随笔- 213 文章- 0 评论- 6 阅读- 21万

SpringBoot使用token简单鉴权的具体实现方法

实现思路：

用户登录请求登录接口时，验证用户名密码等，验证成功会返回给前端一个token，这个token就是之后鉴权的唯一凭证。
后台可能将token存储在redis或者数据库中。
之后前端的请求，需要在header中携带token，后端取出token去redis或者数据库中进行验证，如果验证通过则放行，如果不通过则拒绝操作。

当然，如上的说法只是简单的实现，实质上还有很多需要优化的地方。

可以参考：https://blog.csdn.net/kkkun_joe/article/details/81878231

https://www.javamall.com.cn/blog/archives/642

具体实现方式

1、添加依赖

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.3.4.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.example.jwt.token</groupId>
    <artifactId>demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>demo</name>
    <description>Demo project for Spring Boot</description>
 
    <properties>
        <java.version>1.8</java.version>
    </properties>
 
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
 
        <!-- https://mvnrepository.com/artifact/com.auth0/java-jwt -->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.10.3</version>
        </dependency>
 
 
 
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.junit.vintage</groupId>
                    <artifactId>junit-vintage-engine</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
    </dependencies>
 
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
 
</project>

　　2、生成签名方法

/**
     * 生成签名
     */
    public String sign(String userName,String passWord){
        Date date=new Date(System.currentTimeMillis()+3600);
        //设置私钥和加密算法
        Algorithm algorithm=Algorithm.HMAC256("sadfsfsf3r3r545dfdfasas");
        //设置头部信息
        Map<String,Object> header=new HashMap<>();
        header.put("typ","JWT");
        header.put("alg","HS256");
        String token = JWT.create().withHeader(header).withClaim("userName", userName)
                .withClaim("passWord", passWord).withExpiresAt(date).sign(algorithm);
        return token;
 
    }

　　3、解码，通过token获取用户名

/**
     * 通过token获取用户
     * @param token
     */
    @GetMapping("/user/{token}")
    public void getUserName(@PathVariable("token") String token){
        String userName = JWT.decode(token).getClaim("userName").asString();
        System.out.println(userName);
    }

4、增加拦截器

public class LoginInterceptor implements HandlerInterceptor {
    @Autowired
    private LoginController loginController;
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String token = request.getHeader("token");
        if(StringUtils.isEmpty(token)){
           throw new Exception("token不能为空");
        }
        Boolean verify = null;
        try {
            LoginController loginController=new LoginController();
            verify = loginController.verify(token);
            if(verify){
               return true;
            }else {
                return false;
            }
        } catch (Exception e) {
            return false;
        }
    }
}

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new LoginInterceptor())
                .addPathPatterns("/**")
        .excludePathPatterns("/login")
        ;
    }
}

5、测试

@GetMapping("/login")
    public String login(){
        //模拟用户名和密码
        String userName="admin";
        String passWord="admin";
        String token = sign(userName, passWord);
        return token;
    }