SpringBoot结合JWT登录权限控制的实现
更新时间：2022年07月28日 09:37:08 作者：猩火燎原
本文主要介绍了SpringBoot结合JWT登录权限控制的实现，文中通过示例代码介绍的非常详细，对大家的学习或者工作具有一定的参考学习价值，需要的朋友们下面随着小编来一起学习学习吧
最近项目中使用springboot+jwt实现登录权限控制，所以在这里记录一下防止以后忘记，毕竟好记性不如烂笔头嘛~。
首先我们需要导入使用到的jwt的包：
<dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt</artifactId> <version>0.8.0</version> </dependency> <dependency> <groupId>com.auth0</groupId> <artifactId>java-jwt</artifactId> <version>3.2.0</version> </dependency>
一、准备LoginUser(存放登录用户信息) 和JwtUser
LoginUser.java
public class LoginUser {
private Integer userId;
private String username;
private String password;
private String role;
生成getter和setter......
}JwtUser.java
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Collection;
import java.util.Collections;
public class JwtUser implements UserDetails{
private Integer id;
private String username;
private String password;
private Collection<? extends GrantedAuthority> authorities;
public JwtUser(){
}
public JwtUser(LoginUser loginUser){
this.id = loginUser.getUserId();
this.username = loginUser.getUsername();
this.password = loginUser.getPassword();
authorities = Collections.signleton(new SimpleGrantedAuthority(loginUser.getRole()));
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities(){
return authorities;
}
@Override
public String getPassword(){
return password;
}
@Override
public String getUsername(){
return username;
}
//账号是否未过期
@Override
public boolean isAccountNonExpired(){
return true;
}
//账号是否未锁定
@Override
public boolean isAccountNonLocked(){
return true
}
//账号凭证是否未过期
@Override
public boolean isCredentialsNonExpired(){
return true;
}
@Override
public boolean isEnabled(){
return true;
}
}二、准备JwtTokenUtils
import com.bean.JwtUser;
import io.jsonwebtoken.*;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
public class JwtTokenUtils {
public static final String TOKEN_HEADER = "Authorization";
public static final String TOKEN_PREFIX = "Bearer ";
public static final String SECRET = "jwtsecret";
public static final String ISS = "echisan";
private static final Long EXPIRATION = 60 * 60 * 3;//过期时间3小时
private static final String ROLE = "role";
//创建token
public static String createToken(String username, String role, boolean isRememberMe){
Map map = new HashMap();
map.put(ROLE, role);
return Jwts.builder()
.signWith(SignatureAlgorithm.HS512, SECRET)
.setClaims(map)
.setIssuer(ISS)
.setSubject(username)
.setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + expiration * 1000))
.compact();
}
//从token中获取用户名(此处的token是指去掉前缀之后的)
public static String getUserName(String token){
String username;
try {
username = getTokenBody(token).getSubject();
} catch ( Exception e){
username = null;
}
return username;
}
public static String getUserRole(String token){
return (String) getTokenBody(token).get(ROLE);
}
private static Claims getTokenBody(String token){
Claims claims = null;
try{
claims = Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token).getBody();
} catch(ExpiredJwtException e){
e.printStackTrace();
} catch(UnsupportedJwtException e){
e.printStackTrace();
} catch(MalformedJwtException e){
e.printStackTrace();
} catch(SignatureException e){
e.printStackTrace();
} catch(IllegalArgumentException e){
e.printStackTrace();
}
}
//是否已过期
public static boolean isExpiration(String token){
try{
return getTokenBody(token).getExpiration().before(new Date());
} catch(Exception e){
e.printStackTrace;
}
return true;
}
}三、准备JWTAuthenticationFilter (验证登录)、JWTAuthorizationFilter (鉴定权限)和UserDetailsServiceImpl类 (查库匹配账号密码)
1.JWTAuthenticationFilter.java （验证登录）
public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter{
private AuthenticationManager authenticationManager;
public JWTAuthenticationFilter(AuthenticationManager authenticationManager){
this.authenticationManager = authenticationManager;
setAuthenticationFailureHandler(new FailHandler());//设置账号密码错误时的处理方式
}
@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException{
//从输入流中获取登录的信息
String username = request.getParameter("username");
String password = request.getParameter("password");
return authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(username, password, new ArrayList<>())
);
}
@Override
protected void successfulAuthentication(HttpServletRequest request,
HttpServletResponse response, FilterChain chain, Authentication authResult
) throws IOException, ServletException{
JwtUser jwtUser = (JwtUser) authResult.getPrincipal();
Collection<? extends GrantedAuthority> authorities = jwtUser.getAuthorities();
String role = "";
for(GrantedAuthority authority : authorities){
role = authority.getAuthority();
}
String token = JwtTokenUtils.createToken(jwtUser.getUsername, role, false);
//返回创建成功的token
//但是这里创建的token只是单纯的token，按照jwt的规定，
//最后请求的格式应该是 “Bearer token“。
response.addHeader(JwtTokenUtils.TOKEN_HEADER, JwtTokenUtils.TOKEN_PREFIX + token);
}
//@Override
//protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,
// AuthenticationException failed) throws IOException, ServletException {
// response.getWriter().write("authentication failed, reason: " + failed.getMessage());
//}
}2.JWTAuthorizationFilter.java (鉴定权限)
public class JWTAuthorizationFilter extends BasicAuthenticationFilter{
public JWTAuthorizationFilter(AuthenticationManager authenticationManager){
super(authenticationManager);
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
FilterChain chain) throws IOException, ServletException {
String tokenHeader = request.getHeader(JwtTokenUtils.TOKEN_HEADER);
//如果请求头中没有Authorization信息则直接放行了
if(tokenHeader == null || !tokenHeader.startsWith(JwtTokenUtils.TOKEN_PREFIX)){
chain.doFilter(request, response);
return;
}
//如果请求头中有token,则进行解析，并且设置认证信息
if(!JwtTokenUtils.isExpiration(tokenHeader.replace(JwtTokenUtils.TOKEN_PREFIX， “”))){
SecurityContextHolder.getContext().setAuthentication(getAuthentication(tokenHeader));
}
chain.doFilter(request, response);
}
private UsernamePasswordAuthenticationToken getAuthentication(String tokenHeader){
String token = tokenHeader.replace(JwtTokenUtils.TOKEN_PREFIX， “”);
String username = JwtTokenUtils.getUserName(token);
if(username != null){
return new UsernamePasswordAuthenticationToken(username, null, new ArrayList<>());
}
return null;
}
}3.UserDetailsServiceImpl.java (查库匹配账号密码)
import org.springframework.security.core.userdetails.UserDetailsService;
@Service
public class UserDetailsServiceImpl implements UserDetailsService{
@Autowired
UserMapper userMapper;
public BCryptPasswordEncoder bCryptPasswordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
LoginUser loginUser = usersMapper.selectByUserAccount(s);
loginUser.setPassword(bCryptPasswordEncoder().encode(loginUser.getPassword()));
return new JwtUser(loginUser);
}
}四、FailHandler（账号密码错误时的处理方式）
public class FailHandler extends SimpleUrlAuthenticationFailureHandler {
@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
AuthenticationException exception) throws IOException, ServletException {
String errorMsg = exception.getMessage();
if(exception instanceof BadCredentialsException){
errorMsg = "用户名或密码错误";
}
response.setHeader("content-type", "application/json");
response.getOutputStream().write(JSONObject.fromObject(new AjaxResult(errorMsg, false)).toString().getBytes("utf-8"));
}
}五、配置SecurityConfig
这个类里规定了权限的相关信息
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter{
@Autowired
private UserDetailsService userDetailsService;
@Bean
public BCryptPasswordEncoder bCryptPasswordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception{
auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
}
@Override
public void configure(WebSecurity web) throws Exception{
web.ignoring().antMatchers("/static/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception{
http.cors().and().csrf().disable()
.authorizeRequests()
.antMatchers(HttpMethod.POST, "/login").permitAll()//都可以访问
.antMatchers("/").permitAll()
.antMatchers("/index.html").permitAll()
.antMatchers("/*.js").permitAll()
.antMatchers("/*.css").permitAll()
.antMatchers("/*.png").permitAll()
.antMatchers("/*.svg").permitAll()
.antMatchers("/*.woff").permitAll()
.antMatchers("/*.ttf").permitAll()
.antMatchers("/*.eot").permitAll()
.antMatchers("/test/*").permitAll()//对接口的权限控制，表示对于"/test"路径下的所有接口无需登录也可以访问
.antMatchers("/swagger-ui.html", "/v2/api-docs", "/configuration/ui", "/swagger-resources", "/configuration/security",
"/webjars/**", "/swagger-resources/configuration/ui").permitAll()//表示对swagger页面放行
.anyRequest().authenticated()//表示其余所有请求需要登陆之后才能访问
.and()
.addFilter(new JWTAuthenticationFilter(authenticationManager()))
.addFilter(new JWTAuthorizationFilter(authenticationManager()))
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
@Bean
CorsConfigurationSource corsConfigurationSource() {
final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
return source;
}
}到此springboot+jwt实现登录验证功能就已实现，其实在securityConfig中还可以加入对某个接口的角色权限，因为项目中没有用到所以这里并没有加上，其实也很简单，只是把permitAll()换成其他方法，想实现的话请自行百度啦。更多相关SpringBoot JWT登录权限控制内容请搜索脚本之家以前的文章或继续浏览下面的相关文章希望大家以后多多支持脚本之家！
相关文章
Java语言什么都好，就是在OJ的时候真的是太慢了，今天来讲解一种让Java运行速度快速提高的方法，感兴趣的朋友一起看看吧2023-11-11
这篇文章主要介绍了Java 客户端向服务端上传mp3文件数据的实例代码,非常不错，具有一定的参考借鉴价值，需要的朋友可以参考下2018-09-09
在本篇文章里小编给大家分享了一篇关于java中调用super的实例讲解内容，有兴趣的朋友们可以学习下。2020-12-12
springmvc+ajax+formdata上传图片代码实例
这篇文章主要介绍了springmvc+ajax+formdata上传图片代码实例,文中通过示例代码介绍的非常详细，对大家的学习或者工作具有一定的参考学习价值,需要的朋友可以参考下2019-09-09
这篇文章主要为大家分享了最有价值的3道MySQL面试题，，感兴趣的小伙伴们可以参考一下2021-07-07
基于Java实现一个简单的单词本Android App的实践
本文基于Java实现了一个简单的单词本安卓app，用的是SQLite数据库，文中通过示例代码介绍的非常详细，具有一定的参考价值，感兴趣的小伙伴们可以参考一下2022-01-01
Mybatis报Type interface *.*Mapper is not&
本文主要介绍了Mybatis报Type interface *.*Mapper is not known to the MapperRegis,文中通过示例代码介绍的非常详细,对大家的学习或者工作具有一定的参考学习价值,需要的朋友们下面随着小编来一起学习学习吧2024-07-07
这篇文章主要介绍了如何通过Kaptcha在Web页面生成验证码,文中通过示例代码介绍的非常详细，对大家的学习或者工作具有一定的参考学习价值,需要的朋友可以参考下2020-10-10
这篇文章主要介绍了Java枚举与.net枚举区别详解,文中通过示例代码介绍的非常详细，对大家的学习或者工作具有一定的参考学习价值,需要的朋友可以参考下2020-02-02
映射器是MyBatis最复杂也最重要的组件,也是基于MyBatis应用程序开发中,本文主要介绍了深入浅出MyBatis映射器,具有一定的参考价值,感兴趣的可以了解一下2024-04-04
最新评论