SpringSecurity整合jwt

转x33g5p2x  于2022-03-21 转载在 Spring  
字(10.6k)|赞(0)|评价(0)|浏览(267)

1.pom.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3.          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  4.     <modelVersion>4.0.0</modelVersion>
  5.     <parent>
  6.         <groupId>org.springframework.boot</groupId>
  7.         <artifactId>spring-boot-starter-parent</artifactId>
  8.         <version>2.6.4</version>
  9.         <relativePath/> <!-- lookup parent from repository -->
  10.     </parent>
  11.     <groupId>com.yl</groupId>
  12.     <artifactId>jwt</artifactId>
  13.     <version>0.0.1-SNAPSHOT</version>
  14.     <name>jwt</name>
  15.     <description>Demo project for Spring Boot</description>
  16.     <properties>
  17.         <java.version>11</java.version>
  18.     </properties>
  19.     <dependencies>
  20.         <dependency>
  21.             <groupId>org.springframework.boot</groupId>
  22.             <artifactId>spring-boot-starter-security</artifactId>
  23.         </dependency>
  24.         <dependency>
  25.             <groupId>org.springframework.boot</groupId>
  26.             <artifactId>spring-boot-starter-web</artifactId>
  27.         </dependency>
  28.         <dependency>
  29.             <groupId>io.jsonwebtoken</groupId>
  30.             <artifactId>jjwt</artifactId>
  31.             <version>0.9.1</version>
  32.         </dependency>
  33.         <dependency>
  34.             <groupId>javax.xml.bind</groupId>
  35.             <artifactId>jaxb-api</artifactId>
  36.             <version>2.3.0</version>
  37.         </dependency>
  38.         <dependency>
  39.             <groupId>com.sun.xml.bind</groupId>
  40.             <artifactId>jaxb-impl</artifactId>
  41.             <version>2.3.0</version>
  42.         </dependency>
  43.         <dependency>
  44.             <groupId>com.sun.xml.bind</groupId>
  45.             <artifactId>jaxb-core</artifactId>
  46.             <version>2.3.0</version>
  47.         </dependency>
  48.         <dependency>
  49.             <groupId>javax.activation</groupId>
  50.             <artifactId>activation</artifactId>
  51.             <version>1.1.1</version>
  52.         </dependency>
  54.         <dependency>
  55.             <groupId>org.springframework.boot</groupId>
  56.             <artifactId>spring-boot-starter-test</artifactId>
  57.             <scope>test</scope>
  58.         </dependency>
  59.         <dependency>
  60.             <groupId>org.springframework.security</groupId>
  61.             <artifactId>spring-security-test</artifactId>
  62.             <scope>test</scope>
  63.         </dependency>
  64.     </dependencies>
  66.     <build>
  67.         <plugins>
  68.             <plugin>
  69.                 <groupId>org.springframework.boot</groupId>
  70.                 <artifactId>spring-boot-maven-plugin</artifactId>
  71.             </plugin>
  72.         </plugins>
  73.     </build>
  75. </project>

2.用户实体类

  1. package com.yl.jwt.model;
  3. import org.springframework.security.core.GrantedAuthority;
  4. import org.springframework.security.core.userdetails.UserDetails;
  6. import java.util.Collection;
  7. import java.util.List;
  9. public class User implements UserDetails {
  10.     private String username;
  11.     private String password;
  12.     private List<GrantedAuthority> authorities;
  13.     @Override
  14.     public Collection<? extends GrantedAuthority> getAuthorities() {
  15.         return null;
  16.     }
  18.     @Override
  19.     public String getPassword() {
  20.         return password;
  21.     }
  23.     @Override
  24.     public String getUsername() {
  25.         return username;
  26.     }
  28.     @Override
  29.     public boolean isAccountNonExpired() {
  30.         return true;
  31.     }
  33.     @Override
  34.     public boolean isAccountNonLocked() {
  35.         return true;
  36.     }
  38.     @Override
  39.     public boolean isCredentialsNonExpired() {
  40.         return true;
  41.     }
  43.     @Override
  44.     public boolean isEnabled() {
  45.         return true;
  46.     }
  48.     public void setUsername(String username) {
  49.         this.username = username;
  50.     }
  52.     public void setPassword(String password) {
  53.         this.password = password;
  54.     }
  56.     public void setAuthorities(List<GrantedAuthority> authorities) {
  57.         this.authorities = authorities;
  58.     }
  59. }

3. 自定义认证拦截器，登录成功，则返回token

  1. package com.yl.jwt.filter;
  3. import com.fasterxml.jackson.databind.ObjectMapper;
  4. import com.yl.jwt.model.User;
  5. import io.jsonwebtoken.Jwts;
  6. import io.jsonwebtoken.SignatureAlgorithm;
  7. import org.springframework.security.authentication.AuthenticationManager;
  8. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  9. import org.springframework.security.core.Authentication;
  10. import org.springframework.security.core.AuthenticationException;
  11. import org.springframework.security.core.GrantedAuthority;
  12. import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
  13. import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
  15. import javax.servlet.FilterChain;
  16. import javax.servlet.ServletException;
  17. import javax.servlet.http.HttpServletRequest;
  18. import javax.servlet.http.HttpServletResponse;
  19. import java.io.IOException;
  20. import java.io.PrintWriter;
  21. import java.util.Collection;
  22. import java.util.Date;
  23. import java.util.HashMap;
  24. import java.util.Map;
  26. //登录成功返回token,登录失败返回错误信息
  27. public class JwtLoginFilter extends AbstractAuthenticationProcessingFilter {
  28.     public JwtLoginFilter(String defaultFilterProcessesUrl, AuthenticationManager authenticationManager) {
  29.         super(new AntPathRequestMatcher(defaultFilterProcessesUrl));
  30.         setAuthenticationManager(authenticationManager);
  31.     }
  33.     @Override
  34.     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
  35.         User user = new ObjectMapper().readValue(request.getInputStream(),User.class);
  36.         return getAuthenticationManager().authenticate(new UsernamePasswordAuthenticationToken(user.getUsername(),user.getPassword()));
  37.     }
  39.     //登陆成功
  40.     @Override
  41.     protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
  42.         //获取当前用户的角色
  43.         Collection<? extends GrantedAuthority> authorities = authResult.getAuthorities();
  44.         StringBuilder sb = new StringBuilder();
  45.         for (GrantedAuthority authority : authorities) {
  46.             sb.append(authorities + ",");
  47.         }
  48.         // 构造token
  49.         String token = Jwts.builder()
  50.                 .claim("authorities",sb)
  51.                 .setSubject(authResult.getName())
  52.                 .setExpiration(new Date(System.currentTimeMillis() + 60 * 60 * 1000))
  53.                 .signWith(SignatureAlgorithm.HS512,"admin@123")
  54.                 .compact();
  55.         Map<String,Object> map = new HashMap<>();
  56.         map.put("token",token);
  57.         map.put("msg","login success");
  58.         response.setContentType("application/json;charset=utf-8");
  59.         PrintWriter writer = response.getWriter();
  60.         writer.write(new ObjectMapper().writeValueAsString(map));
  61.         writer.flush();
  62.         writer.close();
  63.     }
  65.     //登录失败
  66.     @Override
  67.     protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
  68.         Map<String,Object> map = new HashMap<>();
  69.         map.put("msg","login fail");
  70.         response.setContentType("application/json;charset=utf-8");
  71.         PrintWriter writer = response.getWriter();
  72.         writer.write(new ObjectMapper().writeValueAsString(map));
  73.         writer.flush();
  74.         writer.close();
  75.     }
  76. }

4. 自定义校验拦截器，校验用户每次发请求时携带的token是否正确

  1. package com.yl.jwt.filter;
  3. import io.jsonwebtoken.Claims;
  4. import io.jsonwebtoken.Jws;
  5. import io.jsonwebtoken.Jwts;
  6. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  7. import org.springframework.security.core.GrantedAuthority;
  8. import org.springframework.security.core.authority.AuthorityUtils;
  9. import org.springframework.security.core.context.SecurityContext;
  10. import org.springframework.security.core.context.SecurityContextHolder;
  11. import org.springframework.web.filter.GenericFilterBean;
  13. import javax.servlet.FilterChain;
  14. import javax.servlet.ServletException;
  15. import javax.servlet.ServletRequest;
  16. import javax.servlet.ServletResponse;
  17. import javax.servlet.http.HttpServletRequest;
  18. import java.io.IOException;
  19. import java.util.List;
  21. //用于校验每次用户访问接口时携带的token正不正确
  22. public class JwtFilter extends GenericFilterBean {
  23.     @Override
  24.     public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
  25.         HttpServletRequest req = (HttpServletRequest)request;
  26.         //从请求头获取token，注意：前端在传的时候也应当放在请求头里
  27.         String authorization = req.getHeader("authorization");
  28.         Jws<Claims> jws = Jwts.parser()
  29.                 .setSigningKey("admin@123")
  30.                 .parseClaimsJws(authorization.replaceAll("Bearer", ""));
  31.         Claims body = jws.getBody();
  32.         String username = body.getSubject();
  33.         List<GrantedAuthority> authorities = AuthorityUtils.commaSeparatedStringToAuthorityList((String) body.get("authorities"));
  34.         UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username,null,authorities);
  35.         SecurityContextHolder.getContext().setAuthentication(token);
  36.         filterChain.doFilter(request,response);
  38.     }
  39. }

5. security的配置

  1. package com.yl.jwt.config;
  3. import com.yl.jwt.filter.JwtFilter;
  4. import com.yl.jwt.filter.JwtLoginFilter;
  5. import org.springframework.context.annotation.Bean;
  6. import org.springframework.context.annotation.Configuration;
  7. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  8. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  9. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  10. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  11. import org.springframework.security.crypto.password.PasswordEncoder;
  12. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
  14. @Configuration
  15. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  17.     @Bean
  18.     PasswordEncoder passwordEncoder() {
  19.         return new BCryptPasswordEncoder();
  20.     }
  22.     @Override
  23.     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  24.         auth.inMemoryAuthentication()
  25.                 .withUser("root")
  26.                 .password("$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO") //123
  27.                 .roles("root")
  28.                 .and()
  29.                 .withUser("admin")
  30.                 .password("$2a$10$O8G0X/sUPAA76MV7U3BwY.3Uo8/QMBcqK678Rwkoz.fowbce.CLtO") //123
  31.                 .roles("admin");
  32.     }
  34.     @Override
  35.     protected void configure(HttpSecurity http) throws Exception {
  36.         http.authorizeRequests()
  37.                 .antMatchers("/root")
  38.                 .hasRole("root")
  39.                 .antMatchers("/admin")
  40.                 .hasRole("admin")
  41.                 .antMatchers("/login").permitAll()
  42.                 .anyRequest().authenticated()
  43.                 .and()
  44.                 .addFilterBefore(new JwtLoginFilter("/login",authenticationManager()), UsernamePasswordAuthenticationFilter.class)
  45.                 .addFilterBefore(new JwtFilter(),UsernamePasswordAuthenticationFilter.class)
  46.                 .csrf().disable();
  47.     }
  48. }

6. controller

  1. package com.yl.jwt.controller;
  3. import org.springframework.web.bind.annotation.GetMapping;
  4. import org.springframework.web.bind.annotation.RestController;
  6. @RestController
  7. public class HelloController {
  8.     @GetMapping("/hello")
  9.     public String hello() {
  10.         return "hello";
  11.     }
  13.     @GetMapping("/admin")
  14.     public String admin() {
  15.         return "hello admin";
  16.     }
  18.     @GetMapping("/root")
  19.     public String root() {
  20.         return "hello root";
  21.     }
  22. }

7. 测试

1.没携带token访问接口

2.以json格式传参，登录获取token

3.携带token访问接口

版权说明 : 本文为转载文章, 版权归原作者所有 版权申明

原文链接 : https://blog.csdn.net/weixin_41359273/article/details/123617681

内容来源于网络，如有侵权，请联系作者删除！

spring

相关文章

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新文章

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com