个人博客开发之blog-api 项目整合JWT实现token登录认证

本文主要是介绍个人博客开发之blog-api 项目整合JWT实现token登录认证，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

前言

现在前后端分离，基于session设计到跨越问题，而且session在多台服器之前同步问题，肯能会丢失，所以倾向于使用jwt作为token认证 json web token

导入java-jwt工具包

 <dependency><groupId>com.auth0</groupId><artifactId>java-jwt</artifactId><version>3.15.0</version></dependency>

通过jwt生成token

编写通用TokenService

package cn.soboys.core.authentication;import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import org.springframework.stereotype.Service;import java.util.Date;/*** @author kenx* @version 1.0* @date 2021/6/22 10:23* token 操作*/
@Service("TokenService")
public class TokenService {//过期时间单位 毫秒 7*24*60*60*1000private final Long tokenExpirationTime = 604800000l;/*** @param uuid   用户唯一标示* @param secret 用户密码等* @return token生成*/public String generateToken(String uuid, String secret) {//每次登录充当前时间重新计算Date expiresDate = new Date(System.currentTimeMillis() + tokenExpirationTime);String token = "";token = JWT.create()//设置过期时间.withExpiresAt(expiresDate)//设置接受方信息，一般时登录用户.withAudience(uuid)// 将 user id 保存到 token 里面//使用HMAC算法.sign(Algorithm.HMAC256(secret));// 以 password 作为 token 的密钥return token;}
}

编写注解过滤拦截需要登录验证的controller

PassToken用于跳过登录验证UserLoginToken表示需要登录验证

package cn.soboys.core.authentication;import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;/*** @author kenx* @version 1.0* @date 2021/6/21 17:21* 跳过登录验证*/
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface PassToken {boolean required() default true;
}

package cn.soboys.core.authentication;import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;/*** @author kenx* @version 1.0* @date 2021/6/21 17:22* 需要登录验证*/
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface UserLoginToken {boolean required() default true;
}

编写业务异常AuthenticationException

认证失败抛出认证异常AuthenticationException

package cn.soboys.core.authentication;import lombok.Data;/*** @author kenx* @version 1.0* @date 2021/6/22 13:58* 认证异常*/
@Data
public class AuthenticationException extends RuntimeException {public AuthenticationException(String message) {super(message);}}

编写认证拦截器AuthenticationInterceptor，拦截需要认证请求

package cn.soboys.core.authentication;import cn.hutool.extra.spring.SpringUtil;
import cn.soboys.core.ret.ResultCode;
import cn.soboys.mallapi.entity.User;
import cn.soboys.mallapi.service.IUserService;
import cn.soboys.mallapi.service.impl.UserServiceImpl;
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.exceptions.JWTVerificationException;
import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.annotation.Annotation;
import java.lang.reflect.Method;/*** @author kenx* @version 1.0* @date 2021/6/21 17:24* 用户验证登录拦截*/public class AuthenticationInterceptor implements HandlerInterceptor {//从header中获取tokenpublic static final String AUTHORIZATION_TOKEN = "authorizationToken";private  IUserService userService= SpringUtil.getBean(UserServiceImpl.class);@Overridepublic boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object object) throws Exception {String token = httpServletRequest.getHeader(AUTHORIZATION_TOKEN);// 从 http 请求头中取出 tokenhttpServletRequest.setAttribute("token", token);// 如果不是映射到Controller mapping方法直接通过if (!(object instanceof HandlerMethod)) {return true;}HandlerMethod handlerMethod = (HandlerMethod) object;Method method = handlerMethod.getMethod();//检查是否有passtoken注释，有则跳过认证if (method.isAnnotationPresent(PassToken.class)) {PassToken passToken = method.getAnnotation(PassToken.class);if (passToken.required()) {return true;}}//检查有没有需要用户权限的注解//Annotation classLoginAnnotation = handlerMethod.getBeanType().getAnnotation(UserLoginToken.class);// 类级别的要求登录标记if (method.isAnnotationPresent(UserLoginToken.class) || handlerMethod.getBeanType().isAnnotationPresent(UserLoginToken.class)) {UserLoginToken userLoginToken =method.getAnnotation(UserLoginToken.class) == null ?handlerMethod.getBeanType().getAnnotation(UserLoginToken.class) : method.getAnnotation(UserLoginToken.class);if (userLoginToken.required()) {// 执行认证if (token == null) {throw new AuthenticationException("无token，请重新登录");}// 获取 token 中的 user idString userId;try {userId = JWT.decode(token).getAudience().get(0);} catch (JWTDecodeException j) {throw new AuthenticationException("非法用户");}User user = userService.getUserInfoById(userId);if (user == null) {throw new AuthenticationException("用户过期，请重新登录");}// 验证 tokenJWTVerifier jwtVerifier = JWT.require(Algorithm.HMAC256(user.getUserMobile())).build();try {jwtVerifier.verify(token);} catch (JWTVerificationException e) {throw new AuthenticationException("非法用户");}return true;}}return true;}
}