Spring Boot 如何集成JWT實(shí)現(xiàn)Token驗(yàn)證

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0aW1lU3RhbXAiOjE2MzkwNDc1NTMxNjksInVzZXJSb2xlIjoiUk9MRV9BRE1JTiIsInVzZXJJZCI6ImFkbWluIn0.UFQLvaiQ1AThx9Fa4SRqNg-b9HPJ9y1TlgQB4-F3pi0

<dependency>    <groupId>com.auth0groupId>    <artifactId>java-jwtartifactId>    <version>3.10.3version>dependency><dependency>    <groupId>org.springframework.bootgroupId>    <artifactId>spring-boot-starter-webartifactId>dependency>

@Componentpublic class TokenUtil {    @Value("${token.secretKey}")    private String secretKey;    /**     * 加密token.     */    public String getToken(String userId, String userRole) {        //這個(gè)是放到負(fù)載payLoad 里面,魔法值可以使用常量類進(jìn)行封裝.        String token = JWT                .create()                .withClaim("userId" ,userId)                .withClaim("userRole", userRole)                .withClaim("timeStamp", System.currentTimeMillis())                .sign(Algorithm.HMAC256(secretKey));        return token;    }    /**     * 解析token.     * {     * "userId": "weizhong",     * "userRole": "ROLE_ADMIN",     * "timeStamp": "134143214"     * }     */    public Map<String, String> parseToken(String token) {        HashMap<String, String> map = new HashMap<String, String>();        DecodedJWT decodedjwt = JWT.require(Algorithm.HMAC256(secretKey))                .build().verify(token);        Claim userId = decodedjwt.getClaim("userId");        Claim userRole = decodedjwt.getClaim("userRole");        Claim timeStamp = decodedjwt.getClaim("timeStamp");        map.put("userId", userId.asString());        map.put("userRole", userRole.asString());        map.put("timeStamp", timeStamp.asLong().toString());        return map;    }}

@Slf4j@Componentpublic class AuthHandlerInterceptor implements HandlerInterceptor {    @Autowired    TokenUtil tokenUtil;    @Value("${token.refreshTime}")    private Long refreshTime;    @Value("${token.expiresTime}")    private Long expiresTime;    /**     * 權(quán)限認(rèn)證的攔截操作.     */    @Override    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object object) throws Exception {        log.info("=======進(jìn)入攔截器========");        // 如果不是映射到方法直接通過,可以訪問資源.        if (!(object instanceof HandlerMethod)) {            return true;        }        //為空就返回錯(cuò)誤        String token = httpServletRequest.getHeader("token");        if (null == token || "".equals(token.trim())) {            return false;        }        log.info("==============token:" + token);        Map map = tokenUtil.parseToken(token);        String userId = map.get("userId");        String userRole = map.get("userRole");        long timeOfUse = System.currentTimeMillis() - Long.parseLong(map.get("timeStamp"));        //1.判斷 token 是否過期        if (timeOfUse < refreshTime) {            log.info("token驗(yàn)證成功");            return true;        }        //超過token刷新時(shí)間，刷新 token        else if (timeOfUse >= refreshTime && timeOfUse < expiresTime) {            httpServletResponse.setHeader("token",tokenUtil.getToken(userId,userRole));            log.info("token刷新成功");            return true;        }        //token過期就返回 token 無效.        else {            throw new TokenAuthExpiredException();        }    }}

@Configurationpublic class AuthWebMvcConfigurer implements WebMvcConfigurer {    @Autowired    AuthHandlerInterceptor authHandlerInterceptor;    /**     * 給除了 /login 的接口都配置攔截器,攔截轉(zhuǎn)向到 authHandlerInterceptor     */    @Override    public void addInterceptors(InterceptorRegistry registry) {        registry.addInterceptor(authHandlerInterceptor)                .addPathPatterns("/**")                .excludePathPatterns("/login");    }}

@RestControllerpublic class TokenTestController {    @Autowired    TokenUtil tokenUtil;    @PostMapping("/login")    public String login(@RequestBody LoginUser user){        // 先驗(yàn)證用戶的賬號(hào)密碼,賬號(hào)密碼驗(yàn)證通過之后，生成Token        String role = "ROLE_ADMIN";        String token = tokenUtil.getToken(user.username,role);        return token;    }    @PostMapping("/testToken")    public String testToken(HttpServletRequest request){        String token = request.getHeader("token");        tokenUtil.parseToken(token);        return "請(qǐng)求成功";    }}