好的，下面是一个基于
Spring Boot、
Spring Security和
JWT的权限管理系统的代码框架。
1. 首先，引入相关的依赖：
```xml
<dependencies>
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-
security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonweb
token</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
</dependencies>
```
2. 编写
JWT工具类：
```java
@Component
public class
JwtUtils {
private static final String SECRET_KEY = "my_secret_key";
private static final long EXPIRATION_TIME = 864_000_000L;
public String generate
Token(String username) {
Date expirationDate = new Date(System.currentTimeMillis() + EXPIRATION_TIME);
String
token =
Jwts.builder()
.setSubject(username)
.setExpiration(expirationDate)
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
return
token;
}
public String getUsernameFrom
Token(String
token) {
try {
Claims claims =
Jwts.parser()
.setSigningKey(SECRET_KEY)
.parseClaimsJws(
token)
.getBody();
return claims.getSubject();
} catch (Exception e) {
return null;
}
}
public boolean isValid
Token(String
token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(
token);
return true;
} catch (Exception e) {
return false;
}
}
}
```
3. 编写自定义UserDetailsService：
```java
@Service
public class CustomUserDetailsService implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException {
User user = userRepository.findByUsername(username);
if (user == null) {
throw new UsernameNotFoundException("User not found with username: " + username);
}
return new org.
springframework.
security.core.userdetails.User(
user.getUsername(),
user.getPassword(),
new ArrayList<>()
);
}
}
```
4. 配置
Spring Security：
```java
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService userDetailsService;
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private UnauthorizedHandler unauthorizedHandler;
@Override
protected void configure(Http
Security http) throws Exception {
http.csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, "/users/login").permitAll()
.anyRequest().authenticated()
.and()
.exceptionHandling()
.authenticationEntryPoint(unauthorizedHandler)
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(
jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}
@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public
JwtAuthenticationFilter
jwtAuthenticationFilter() {
return new
JwtAuthenticationFilter(
jwtUtils, userDetailsService);
}
}
```
在这个配置中，我们使用了
JwtAuthenticationFilter来处理
JWT的
校验和授权。UnauthorizedHandler则用来处理未授权的情况。
5. 编写
JwtAuthenticationFilter：
```java
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private
JwtUtils
jwtUtils;
@Autowired
private CustomUserDetailsService userDetailsService;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {
String authorizationHeader = request.getHeader("Authorization");
String username = null;
String
token = null;
if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
token = authorizationHeader.substring(7);
username =
jwtUtils.getUsernameFrom
Token(
token);
}
if (username != null &&
SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
if (
jwtUtils.isValid
Token(
token)) {
UsernamePasswordAuthentication
Token authentication = new UsernamePasswordAuthentication
Token(
userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
chain.doFilter(request, response);
}
}
```
6. 编写UnauthorizedHandler：
```java
@Component
public class UnauthorizedHandler implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
throws IOException, ServletException {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
}
```
7. 编写UserController：
```java
@RestController
@RequestMapping("/users")
public class UserController {
@Autowired
private UserRepository userRepository;
@Autowired
private
JwtUtils
jwtUtils;
@PostMapping("/signup")
public ResponseEntity<?> signUp(@RequestBody User user) {
User existingUser = userRepository.findByUsername(user.getUsername());
if (existingUser != null) {
return new ResponseEntity<>("Username already exists", HttpStatus.BAD_REQUEST);
}
user.setPassword(new BCryptPasswordEncoder().encode(user.getPassword()));
userRepository.save(user);
return ResponseEntity.ok("User created successfully");
}
@PostMapping("/login")
public ResponseEntity<?> login(@RequestBody User user) {
try {
Authentication authentication =
SecurityContextHolder.getContext().getAuthentication();
if (authentication != null && authentication.isAuthenticated()) {
return ResponseEntity.ok("User already authenticated");
}
authenticationManager.authenticate(new UsernamePasswordAuthentication
Token(
user.getUsername(), user.getPassword()));
final String
token =
jwtUtils.generate
Token(user.getUsername());
return ResponseEntity.ok(
token);
} catch (BadCredentialsException e) {
return new ResponseEntity<>("Invalid username/password supplied", HttpStatus.UNAUTHORIZED);
}
}
}
```
这里的User类是一个简单的POJO，包含了username和password字段。
现在，就可以使用这个权限管理系统了。在前端请求中，需要在Header中传递一个Authorization的键值对，键是Bearer加上空格，值是
JWT Token。这样就可以在
Spring Security中进行授权了。
1303
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
