试图为特定端点实现基于jwt的身份验证,但无法导入许多包,如在安全配置中,无法使用extends WebSecurityConfigurerAdapter扩展我的类,它提供了许多内置函数,用于此的jwt依赖项是:
io.jsonwebtoken jjwt 0.11.0
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;
@Component
public class JwtUtil {
@Value("${jwt.secret}")
private String secret;
@Value("${jwt.expirationMs}")
private long expirationMs;
public String generateToken(String username) {
Map<String, Object> claims = new HashMap<>();
return Jwts.builder()
.setClaims(claims)
.setSubject(username)
.setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + expirationMs))
.signWith(SignatureAlgorithm.HS256, secret)
.compact();
}
public boolean validateToken(String token, String username) {
String tokenUsername = extractUsername(token);
return (tokenUsername.equals(username) && !isTokenExpired(token));
}
public String extractUsername(String token) {
return extractClaim(token, Claims::getSubject);
}
public Date extractExpirationDate(String token) {
return extractClaim(token, Claims::getExpiration);
}
private <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
final Claims claims = extractAllClaims(token);
return claimsResolver.apply(claims);
}
private Claims extractAllClaims(String token) {
return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
}
private boolean isTokenExpired(String token) {
return extractExpirationDate(token).before(new Date());
}
}
public class MySecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService customUserDetailsService;
@Autowired
private JwtAuthenticationFilter jwtFilter;
@Autowired
private JwtAuthenticationEntryPoint entryPoint;
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf()
.disable()
.cors()
.disable()
.authorizeRequests()
.antMatchers("/token").permitAll()
.antMatchers(HttpMethod.OPTIONS).permitAll()
.anyRequest().authenticated()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.exceptionHandling().authenticationEntryPoint(entryPoint);
http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
}
//over
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(customUserDetailsService);
}
@Bean
public PasswordEncoder passwordEncoder() {
return NoOpPasswordEncoder.getInstance();
}
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public RegistrationBean jwtAuthFilterRegister(JwtAuthenticationFilter filter) {
FilterRegistrationBean<JwtAuthenticationFilter> registrationBean = new FilterRegistrationBean<>(filter);
registrationBean.setEnabled(false);
return registrationBean;
}
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/signin", "/signup");
}
####################jwt filter #############################
//get jwt
//Bearer
//validate
String requestTokenHeader = request.getHeader("Authorization");
String username=null;
String jwtToken=null;
//null and format
if(requestTokenHeader!=null && requestTokenHeader.startsWith("Bearer "))
{
jwtToken=requestTokenHeader.substring(7);
try{
username = this.jwtUtil.getUsernameFromToken(jwtToken);
}catch (Exception e)
{
e.printStackTrace();
}
if(username!=null && SecurityContextHolder.getContext().getAuthentication()==null)
{
UserDetails userDetails = this.customUserDetailsService.loadUserByUsername(username);
//security
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
usernamePasswordAuthenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
}else
{
System.out.println("Token is not validated..");
}
}
filterChain.doFilter(request,response);
##################entry point ###################
response.sendError(401, "Unauthorized");
1条答案
按热度按时间gojuced71#
在class:public class MySecurityConfig extends WebSecurityConfigurerAdapter中,WebSecurityConfigurerAdapter已被弃用,您可以像这样创建类: