使用JWT實現Token認證

為什么使用JWT？
隨着技術的發展，分布式web應用的普及，通過session管理用戶登錄狀態成本越來越高，因此慢慢發展成為token的方式做登錄身份校驗，然后通過token去取redis中的緩存的用戶信息，隨着之后jwt的出現，校驗方式更加簡單便捷化，無需通過redis緩存，而是直接根據token取出保存的用戶信息，以及對token可用性校驗，單點登錄更為簡單。

JWT架構圖

JWT架構圖.png

使用JWT核心代碼：
maven依賴：

        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.2.0</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.7.0</version>
        </dependency>

JWT工具類：
用於生成Token，和Token驗證

public class JwtUtils {
    /** * 簽發JWT * @param id * @param subject 可以是JSON數據 盡可能少 * @param ttlMillis * @return String * */
    public static String createJWT(String id, String subject, long ttlMillis) {
        SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
        long nowMillis = System.currentTimeMillis();
        Date now = new Date(nowMillis);
        SecretKey secretKey = generalKey();
        JwtBuilder builder = Jwts.builder()
                .setId(id)
                .setSubject(subject)   // 主題
                .setIssuer("user")     // 簽發者
                .setIssuedAt(now)      // 簽發時間
                .signWith(signatureAlgorithm, secretKey); // 簽名算法以及密匙
        if (ttlMillis >= 0) {
            long expMillis = nowMillis + ttlMillis;
            Date expDate = new Date(expMillis);
            builder.setExpiration(expDate); // 過期時間
        }
        return builder.compact();
    }
    /** * 驗證JWT * @param jwtStr * @return */
    public static CheckResult validateJWT(String jwtStr) {
        CheckResult checkResult = new CheckResult();
        Claims claims = null;
        try {
            claims = parseJWT(jwtStr);
            checkResult.setSuccess(true);
            checkResult.setClaims(claims);
        } catch (ExpiredJwtException e) {
            checkResult.setErrCode(SystemConstant.JWT_ERRCODE_EXPIRE);
            checkResult.setSuccess(false);
        } catch (SignatureException e) {
            checkResult.setErrCode(SystemConstant.JWT_ERRCODE_FAIL);
            checkResult.setSuccess(false);
        } catch (Exception e) {
            checkResult.setErrCode(SystemConstant.JWT_ERRCODE_FAIL);
            checkResult.setSuccess(false);
        }
        return checkResult;
    }
    public static SecretKey generalKey() {
        byte[] encodedKey = Base64.decode(SystemConstant.JWT_SECERT);
        SecretKey key = new SecretKeySpec(encodedKey, 0, encodedKey.length, "AES");
        return key;
    }
<span class="hljs-comment">/**
 * 
 * 解析JWT字符串
 * <span class="hljs-doctag">@param</span> jwt
 * <span class="hljs-doctag">@return</span>
 * <span class="hljs-doctag">@throws</span> Exception
 */</span>
<span class="hljs-function"><span class="hljs-keyword">public</span> <span class="hljs-keyword">static</span> Claims <span class="hljs-title">parseJWT</span><span class="hljs-params">(String jwt)</span> <span class="hljs-keyword">throws</span> Exception </span>{
    SecretKey secretKey = generalKey();
    <span class="hljs-keyword">return</span> Jwts.parser()
        .setSigningKey(secretKey)
        .parseClaimsJws(jwt)
        .getBody();
}

}
 

如何使用？
代碼實例：

public class LoginController {
    @Autowired
    UserRepository userRepository;
<span class="hljs-meta">@ApiOperation</span>(value=<span class="hljs-string">"用戶登陸"</span>)
<span class="hljs-meta">@RequestMapping</span>(value=<span class="hljs-string">"login"</span>,method = RequestMethod.POST)
<span class="hljs-function"><span class="hljs-keyword">public</span> ReturnVo <span class="hljs-title">login</span><span class="hljs-params">(String username, String password,HttpServletResponse
        response)</span> </span>{
    User user =  userRepository.findByUsername(username);
    <span class="hljs-keyword">if</span>(user!=<span class="hljs-keyword">null</span>){
        <span class="hljs-keyword">if</span>(user.getPassword().equals(password)){
            <span class="hljs-comment">//把token返回給客戶端--&gt;客戶端保存至cookie--&gt;客戶端每次請求附帶cookie參數</span>
            String JWT = JwtUtils.createJWT(<span class="hljs-string">"1"</span>, username, SystemConstant.JWT_TTL);
            <span class="hljs-keyword">return</span> ReturnVo.ok(JWT);
        }<span class="hljs-keyword">else</span>{
            <span class="hljs-keyword">return</span> ReturnVo.error();
        }
    }<span class="hljs-keyword">else</span>{
        <span class="hljs-keyword">return</span> ReturnVo.error();
    }
}
<span class="hljs-meta">@ApiOperation</span>(value=<span class="hljs-string">"獲取用戶信息"</span>)
<span class="hljs-meta">@RequestMapping</span>(value=<span class="hljs-string">"description"</span>,method = RequestMethod.POST)
<span class="hljs-function"><span class="hljs-keyword">public</span> ReturnVo <span class="hljs-title">description</span><span class="hljs-params">(String username)</span> </span>{
    User user =  userRepository.findByUsername(username);
    <span class="hljs-keyword">return</span> ReturnVo.ok(user.getDescription());
}

}
 

      </div>