Token插件：Auto0和jsonwebtoken对比

Auto0工具类

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTCreator;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.auth0.jwt.interfaces.JWTVerifier;
import org.springframework.beans.factory.annotation.Value;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

/**
 * @author: lizz
 * @date: 2020/1/20 09:58
 */
public class Auth0Util {
    /**
     * 引入apollo的配置
     */
    private static String TOKEN_KEY = "54f12048-1f56-45c1-a3f1-2c546bc2bb42";
    /**
     * jwt有效时间
     */
    private static long TOKEN_TIMEOUT = 10* 60 * 1000;

    /**
     * jwt生成方
     */
    private final static String JWT_ISSUER = "lb-fw-gw";

    /**
     * 生成jwt
     *
     * @param header
     * @return
     */
    public static String create(Map header) {
        return create(header, new HashMap<>(0), JWT_ISSUER, TOKEN_TIMEOUT);
    }

    public static String create(Map header, Map claims) {
        return create(header, claims, JWT_ISSUER, TOKEN_TIMEOUT);
    }

    public static String create(Map header, long timeout) {
        return create(header, new HashMap<>(0), JWT_ISSUER, timeout);
    }

    /**
     * 生成jwt
     *
     * @param header
     * @param issuer
     * @return
     */
    public static String create(Map header, Map claims, String issuer, long timeout) {
        String token;
        try {
            Algorithm algorithm = Algorithm.HMAC256(TOKEN_KEY);
            Date date = new Date(System.currentTimeMillis() + timeout);
            JWTCreator.Builder builder = JWT.create()
                    .withHeader(header)
                    .withIssuer(issuer)
                    .withExpiresAt(date);
            for (String key : claims.keySet()) {
                builder.withClaim(key, claims.get(key));
            }
            token = builder.sign(algorithm);
        } catch (JWTVerificationException exception) {
            System.out.println(exception.getMessage());
            return null;
        }
        return token;
    }

    /**
     * 验证jwt
     *
     * @param token
     * @return
     */
    public static DecodedJWT decode(String token) {
        DecodedJWT jwt;
        try {
            Algorithm algorithm = Algorithm.HMAC256(TOKEN_KEY);
            JWTVerifier verifier = JWT.require(algorithm)
//                    .withIssuer(JWT_ISSUER)
//                    .acceptLeeway(1)
//                    .acceptExpiresAt(1)
//                    .acceptIssuedAt(1)
//                    .acceptNotBefore(1)
                    .build();
            jwt = verifier.verify(token);
        } catch (JWTVerificationException exception) {
            System.out.println(exception.getMessage());
            return null;
        }
        return jwt;
    }
}

单测

import org.junit.jupiter.api.Test;

import java.util.HashMap;
import java.util.Map;

class Auth0UtilTest {

    /**
     * jwt创建测试结果
     * 次数 : 3批耗时ms
     * 1000 : 1502 1673 1513
     * 10000 : 2353 2319 2311
     * 100000 : 5681 5604 5452
     */
    @Test
    void create() {
        Map header = new HashMap<>(4);
        header.put("auth", "level1");
        Map claims = new HashMap<>(4);
        claims.put("user", "xxxs");
        long btime = System.currentTimeMillis();
        int times = 100000;
        for (int i = 1; i <= times; i++) {
            Auth0Util.create(header);
        }
        System.out.println(System.currentTimeMillis() - btime);
    }

    /**
     * jwt校验测试结果
     * 次数 : 3批耗时ms
     * 1000 : 898 927 939
     * 10000 : 1973 1992 1882
     * 100000 : 4402 4562 4649
     */
    @Test
    void decode() {
        Map header = new HashMap<>(4);
        header.put("auth", "level1");
        Map claims = new HashMap<>(4);
        claims.put("user", "xxxs");
        String token = Auth0Util.create(header); //创建一个新的token
        System.out.println("token：" + token);
        int times = 100000; //循环次数
        long btime = System.currentTimeMillis();
        for (int i = 1; i <= times; i++) {
            Auth0Util.decode(token);
        }
        System.out.println(System.currentTimeMillis() - btime);
    }
}

 

jsonwebtoken工具类

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;

import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.security.Key;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

/**
 * @description: jsonwebtoken工具类
 * @author: lizz
 * @date: 2020/2/25 4:18 下午
 */
public class JsonWebTokenUtil {
    /**
     * jwt密钥 必须大于32个字符
     */
    private static String TOKEN_KEY = "54f12048-1f56-45c1-a3f1-2c546bc2bb42";
    /**
     * jwt有效时间
     */
    private static long TOKEN_TIMEOUT = 60 * 30 * 1000;

    /**
     * jwt生成方
     */
    private final static String JWT_ISSUER = "lb-fw-gw";

    /**
     * 生成jwt
     *
     * @param header
     * @return
     */
    public static String create(Map header) {
        return create(header, new HashMap<>(2), JWT_ISSUER, TOKEN_TIMEOUT);
    }

    public static String create(Map header, Map claims) {
        return create(header, claims, JWT_ISSUER, TOKEN_TIMEOUT);
    }

    public static String create(Map header, long timeout) {
        return create(header, new HashMap<>(2), JWT_ISSUER, timeout);
    }

    public static String create(Map header, Map claims, long timeout) {
        return create(header, claims, JWT_ISSUER, timeout);
    }

    /**
     * 生成jwt
     *
     * @param header
     * @return
     */
    public static String create(Map header, Map claims, String issuer, long timeout) {
        String token;
        try {
            Date date = new Date(System.currentTimeMillis() + timeout);
            SecretKey key = Keys.hmacShaKeyFor(TOKEN_KEY.getBytes());
            token = Jwts.builder()
                    .setHeader(header)
                    .setClaims(claims)
                    .setIssuer(issuer)
                    .setExpiration(date)
                    .signWith(key, SignatureAlgorithm.HS256)
                    .compact();
        } catch (JwtException exception) {
            System.out.println(exception.getMessage());
            return null;
        }
        return token;
    }

    /**
     * 验证jwt
     *
     * @param token
     * @return
     */
    public static Jws decode(String token) {
        Jws claimsJws;
        try {
            Key key = new SecretKeySpec(TOKEN_KEY.getBytes(), SignatureAlgorithm.HS256.getJcaName());
            claimsJws = Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token);
        } catch (JwtException exception) {
            System.out.println(exception.getMessage());
            return null;
        }
        return claimsJws;
    }
}

单测

import org.junit.jupiter.api.Test;

import java.util.HashMap;
import java.util.Map;
class JsonWebTokenUtilTest {

    /**
     * jwt创建测试结果
     * 次数 : 3批耗时ms
     * 1000 : 2037 1850 2052
     * 10000 : 4874 4833 4908
     * 100000 : 18598 17841 17942
     */
    @Test
    void create() {
        HashMap header = new HashMap<>(4);
        header.put("auth", "level1");
        Map claims = new HashMap<>(4);
        claims.put("user", "xxxs");
        long btime = System.currentTimeMillis();
        int times = 100000;
        for (int i = 1; i <= times; i++) {
            JsonWebTokenUtil.create(header,claims);
        }
        System.out.println(System.currentTimeMillis() - btime);
    }

    /**
     * jwt校验测试结果
     * 次数 : 3批耗时ms
     * 1000 : 2128 1980 1933
     * 10000 : 9763 10073 9494
     * 100000 : 47531 48893 48845
     */
    @Test
    void decode() {
        HashMap header = new HashMap<>(4);
        header.put("auth", "level1");
        Map claims = new HashMap<>(4);
        claims.put("user", "xxxs");
        String token = JsonWebTokenUtil.create(header,claims); //创建一个新的token
        int times = 100000;
        long btime = System.currentTimeMillis();
        for (int i = 1; i <= times; i++) {
            JsonWebTokenUtil.decode(token);
        }
        System.out.println(System.currentTimeMillis() - btime);
    }
}

 

测试数据

取3次中位数。

操作	decode		create
次数	auth0	jsonweboken	auth0	jsonwebtoken
1,000	1665 ms	2842 ms	2306	2398 ms
10,000	2951 ms	9755 ms	3952	5246 ms
100,000	5786ms	38859 ms	11784	16191 ms

结论

• 性能方面auth0更优。
• 功能方面jsonwebtoken支持更高级的应用，如高级加密算法等。