spring boot 配置攔截器驗證使用 token 登錄

1、自定義登錄注解

package io.xiongdi.annotation; import java.lang.annotation.*; /** * @author wujiaxing * @date 2019-07-12 * 登錄校驗 */ @Target(ElementType.METHOD) @Documented @Retention(RetentionPolicy.RUNTIME) public @interface Login { }

 

2、創建 token 實體類

package io.xiongdi.entity; import com.baomidou.mybatisplus.annotation.IdType; import com.baomidou.mybatisplus.annotation.TableId; import com.baomidou.mybatisplus.annotation.TableName; import lombok.Builder; import lombok.Data; import java.io.Serializable; import java.time.LocalDateTime; /** * 用戶token * @author wujiaxing * @date ${2019-6-30} */ @Data @TableName("tb_token") @Builder public class TokenEntity implements Serializable { private static final long serialVersionUID = 5584132314624077161L; public TokenEntity(){} public TokenEntity(long userId, String token, LocalDateTime expireTime, LocalDateTime updateTime) { this.userId = userId; this.token = token; this.expireTime = expireTime; this.updateTime = updateTime; } /** * 用戶ID */ @TableId(type = IdType.INPUT) private long userId; /** * token */
    private String token; /** * 過期時間 */
    private LocalDateTime expireTime; /** * 修改時間 */
    private LocalDateTime updateTime; }

 

3、創建處理 token 的接口方法

package io.xiongdi.service; import com.baomidou.mybatisplus.extension.service.IService; import io.xiongdi.entity.TokenEntity; /** * token * @author wujiaxing * @date 2019-06-30 */
public interface TokenService extends IService<TokenEntity> { /** * <p> * 根據請求token查詢token信息 * </p> * @param token * @return
     */ TokenEntity queryByToken(String token); /** * 創建token * @param userId 用戶ID * @return 返回token信息 */ TokenEntity createToken(long userId); /** * 設置token過期 * @param userId 用戶ID */
    void expireToken(long userId); }

package io.xiongdi.service.impl; import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper; import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl; import io.xiongdi.dao.TokenDao; import io.xiongdi.entity.TokenEntity; import io.xiongdi.service.TokenService; import org.springframework.stereotype.Service; import java.time.LocalDateTime; import java.time.ZoneId; import java.time.ZoneOffset; import java.util.Date; import java.util.UUID; /** * @author wujiaxing * @date 2019-07-08 */ @Service("tokenService") public class TokenServiceImpl extends ServiceImpl<TokenDao, TokenEntity> implements TokenService { /** * 12 小時過期 單位：毫秒 */
    private final static int EXPIRE = 3600 * 12 * 1000; /** * 根據請求頭的token查詢數據庫對應的token信息 * @param token * @return
     */ @Override public TokenEntity queryByToken(String token) { return this.getOne(new QueryWrapper<TokenEntity>().eq("token", token)); } @Override public TokenEntity createToken(long userId) { // 得到當前時間
        LocalDateTime now = LocalDateTime.now(); // 根據過期時間加上當前時間，得到token的有效期
        long indate = LocalDateTime.now().toInstant(ZoneOffset.of("+8")).toEpochMilli() + EXPIRE; LocalDateTime tokenExpireDateTime = LocalDateTime.ofInstant(new Date(indate).toInstant(), ZoneId.systemDefault()); // 生成token
        String token = generateToken(); // 創建實體對象
        TokenEntity tokenEntity = TokenEntity.builder().expireTime(tokenExpireDateTime).userId(userId).token(token).updateTime(now).build(); // 放入數據庫保存
        this.saveOrUpdate(tokenEntity); return tokenEntity; } /** * 生成token * @return
     */
    private String generateToken() { return UUID.randomUUID().toString().replace("-", ""); } @Override public void expireToken(long userId) { // 獲取當前時間
        LocalDateTime now = LocalDateTime.now(); TokenEntity tokenEntity = TokenEntity.builder().userId(userId).expireTime(now).updateTime(now).build(); this.saveOrUpdate(tokenEntity); } }

 

4、創建攔截器

package io.xiongdi.interceptor; import io.xiongdi.annotation.Login; import io.xiongdi.common.exception.XDException; import io.xiongdi.common.utils.ResultType; import io.xiongdi.entity.TokenEntity; import io.xiongdi.service.TokenService; import org.apache.commons.lang.StringUtils; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Component; import org.springframework.web.method.HandlerMethod; import org.springframework.web.servlet.HandlerInterceptor; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.time.LocalDateTime; /** * 權限（token）驗證 * @author wujiaxing * @date 2019-06-30 */ @Component public class AuthorizationInterceptor implements HandlerInterceptor { @Autowired private TokenService tokenService; public final static String USER_KEY = "userId"; @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { Login annotation; // 如果處理對象是一個處理方法，則獲取到方法上的注解
        if (handler instanceof HandlerMethod) { annotation = ((HandlerMethod)handler).getMethodAnnotation(Login.class); // 否則直接放過攔截的請求
        } else { return true; } // 說明此方法沒有Login注解
        if (annotation == null) { return true; } // 從請求頭獲取token
        String token = request.getHeader("token"); // 如果請求頭沒有token,則從請求參數中取
        if (StringUtils.isBlank(token)) { token = request.getParameter("token"); } // 如果還是沒有token,則拋異常
        if (StringUtils.isBlank(token)) { throw new XDException(ResultType.TOKEN_NULL); } // 查詢token信息
        TokenEntity tokenEntity = tokenService.queryByToken(token); // 如果token信息是否為null或是否過期，則拋異常
        if (tokenEntity == null || tokenEntity.getExpireTime().isBefore(LocalDateTime.now())) { throw new XDException(ResultType.TOKEN_EXPIRE); } // 否則，存入request作用域,后續根據userId，獲取用戶信息
 request.setAttribute(USER_KEY, tokenEntity.getUserId()); return true; } }

 

5、將攔截器配置給 spring boot

package io.xiongdi.config; import io.xiongdi.interceptor.AuthorizationInterceptor; import io.xiongdi.resolver.LoginUserHandlerMethodArgumentResolver; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.web.method.support.HandlerMethodArgumentResolver; import org.springframework.web.servlet.config.annotation.CorsRegistry; import org.springframework.web.servlet.config.annotation.InterceptorRegistry; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import java.util.List; /** * @author wujiaxing * <p> * 此配置類可配置攔截器、參數解析器、返回值解析器、跨域支持等等 * </p> */ @Configuration public class WebMvcConfig implements WebMvcConfigurer { @Autowired private AuthorizationInterceptor authorizationInterceptor; @Autowired private LoginUserHandlerMethodArgumentResolver loginUserHandlerMethodArgumentResolver; /** * 攔截器配置 * @param registry */ @Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(authorizationInterceptor).addPathPatterns("/api/**"); } /** * 跨域支持配置 * @param registry */ @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping("/**").allowCredentials(true).allowedOrigins("*").allowedMethods("GET", "PUT", "DELETE", "POST", "OPTIONS").maxAge(3600); } /** * 參數解析配置 * @param resolvers */ @Override public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) { resolvers.add(loginUserHandlerMethodArgumentResolver); } }

 

6、配置已經好了，可以開始測試