直接贴几个类的代码
如果报红 估计是 导包问题
可以根据Token Subject的不同实现不同用户的身份认证
提供不同的token接口 生成不同主题的token就行了
过滤器中可以实现
--未实现token刷新功能
--未实现token过期功能
1. pom依赖
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.7.0</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
</dependency>
2. SecurityJjwtDemoApplication项目启动类 也是接口类
提供两个接口 getToken 和 获取当前会话用户
getToken的响应头中有token
获取会话用户需要携带token访问
@SpringBootApplication
@RestController
public class SecurityJjwtDemoApplication {
public static void main(String[] args) {
SpringApplication.run(SecurityJjwtDemoApplication.class, args);
}
@Autowired
private AuthService authService;
@GetMapping("/getToken")
public ResponseEntity<String> createAuthenticationToken(String username, String password) throws JsonProcessingException {
String token = authService.login(username, password);
HttpHeaders headers = new HttpHeaders();
headers.add("X-Authorization", token);
return ResponseEntity.noContent().headers(headers).build();
}
@GetMapping("/currentUser")
public ResponseEntity<UserDetails> currentUser() {
UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
return ResponseEntity.ok(userDetails);
}
}
3. WebSecurityConfig配置类
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, proxyTargetClass = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private AuthService authService;
@Bean
public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
return new JwtAuthenticationTokenFilter(authService);
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/favicon.ico");
}
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
// 由于使用的是JWT，我们这里不需要csrf
.csrf().disable()
// 认证过程 发生异常处理类
.exceptionHandling().authenticationEntryPoint(new JwtAuthenticationEntryPoint())
.and()
.headers().httpStrictTransportSecurity().disable()
.and()
// 基于token，所以不需要session
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
// 对于获取token的rest api要允许匿名访问
.antMatchers("/getToken").permitAll()
// 除上面外的所有请求全部需要鉴权认证
.anyRequest().authenticated();
// 添加JWT filter
httpSecurity.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
// 禁用缓存
httpSecurity.headers().cacheControl();
}
}
4. JwtAuthenticationEntryPoint异常处理类
@Slf4j
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable {
private static final long serialVersionUID = -8970718410437077606L;
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
log.error("认证授权过程发生异常 返回401状态码", authException);
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
}
5. JwtAuthenticationTokenFilter认证过滤器
public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
private AuthService authService;
public JwtAuthenticationTokenFilter(AuthService authService) {
this.authService = authService;
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
String authToken = request.getHeader("X-Authorization".toLowerCase());
if (StringUtils.isNotBlank(authToken)) {
if (SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails = authService.getUserDetails(authToken);
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
logger.info("authenticated user " + userDetails.getUsername() + ", setting security context");
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
chain.doFilter(request, response);
}
}
6. AuthService服务类
@Service
public class AuthService implements UserDetailsService {
/**
* 密钥
*/
public static final String SECRET = "SECRET";
public static final String USER_KEY = "USER_KEY";
/**
* 用户主题
*/
public static final String USER_SUBJECT = "USER_SUBJECT";
/**
* 过期时间
*/
public static final Long expiration = 604800L;
@Autowired
private ObjectMapper objectMapper;
/**
* 解码出token中的UserDetails
*
* @param authToken
* @return
*/
public UserDetails getUserDetails(String authToken) {
Claims mySecret = Jwts.parser().setSigningKey(SECRET).parseClaimsJws(authToken).getBody();
String subject = mySecret.getSubject();
String user = (String) mySecret.get(USER_KEY);
try {
/**
* 根据不同的用户主题 反序列化出 不同的用户对象
*/
if (USER_SUBJECT.equals(subject)) {
return objectMapper.readValue(user, User.class);
}
} catch (IOException e) {
e.printStackTrace();
}
return null;
}
public String login(String username, String password) throws JsonProcessingException {
UserDetails userDetails = loadUserByUsername(username);
if (!userDetails.getPassword().equals(password)) {
throw new BadCredentialsException("密码错误");
}
Map<String, Object> claims = new HashMap<>();
claims.put(USER_KEY, objectMapper.writeValueAsString(userDetails));
Date issuedAt = new Date();
return Jwts.builder()
.setClaims(claims)
// .setId()
// 主题
.setSubject(USER_SUBJECT)
// 发行时间
.setIssuedAt(issuedAt)
// 过期时间
.setExpiration(new Date(issuedAt.getTime() + expiration * 1000))
.signWith(SignatureAlgorithm.HS512, SECRET)
.compact();
}
/**
* 从数据源中 获取用户数据
*
* @param username
* @return
* @throws UsernameNotFoundException
*/
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
User user = new User().setUsername(username).setPassword("123456");
return user;
}
}
7. UserDetails实现类
@Data
@Accessors(chain = true)
public class User implements UserDetails {
private String username;
private String password;
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return null;
}
@Override
public boolean isAccountNonExpired() {
return false;
}
@Override
public boolean isAccountNonLocked() {
return false;
}
@Override
public boolean isCredentialsNonExpired() {
return false;
}
@Override
public boolean isEnabled() {
return false;
}
}
网友评论