Spring Boot和
Spring Security可以很好地结合使用来
实现RESTful API的
认证。而
JWT（JSON Web Token）是一种用于
认证和授权的安全传输方式。
要在
Spring Boot中
实现JWT认证，可以遵循以下步骤：
1. 添加依赖：在`pom.xml`文件中添加以下依赖：
```xml
<dependency>
<groupId>org.
springframework.
boot</groupId>
<artifactId>
spring-
boot-starter-
security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>j
jwt</artifactId>
<version>0.9.1</version>
</dependency>
```
2. 创建
JWT工具类：创建一个
JWT工具类来生成和解析
JWT。可以使用J
JWT库来简化这个过程。
3. 创建
认证过滤器：创建一个继承自`OncePerRequestFilter`的
认证过滤器，在该过滤器中检查请求中的
JWT，并进行
认证。
4. 配置
Spring Security：将
认证过滤器添加到
Spring Security的配置中，以便在每个请求到达之前进行
JWT认证。
5. 创建
登录接口：创建一个
登录接口，用于验证用户的身份并生成
JWT。
这是一个简单的示例代码，说明如何在
Spring Boot中
实现JWT认证：
```java
//
JWT工具类
public class
JwtUtils {
private static final String SECRET_KEY = "your-secret-key";
private static final long EXPIRATION_TIME = 864_000_000; // 10天
public static String generateToken(Authentication authentication) {
UserDetailsImpl userPrincipal = (UserDetailsImpl) authentication.getPrincipal();
Date expirationDate = new Date(System.currentTimeMillis() + EXPIRATION_TIME);
return
Jwts.builder()
.setSubject(userPrincipal.getUsername())
.setIssuedAt(new Date())
.setExpiration(expirationDate)
.signWith(SignatureAlgorithm.HS512, SECRET_KEY)
.compact();
}
public static String getUsernameFromToken(String token) {
return
Jwts.parser()
.setSigningKey(SECRET_KEY)
.parseClaimsJws(token)
.getBody()
.getSubject();
}
public static boolean validateToken(String token) {
try {
Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
return true;
} catch (SignatureException | Malformed
JwtException | Expired
JwtException | Unsupported
JwtException | IllegalArgumentException e) {
return false;
}
}
}
//
认证过滤器
public class
JwtAuthenticationFilter extends OncePerRequestFilter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
JwtUtils
jwtUtils;
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
String authorizationHeader = request.getHeader("Authorization");
if (StringUtils.hasText(authorizationHeader) && authorizationHeader.startsWith("Bearer ")) {
String token = authorizationHeader.substring(7);
if (
jwtUtils.validateToken(token)) {
String username =
jwtUtils.getUsernameFromToken(token);
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
filterChain.doFilter(request, response);
}
}
//
Spring Security配置类
@Configuration
@EnableWeb
Security
public class
SecurityConfig extends Web
SecurityConfigurerAdapter {
@Autowired
private UserDetailsService userDetailsService;
@Autowired
private
JwtAuthenticationFilter
jwtAuthenticationFilter;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
}
@Override
protected void configure(Http
Security http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/login").permitAll()
.anyRequest().authenticated()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.addFilterBefore(
jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
}
}
//
登录接口
@RestController
public class AuthController {
@Autowired
private AuthenticationManager authenticationManager;
@PostMapping("/login")
public ResponseEntity<?> authenticateUser(@RequestBody LoginRequest loginRequest) {
Authentication authentication = authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword())
);
SecurityContextHolder.getContext().setAuthentication(authentication);
String token =
JwtUtils.generateToken(authentication);
return ResponseEntity.ok(new
JwtResponse(token));
}
}
//
登录请求DTO
public class LoginRequest {
private String username;
private String password;
// getters and setters
}
//
JWT响应DTO
public class
JwtResponse {
private String token;
// constructor and getter
}
// 用户详情
实现类
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private UserRepository userRepository;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = userRepository.findByUsername(username)
.orElseThrow(() -> new UsernameNotFoundException("User Not Found with username: " + username));
return UserDetailsImpl.build(user);
}
}
```
5891
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
