2023年6月20日发(作者：)

详解SpringBoot实战之Filter实现使⽤JWT进⾏接⼝认证本⽂介绍了spring Boot实战之Filter实现使⽤JWT进⾏接⼝认证，分享给⼤家jwt(json web token)⽤户发送按照约定，向服务端发送 Header、Payload 和 Signature，并包含认证信息（密码），验证通过后服务端返回⼀个token,之后⽤户使⽤该token作为登录凭证，适合于移动端和apijwt使⽤流程本⽂⽰例接上⾯⼏篇⽂章中的代码进⾏编写，请阅读本⽂的同时可以参考前⾯⼏篇⽂章1、添加依赖库jjwt，本⽂中构造jwt及解析jwt都使⽤了jjwt库

btoken

jjwt

0.6.0

2、添加登录获取token时，所需要的认证信息类ckage ;

public class LoginPara {

private String clientId;

private String userName;

private String password;

private String captchaCode;

private String captchaValue;

public String getClientId() {

return clientId;

}

public void setClientId(String clientId) {

Id = clientId;

}

public String getUserName() {

return userName;

}

public void setUserName(String userName) {

me = userName;

}

public String getPassword() {

return password;

}

public void setPassword(String password) {

rd = password;

}

public String getCaptchaCode() {

return captchaCode;

}

public void setCaptchaCode(String captchaCode) {

aCode = captchaCode;

}

public String getCaptchaValue() {

return captchaValue;

}

public void setCaptchaValue(String captchaValue) {

aValue = captchaValue;

}

}

3、添加构造jwt及解析jwt的帮助类ckage ;

import ;

import ;

import KeySpec;

import peConverter;

import ;

import lder;

import ;

import ureAlgorithm;

public class JwtHelper {

public static Claims parseJWT(String jsonWebToken, String base64Security){

try

{

Claims claims = ()

.setSigningKey(ase64Binary(base64Security))

.parseClaimsJws(jsonWebToken).getBody();

return claims;

}

catch(Exception ex)

{

return null;

}

}

public static String createJWT(String name, String userId, String role,

String audience, String issuer, long TTLMillis, String base64Security)

{

SignatureAlgorithm signatureAlgorithm = 256;

long nowMillis = tTimeMillis();

Date now = new Date(nowMillis);

//⽣成签名密钥

byte[] apiKeySecretBytes = ase64Binary(base64Security);

Key signingKey = new SecretKeySpec(apiKeySecretBytes, Name());

//添加构成JWT的参数

JwtBuilder builder = r().setHeaderParam("typ", "JWT")

.claim("role", role)

.claim("unique_name", name)

.claim("userid", userId)

.setIssuer(issuer)

.setAudience(audience)

.signWith(signatureAlgorithm, signingKey);

//添加Token过期时间

if (TTLMillis >= 0) {

long expMillis = nowMillis + TTLMillis;

Date exp = new Date(expMillis);

iration(exp).setNotBefore(now);

}

//⽣成JWT

return t();

}

}

4、添加token返回结果类ckage ;

public class AccessToken {

private String access_token;

private String token_type;

private long expires_in;

public String getAccess_token() {

return access_token;

}

public void setAccess_token(String access_token) {

_token = access_token;

}

public String getToken_type() {

return token_type;

}

public void setToken_type(String token_type) {

_type = token_type;

}

public long getExpires_in() {

return expires_in;

}

public void setExpires_in(long expires_in) {

s_in = expires_in;

}

}

5、添加获取token的接⼝，通过传⼊⽤户认证信息(⽤户名、密码)进⾏认证获取package ;

import red;

import tBody;

import tMapping;

import ntroller;

import fo;

import foRepository;

import s;

import Msg;

import StatusCode;

@RestController

public class JsonWebToken {

@Autowired

private UserInfoRepository userRepositoy;

@Autowired private Audience audienceEntity;

@RequestMapping("oauth/token")

public Object getAccessToken(@RequestBody LoginPara loginPara)

{

ResultMsg resultMsg;

try

{

if(entId() == null

|| (entId().compareTo(entId()) != 0))

{

resultMsg = new ResultMsg(D_code(),

D_msg(), null);

return resultMsg;

}

//验证码校验在后⾯章节添加

//验证⽤户名密码

UserInfo user = erInfoByName(rName());

if (user == null)

{

resultMsg = new ResultMsg(D_code(),

D_msg(), null);

return resultMsg;

}

else

{

String md5Password = 5(sword()+t());

if (eTo(sword()) != 0)

{

resultMsg = new ResultMsg(D_code(),

D_msg(), null);

return resultMsg;

}

}

//拼装accessToken

String accessToken = JWT(rName(), f(e()),

e(), entId(), e(),

iresSecond() * 1000, e64Secret());

//返回accessToken

AccessToken accessTokenEntity = new AccessToken();

ess_token(accessToken);

ires_in(iresSecond());

en_type("bearer");

resultMsg = new ResultMsg(code(),

msg(), accessTokenEntity);

return resultMsg;

}

catch(Exception ex)

{

resultMsg = new ResultMsg(_code(),

_msg(), null);

return resultMsg;

}

}

}

6、添加使⽤jwt认证的filterpackage ;

import ption;

import ;

import Chain;

import Config;

import tException;

import tRequest;

import tResponse;

import rvletRequest;

import rvletResponse;

import red;

import BeanAutowiringSupport;

import Mapper;

import ce;

import per;

import Msg;

import StatusCode;

public class HTTPBearerAuthorizeAttribute implements Filter{

@Autowired

private Audience audienceEntity;

@Override

public void init(FilterConfig filterConfig) throws ServletException {

// TODO Auto-generated method stub

sInjectionBasedOnServletContext(this,

vletContext());

}

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

// TODO Auto-generated method stub

ResultMsg resultMsg;

HttpServletRequest httpRequest = (HttpServletRequest)request;

String auth = der("Authorization");

if ((auth != null) && (() > 7))

{

String HeadStr = ing(0, 6).toLowerCase(); if (eTo("bearer") == 0)

{

auth = ing(7, ());

if (WT(auth, e64Secret()) != null)

{

er(request, response);

return;

}

}

}

HttpServletResponse httpResponse = (HttpServletResponse) response;

racterEncoding("UTF-8");

tentType("application/json; charset=utf-8");

tus(_UNAUTHORIZED);

ObjectMapper mapper = new ObjectMapper();

resultMsg = new ResultMsg(D_code(), D_msg(), null);

ter().write(alueAsString(resultMsg));

return;

}

@Override

public void destroy() {

// TODO Auto-generated method stub

}

}

7、在⼊⼝处注册filterpackage ;

import ist;

import ;

import Application;

import BootApplication;

import RegistrationBean;

import ConfigurationProperties;

import ;

import sicAuthorizeAttribute;

import arerAuthorizeAttribute;

import ce;

@SpringBootApplication

@EnableConfigurationProperties()

public class SpringRestApplication {

public static void main(String[] args) {

(, args);

}

@Bean

public FilterRegistrationBean basicFilterRegistrationBean() {

FilterRegistrationBean registrationBean = new FilterRegistrationBean();

HTTPBasicAuthorizeAttribute httpBasicFilter = new HTTPBasicAuthorizeAttribute();

ter(httpBasicFilter);

List urlPatterns = new ArrayList();

("/user/getuser");

Patterns(urlPatterns);

return registrationBean;

}

@Bean

public FilterRegistrationBean jwtFilterRegistrationBean(){

FilterRegistrationBean registrationBean = new FilterRegistrationBean();

HTTPBearerAuthorizeAttribute httpBearerFilter = new HTTPBearerAuthorizeAttribute();

ter(httpBearerFilter);

List urlPatterns = new ArrayList();

("/user/getusers");

Patterns(urlPatterns);

return registrationBean;

}

}

8、添加获取md5的⽅法类MyUtilspackage ;

import eDigest;

public class MyUtils {

public static String getMD5(String inStr) {

MessageDigest md5 = null;

try {

md5 = tance("MD5");

} catch (Exception e) {

tackTrace();

return "";

}

char[] charArray = Array();

byte[] byteArray = new byte[];

for (int i = 0; i < ; i++)

byteArray[i] = (byte) charArray[i];

byte[] md5Bytes = (byteArray);

StringBuffer hexValue = new StringBuffer();

for (int i = 0; i < ; i++) {

int val = ((int) md5Bytes[i]) & 0xff;

if (val < 16)

("0"); (tring(val));

}

return ng();

}

}

9、在返回信息类中补充添加错误码INVALID_CLIENTID(30003, "Invalid clientid"),

INVALID_PASSWORD(30004, "User name or password is incorrect"),

INVALID_CAPTCHA(30005, "Invalid captcha or captcha overdue"),

INVALID_TOKEN(30006, "Invalid token");

10、代码中涉及的Audience类，在上⼀篇⽂章中定义，本⽂不再重复说明11、代码整体结构

12、测试1） 获取token，传⼊⽤户认证信息认证通过返回token信息2） 使⽤上⾯获取的token进⾏接⼝调⽤未使⽤token，获取token错误，或者token过期时使⽤正确的token时以上就是本⽂的全部内容，希望对⼤家的学习有所帮助，也希望⼤家多多⽀持。