Spring Security+jwt使用總結

（1）導入依賴（jwt）

<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>

（2）token工具類

@Slf4j
@Component
@Data
@ConfigurationProperties(prefix = "blog.jwt")
public class JWTUtils {
    private long expire;
    private String secure;
    private String header;

    //生成jwt
    public String createToken(String username){
        Date nowTime = new Date();
        Date expireTime = new Date(nowTime.getTime() + 1000 * expire);
        return Jwts.builder()
                //token類型
                .setHeaderParam("typ","JWT")
                .setSubject(username)
                .setIssuedAt(nowTime)
                .setExpiration(expireTime)
                .signWith(SignatureAlgorithm.HS512,secure)
                .compact();
    }

    //解析jwt
    public Claims getClaimsByToken(String jwt){
        try {
            return Jwts.parser()
                    .setSigningKey(secure)
                    .parseClaimsJws(jwt)
                    .getBody();
        } catch (Exception e) {
            return null;
        }
    }
	/**
     * 判斷是否token過期
     * @param claims
     * @return
     */
    public boolean isTokenExpired(Claims claims){
        return claims.getExpiration().before(new Date());
    }
}

（3）登陸成功時，添加token到header

//創建token
String token = jwtUtils.createToken(authentication.getName());
//將token放在請求頭中，前端獲取
httpServletResponse.setHeader(jwtUtils.getHeader(),token);

（4）關閉session

.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
;

（5）實現過濾器JWTFilter extends BasicAuthenticationFilter

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
    //獲得請求中的token
    String jwt = request.getHeader(jwtUtils.getHeader());
    //token不存在，匿名訪問，放行
    if(jwt==null||jwt==""){
        chain.doFilter(request,response);
        return;
    }
    Claims claims = jwtUtils.getClaimsByToken(jwt);
    //獲取token信息
      if(claims==null){
            response.setContentType("application/json;charset=utf-8");
            response.getWriter().write(JSON.toJSONString(new Result(false, StatusConst.TOKEN_ERROR, "token異常！")));
            return;
        }
        if(jwtUtils.isTokenExpired(claims)){
            response.setContentType("application/json;charset=utf-8");
            response.getWriter().write(JSON.toJSONString(new Result(false, StatusConst.TOKEN_EXPIRED, "用戶身份過期，請重新登陸！")));
            return;
        }
    String username = claims.getSubject();
    //獲取用戶信息
    UserAuth userAuth = userAuthMapper.selectByUserName(username);
    if (userAuth == null) {
        throw new ServerException("用戶不存在！");
    }
    UserInfo userInfo = userInfoMapper.selectById(userAuth.getUserInfoId());
    List<String> roles = roleMapper.listRolesByUserInfoId(userInfo.getId());

    /**
     * ----------------------用戶的文章點贊和留言點贊集合------------------------
     */
    Set<Integer> articleLikeSet = (Set<Integer>) redisTemplate.boundHashOps(RedisPreFixConst.ARTICLE_USER_LIKE).get(userInfo.getId().toString());
    Set<Integer> commentLikeSet = (Set<Integer>) redisTemplate.boundHashOps(RedisPreFixConst.COMMENT_USER_LIKE).get(userInfo.getId().toString());
    UserInfoDTO userDetails = UserUtils.setUserDetails(userAuth, userInfo, roles, articleLikeSet, commentLikeSet, request);
    //綁定用戶和用戶角色信息
    UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
    SecurityContextHolder.getContext().setAuthentication(authenticationToken);
    chain.doFilter(request,response);
}

（6）添加過濾器

@Bean
public JWTFilter jwtFilter() throws Exception {
    return new JWTFilter(authenticationManager());
}

.addFilter(jwtFilter())

（7）登出時，返回登出響應碼，讓前端刪除token