環境
springBoot 2.3.3
springSecurity 5.0
jjwt 0.91
pox.xml 檔案主要資訊
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>登入後複製
目錄結構資訊
請忽略檔案命名
jwtAccessDeniedHandler 和JwtAuthenticationEntryPoint
這兩個類別的作用是使用者存取沒有授權資源和攜帶錯誤token的錯誤返回處理資訊類，要使用這兩個類別只需要在security的設定檔中設定一下就可以只用了
/**
* @author Bxsheng
* @blogAddress www.kdream.cn
* @createTIme 2020/9/17
* since JDK 1.8
* 当用户在没有授权的时候，返回的指定信息
*/
@Component
public class jwtAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {
System.out.println("用户访问没有授权资源");
System.out.println(e.getMessage());
httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, e==null?"用户访问没有授权资源":e.getMessage());
}
}登入後複製
/**
* @author Bxsheng
* @blogAddress www.kdream.cn
* @createTIme 2020/9/17
* since JDK 1.8
*/
@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {
System.out.println("用户访问资源没有携带正确的token");
System.out.println(e.getMessage());
httpServletResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, e==null?"用户访问资源没有携带正确的token":e.getMessage());
}
}登入後複製
UserDetailsServiceImpl 登入資訊驗證
該類別直接繼承UserDetailsService 進行登入資訊驗證，在輸入帳戶密碼進行登入的時候，會進入這個類別進行驗證資訊。
當然我這裡是直接使用了寫死的密碼，正常應該從資料庫中取得使用者的資訊和權限資訊
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
//直接写死数据信息，可以在这里获取数据库的信息并进行验证
UserDetails userDetails = User.withUsername(s).password(new BCryptPasswordEncoder().encode("123456"))
.authorities("bxsheng").build();
return userDetails;
}
}登入後複製
JwtTokenUtils jwt包裝類別
#該類別直接使用slyh 的[SpringBoot JWT實作登入權限控制(代碼))](( https://www.yisu.com/article/257119.htm)的文章裡面的類別。
package cn.kdream.securityjwt.utlis;
import io.jsonwebtoken.*;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
/**
* @author Bxsheng
* @blogAddress www.kdream.cn
* @createTIme 2020/9/16
* since JDK 1.8
*/
public class JwtTokenUtils {
public static final String TOKEN_HEADER = "Authorization";
public static final String TOKEN_PREFIX = "Bearer ";
public static final String SECRET = "jwtsecret";
public static final String ISS = "echisan";
private static final Long EXPIRATION = 60 * 60 * 3L; //过期时间3小时
private static final String ROLE = "role";
//创建token
public static String createToken(String username, String role, boolean isRememberMe){
Map map = new HashMap();
map.put(ROLE, role);
return Jwts.builder()
.signWith(SignatureAlgorithm.HS512, SECRET)
.setClaims(map)
.setIssuer(ISS)
.setSubject(username)
.setIssuedAt(new Date())
.setExpiration(new Date(System.currentTimeMillis() + EXPIRATION * 1000))
.compact();
}
//从token中获取用户名(此处的token是指去掉前缀之后的)
public static String getUserName(String token){
String username;
try {
username = getTokenBody(token).getSubject();
} catch ( Exception e){
username = null;
}
return username;
}
public static String getUserRole(String token){
return (String) getTokenBody(token).get(ROLE);
}
private static Claims getTokenBody(String token){
Claims claims = null;
try{
claims = Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token).getBody();
} catch(ExpiredJwtException e){
e.printStackTrace();
} catch(UnsupportedJwtException e){
e.printStackTrace();
} catch(MalformedJwtException e){
e.printStackTrace();
} catch(SignatureException e){
e.printStackTrace();
} catch(IllegalArgumentException e){
e.printStackTrace();
}
return claims;
}
//是否已过期
public static boolean isExpiration(String token){
try{
return getTokenBody(token).getExpiration().before(new Date());
} catch(Exception e){
System.out.println(e.getMessage());
}
return true;
}
}登入後複製
JwtAuthenticationFilter 自訂驗證jwt
該類別直接使用slyh 的[SpringBoot JWT實作登入權限控制(代碼))](( https://www.yisu.com/article /257119.htm))的文章裡面的類別。
這個類別主要的功能是驗證jwt訊息 ，主要攜帶了token請求過來，解析jwt並設定在security的上下文中。保存token中所包含權限資訊到上下文是這個做法的其中一個目的。你就可以對使用者進行權限認證了
/**
* @author Bxsheng
* @blogAddress www.kdream.cn
* @createTIme 2020/9/16
* since JDK 1.8
*/
public class JwtAuthenticationFilter extends BasicAuthenticationFilter {
public JwtAuthenticationFilter(AuthenticationManager authenticationManager) {
super(authenticationManager);
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
String tokenHeader = request.getHeader(JwtTokenUtils.TOKEN_HEADER);
//如果请求头中没有Authorization信息则直接放行了
if(tokenHeader == null || !tokenHeader.startsWith(JwtTokenUtils.TOKEN_PREFIX)){
chain.doFilter(request, response);
return;
}
//如果请求头中有token,则进行解析，并且设置认证信息
if(!JwtTokenUtils.isExpiration(tokenHeader.replace(JwtTokenUtils.TOKEN_PREFIX,""))){
//设置上下文
UsernamePasswordAuthenticationToken authentication = getAuthentication(tokenHeader);
SecurityContextHolder.getContext().setAuthentication(authentication);
}
super.doFilterInternal(request, response, chain);
}
//获取用户信息
private UsernamePasswordAuthenticationToken getAuthentication(String tokenHeader){
String token = tokenHeader.replace(JwtTokenUtils.TOKEN_PREFIX, "");
String username = JwtTokenUtils.getUserName(token);
// 获得权限 添加到权限上去
String role = JwtTokenUtils.getUserRole(token);
List<GrantedAuthority> roles = new ArrayList<GrantedAuthority>();
roles.add(new GrantedAuthority() {
@Override
public String getAuthority() {
return role;
}
});
if(username != null){
return new UsernamePasswordAuthenticationToken(username, null,roles);
}
return null;
}
}登入後複製
security的設定資訊
@EnableGlobalMethodSecurity(prePostEnabled = true) 開啟prePostEnabled註解方式授權
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityJwtConfig extends WebSecurityConfigurerAdapter {
@Autowired
private jwtAccessDeniedHandler jwtAccessDeniedHandler;
@Autowired
private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.OPTIONS,"/**")
.permitAll()
.antMatchers("/").permitAll()
//login 不拦截
.antMatchers("/login").permitAll()
.anyRequest().authenticated()
//授权
.and()
// 禁用session
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
// 使用自己定义的拦截机制，拦截jwt
http.addFilterBefore(new JwtAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class)
//授权错误信息处理
.exceptionHandling()
//用户访问资源没有携带正确的token
.authenticationEntryPoint(jwtAuthenticationEntryPoint)
//用户访问没有授权资源
.accessDeniedHandler(jwtAccessDeniedHandler);
}
@Bean
public PasswordEncoder passwordEncoder(){
//使用的密码比较方式
return new BCryptPasswordEncoder();
}
}登入後複製
啟動類別
我在啟動類別中配置了三個方法，一個是用來進行登入資訊的，另外兩個設定了需要權限存取
@SpringBootApplication
@RestController
public class SecurityJwtApplication {
private final AuthenticationManagerBuilder authenticationManagerBuilder;
public SecurityJwtApplication(AuthenticationManagerBuilder authenticationManagerBuilder) {
this.authenticationManagerBuilder = authenticationManagerBuilder;
}
public static void main(String[] args) {
SpringApplication.run(SecurityJwtApplication.class, args);
}
@GetMapping("/")
public String index(){
return "security jwt";
}
@PostMapping("/login")
public String login(@RequestParam String u,@RequestParam String p){
// 登陆验证
UsernamePasswordAuthenticationToken token =
new UsernamePasswordAuthenticationToken(u, p);
Authentication authentication = authenticationManagerBuilder.getObject().authenticate(token);
SecurityContextHolder.getContext().setAuthentication(authentication);
//创建jwt信息
String token1 = JwtTokenUtils.createToken(u,"bxsheng", true);
return token1;
}
@GetMapping("/role")
@PreAuthorize("hasAnyAuthority('bxsheng')")
public String roleInfo(){
return "需要获得bxsheng权限，才可以访问";
}
@GetMapping("/roles")
@PreAuthorize("hasAnyAuthority('kdream')")
public String rolekdream(){
return "需要获得kdream权限，才可以访问";
}
}登入後複製
效果
直接存取需要授權的使用者資訊
直接沒有使用token直接存取只要授權的資源信息，會進入JwtAuthenticationEntryPoint 類別
#取得token
存取在啟動類別中的login方法，取得token資訊
因為我使用了固定的密碼，所以在使用當錯誤的密碼訪問的時候，可以在springboot的全局異常處理中捕獲到異常信息
/**
* @author Bxsheng
* @blogAddress www.kdream.cn
* @createTIme 2020/9/17
* since JDK 1.8
*/
@RestControllerAdvice
public class Error {
@ExceptionHandler(BadCredentialsException.class)
public void badCredentialsException(BadCredentialsException e){
System.out.println(e.getMessage());//用户名或密码错误
// throw new BadCredentialsException(e.getMessage());
}
}登入後複製
正確的獲取token，並進行受保護的資源訪問
裡面有寫死的bxsheng權限訊息，所以正常是可以取得bxsheng標識的資源資訊的。
成功取得資訊
#嘗試取得無權限資源資訊
#使用token直接存取無權限資源資訊，會進入jwtAccessDeniedHandler 類別
以上是怎麼使用SpringBoot+SpringSecurity+jwt實現驗證的詳細內容。更多資訊請關注PHP中文網其他相關文章！
