureAlgorithm.HS512,
jwtSecret)
.compact();
}
public boolean validate
JwtToken(String auth
Token) {
try {
Jwts.parser().setSigningKey(
jwtSecret).parseClaimsJws(auth
Token);
return true;
} catch (SignatureException e) {
logger.error("Invalid
JWT signature: {}", e.getMessage());
} catch (Malformed
JwtException e) {
logger.error("Invalid
JWT token: {}", e.getMessage());
} catch (Expired
JwtException e) {
logger.error("
JWT token is expired: {}", e.getMessage());
} catch (Unsupported
JwtException e) {
logger.error("
JWT token is unsupported: {}", e.getMessage());
} catch (IllegalArgumentException e) {
logger.error("
JWT claims string is empty: {}", e.getMessage());
}
return false;
}
public String getUsernameFrom
JwtToken(String
token) {
return
Jwts.parser().setSigningKey(
jwtSecret).parseClaimsJws(
token).getBody().getSubject();
}
}
```
这里的“
jwt.secret”和“
jwt.expirationMs”分别是用于生成
token的密钥和过期时间（以毫秒为单位）。
5. 实现
JwtAuthenticationFilter
创建一个
JwtAuthenticationFilter类，用于在每个请求上
验证token。例如：
```
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
try {
String
jwt = parse
Jwt(request);
if (
jwt != null &&
jwtUtils.validate
JwtToken(
jwt)) {
String username =
jwtUtils.getUsernameFrom
JwtToken(
jwt);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePasswordAuthentication
Token authentication = new UsernamePasswordAuthentication
Token(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
} catch (Exception e) {
logger.error("Cannot set user authentication: {}", e.getMessage());
}
filterChain.doFilter(request, response);
}
private String parse
Jwt(HttpServletRequest request) {
String headerAuth = request.getHeader("Authorization");
if (StringUtils.hasText(headerAuth) && headerAuth.startsWith("Bearer ")) {
return headerAuth.substring(7, headerAuth.length());
}
return null;
}
}
```
这个过滤器将从请求头中获取
token，并
使用JwtUtils类来
验证token。如果
token有效，则将用户信息设置为Spring Security的上下文中的认证信息。
6. 创建登录接口
创建一个登录接口，用于
验证用户并生成
token。例如：
```
@RestController
@RequestMapping("/api/auth")
public class AuthController {
@Autowired
private AuthenticationManager authenticationManager;
@Autowired
private
JwtUtils
jwtUtils;
@PostMapping("/signin")
public ResponseEntity<?> authenticateUser(@Valid @RequestBody LoginRequest loginRequest) {
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthentication
Token(loginRequest.getUsername(), loginRequest.getPassword()));
SecurityContextHolder.getContext().setAuthentication(authentication);
String
jwt =
jwtUtils.generate
JwtToken(authentication);
return ResponseEntity.ok(new
JwtResponse(
jwt));
}
}
```
这个接口将
使用AuthenticationManager来
验证用户信息，并
使用JwtUtils类来生成
token。如果
验证成功，则返回一个包含
token的
JwtResponse对象。
7. 测试接口
现在可以测试接口了。
使用POST方法向“/api/auth/signin”发送以下JSON数据：
```
{
"username": "your_username",
"password": "your_password"
}
```
如果
验证成功，则会返回一个包含
token的JSON响应。以后，可以在每个请求中将
token作为“Authorization”请求头的值发送。
最低0.47元/天 解锁文章
839
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
