SpringBoot整合Spring Security+JWT实现用户注册登录
最近在做一个自己的项目，前后端分离的项目，于是整合了一下Spring
Security和JWT来实现后端系统的用户登录，自己以前没有使用过Spring Security所以这次踩坑之后记录下来。
该文较长，请耐心阅读，需要整合这部分的可以给到你一些帮助。
一、整合JWT
1.1 pom包
<!-- jwt依赖 -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.6.0</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.10.5</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
1.2 设定jwt的配置信息
首先在配置文件中配置jwt需要的密钥、过期时间和头部信息
#配置token生成策略
config:
jwt:
secret: test1@Login(Auth}*^31)&heiMa% #这里可以自己定制
expire: 30 # 过期时间,单位分钟
header: testProject #随意定制
然后创建JwtProperties来接收配置文件中的jwt配置信息
@Configuration
@Data
@ConfigurationProperties(prefix = "config.jwt")
public class JwtProperties {
/**
*密钥
*/
public String secret;
/**
* 过期时间
*/
public int expire;
/**
* 名称
*/
public String header;
}
1.3 创建SecurityUser
新创建的SecurityUser继承UserDetails，另外重写UserDetails时要将return false改为return true
@Data
public class SecurityUser implements UserDetails {
private String username;
private String password;
private Collection<? extends GrantedAuthority> authorities;
public SecurityUser(String username, String password, Collection<? extends GrantedAuthority> authorities) {
this.username = username;
this.password = password;
this.authorities = authorities;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
1.4 创建jwt配置类JwtUtils
该配置类中指定了token生成策略
@Configuration
public class JwtUtils {
@Resource
private JwtProperties jwtProperties;
/**
* 生成token
* @param subject
* @return
*/
public String createToken (String subject){
Date nowDate = new Date();
//过期时间
Date expireDate = new Date(nowDate.getTime() + jwtProperties.expire * 1000);
return Jwts.builder()
.setHeaderParam("type", "JWT")
.setSubject(subject)
.setIssuedAt(nowDate)
.setExpiration(expireDate)
.signWith(SignatureAlgorithm.HS512, jwtProperties.secret)
.compact();
}
/**
* 获取token中注册信息
* @param token
* @return
*/
public Claims getTokenClaim (String token) {
try {
return Jwts.parser().setSigningKey(jwtProperties.secret).parseClaimsJws(token).getBody();
}catch (Exception e){
e.printStackTrace();
return null;
}
}
/**
* 验证令牌
*
* @param token 令牌
* @param userDetails 用户
* @return 是否有效
*/
public Boolean validateToken(String token, UserDetails userDetails) {
SecurityUser user = (SecurityUser) userDetails;
String username = getUsernameFromToken(token);
return (username.equals(user.getUsername()) && !isTokenExpired(token));
}
/**
* 从令牌中获取数据声明
*
* @param token 令牌
* @return 数据声明
*/
private Claims getClaimsFromToken(String token) {
Claims claims;
try {
claims = Jwts.parser().setSigningKey(jwtProperties.secret).parseClaimsJws(token).getBody();
} catch (Exception e) {
claims = null;
}
return claims;
}
/**
* 判断令牌是否过期
*
* @param token 令牌
* @return 是否过期
*/
public Boolean isTokenExpired(String token) {
try {
Claims claims = getClaimsFromToken(token);
Date expiration = claims.getExpiration();
return expiration.before(new Date());
} catch (Exception e) {
return true;
}
}
/**
* 验证token是否过期失效
* @param expirationTime
* @return
*/
public boolean isTokenExpired (Date expirationTime) {
return expirationTime.before(new Date());
}
/**
* 获取token失效时间
* @param token
* @return
*/
public Date getExpirationDateFromToken(String token) {
return getTokenClaim(token).getExpiration();
}
/**
* 获取用户名从token中
*/
public String getUsernameFromToken(String token) {
return getTokenClaim(token).getSubject();
}
/**
* 获取jwt发布时间
*/
public Date getIssuedAtDateFromToken(String token) {
return getTokenClaim(token).getIssuedAt();
}
}
以上就是整合JWT的操作，到这里也只是做好了token的生成策略，还没有实现注册登录，实现注册登录需要Spring Security。
二、整合Spring Security
2.1 跨域配置CorsConfig
我这里首先要配置拦截器InterceptorJWT继承HandlerInterceptorAdapter
我这里通过Redis实现了单点登录，所以调用了RedisUtils。
@Component
public class RedisUtils {
public static final String ACCESS_TOKEN = "TOKEN_GIFT_";//客户端请求服务器时携带的token参数
public static final String REFRESH_TOKEN = "REFRESH_GIFT_";//客户端用户刷新token的参数
public static final String PHONE_VALID_CODE = "PHONE_VALID_CODE_";//客户端短信验证码
@Resource
private RedisTemplate<String, String> redisTemplate;
/**
* @Description: 设置缓存，k-v形式
* @param key
* @param value
* @param timeout：单位：毫秒
* @author:
* @date:
*/
public void setValue(String key, String value, long timeout ){
redisTemplate.opsForValue().set(key, value, timeout , TimeUnit.MILLISECONDS);
}
/**
* @Description: 设置access_token的缓存
* @param userId
* @param value
* @param timeout
* @author:
* @date:
*/
public void setToken(Long userId, String value, long timeout){
setValue(ACCESS_TOKEN + userId, value, timeout);
}
/**
* @Description: 获取缓存，通过key获取value值
* @param key
* @return
* @author:
* @date:
*/
public String getValue(String key){
return redisTemplate.opsForValue().get(key);
}
/**
* @Description: 获取redis中的access_token信息
* @param userId
* @return
* @author:
* @date:
*/
public String getToken(Long userId){
return getValue(ACCESS_TOKEN + userId);
}
/**
* @Description: 删除缓存
* @param key
* @author:
* @date:
*/
public void delete(String key){
redisTemplate.delete(key);
}
}
/**
* 请求api服务器时，对accessToken进行拦截判断，有效则可以反问接口，否则返回错误
*
* @author
*/
@Component
public class InterceptorJWT extends HandlerInterceptorAdapter {
@Autowired
private RedisUtils redisUtils;
@Resource
private JwtUtils jwtUtils;
@Resource
private JwtProperties jwtProperties;
@Override
public boolean preHandle(HttpServletRequest request,
HttpServletResponse response, Object handler) {
// 若目标方法忽略了安全性检查，则直接调用目标方法
if (handler.getClass().isAssignableFrom(HandlerMethod.class)) {
//如果方法上有@IgnoreSecurity注解，则不需要进行token验证
IgnoreSecurity ignoreSecurity = ((HandlerMethod) handler).getMethodAnnotation(IgnoreSecurity.class);
if (ignoreSecurity != null) {
return true;
}
}else {
String token = request.getParameter(jwtProperties.header);
if (StringUtils.isNotEmpty(token)) {
Claims claims = jwtUtils.getTokenClaim(token);
Long userId = (Long) claims.get("userId");
String redisToken = redisUtils.getToken(userId);
token = request.getParameter(jwtProperties.header);
if (!redisToken.equals(token)) {
throw new SignatureException(jwtProperties.header + "失效，请重新登录。");
}
if (claims == null || jwtUtils.isTokenExpired(claims.getExpiration())) {
throw new SignatureException(jwtProperties.header + "失效，请重新登录。");
}
/** 设置 identityId 用户身份ID */
request.setAttribute("identityId", claims.getSubject());
}else {
throw new SignatureException(jwtProperties.header + "失效，请重新登录。");
}
}
return true;
}
@Override
public void postHandle(HttpServletRequest request,
HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
super.postHandle(request, response, handler, modelAndView);
}
@Override
public void afterCompletion(HttpServletRequest request,
HttpServletResponse response, Object handler, Exception ex)
throws Exception {
super.afterCompletion(request, response, handler, ex);
}
@Override
public void afterConcurrentHandlingStarted(HttpServletRequest request,
HttpServletResponse response, Object handler) throws Exception {
super.afterConcurrentHandlingStarted(request, response, handler);
}
}
然后创建跨域配置文件CorsConfig实现WebMvcConfigurer类
@Configuration
@EnableWebMvc
public class CorsConfig implements WebMvcConfigurer {
@Autowired
private InterceptorJWT interceptorJWT;
private CorsConfiguration config() {
CorsConfiguration corsConfiguration = new CorsConfiguration();
corsConfiguration.setAllowCredentials(true);
//设置你要允许的网站域名，如果全允许则设为 *
corsConfiguration.addAllowedOrigin("*");
//如果要限制 HEADER 或 METHOD 请自行更改
corsConfiguration.addAllowedHeader("*");
corsConfiguration.addAllowedMethod("*");
return corsConfiguration;
}
@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration( "/**", config() );
return new CorsFilter(source);
}
@Override
public void addInterceptors(InterceptorRegistry registry){
registry.addInterceptor(interceptorJWT)
.excludePathPatterns("/api/**")
.excludePathPatterns("/login/**")
.excludePathPatterns("/swagger-resources/**", "/webjars/**", "/v2/**", "/swagger-ui.html/**");;
}
@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
registry.addResourceHandler("swagger-ui.html")
.addResourceLocations("classpath:/META-INF/resources/");
registry.addResourceHandler("/webjars/**")
.addResourceLocations("classpath:/META-INF/resources/webjars/");
}
}
2.2 创建UserDetailsServiceImpl
创建UserDetailsServiceImpl实现UserDetailsService，其中的逻辑自己去设定实现
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
@Autowired
private SysUserService userService;
@Autowired
private SysUserRoleService sysUserRoleService;
@Autowired
private SysRoleService sysRoleService;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
Collection<GrantedAuthority> authorities = new ArrayList<>();
// 从数据库中取出用户信息
SysUser user = userService.findByUserName(username);
// 判断用户是否存在
if(user == null) {
throw new UsernameNotFoundException("用户名不存在");
}
// 添加权限
List<SysUserRole> userRoles = sysUserRoleService.listByUserId(user.getId());
for (SysUserRole userRole : userRoles) {
SysRole role = sysRoleService.get(userRole.getRoleId());
authorities.add(new SimpleGrantedAuthority(role.getName()));
}
// 返回UserDetails实现类
return new SecurityUser(user.getUsername(), user.getPassword(), authorities);
}
}
2.3 创建验证登录过滤器AuthenticationFilter
创建AuthenticationFilter继承UsernamePasswordAuthenticationFilter
/**
* 验证用户名密码正确后，生成一个token，并将token返回给客户端
* 该类继承自UsernamePasswordAuthenticationFilter，重写了其中的2个方法 ,
* attemptAuthentication：接收并解析用户凭证。
* successfulAuthentication：用户成功登录后，这个方法会被调用，我们在这个方法里生成token并返回。
* @author admin
*/
public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {
@Resource
private JwtUtils jwtUtils;
private AuthenticationManager authenticationManager;
public AuthenticationFilter(AuthenticationManager authenticationManager,JwtUtils jwtUtils) {
this.authenticationManager = authenticationManager;
this.jwtUtils = jwtUtils;
super.setFilterProcessesUrl("/login");
}
@Override
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
// 从输入流中获取到登录的信息
try {
SysUser loginUser = new ObjectMapper().readValue(request.getInputStream(), SysUser.class);
return authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(loginUser.getUsername(), loginUser.getPassword())
);
} catch (IOException e) {
e.printStackTrace();
return null;
}
}
// 成功验证后调用的方法
// 如果验证成功，就生成token并返回
@Override
protected void successfulAuthentication(HttpServletRequest request,
HttpServletResponse response,
FilterChain chain,
Authentication authResult){
SecurityUser jwtUser = (SecurityUser) authResult.getPrincipal();
System.out.println("jwtUser:" + jwtUser.toString());
String token = jwtUtils.createToken(jwtUser.getUsername());
// 返回创建成功的token
// 但是这里创建的token只是单纯的token
// 按照jwt的规定，最后请求的时候应该是 `Bearer token`
response.setCharacterEncoding("UTF-8");
response.setContentType("application/json; charset=utf-8");
response.setHeader("token",token);
ResponseUtils.out(response,Result.ok("登录成功",token));
}
@Override
protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
response.getWriter().write("authentication failed, reason: " + failed.getMessage());
}
}
创建权限过滤器AuthentizationFilter
创建AuthentizationFilter继承BasicAuthenticationFilter
public class AuthentizationFilter extends BasicAuthenticationFilter {
@Resource
private UserDetailsService userDetailsService;
@Resource
private JwtUtils jwtTokenUtil;
@Resource
private JwtProperties jwtProperties;
public AuthentizationFilter(AuthenticationManager authenticationManager,JwtUtils jwtUtils,JwtProperties jwtProperties) {
super(authenticationManager);
this.jwtTokenUtil = jwtUtils;
this.jwtProperties = jwtProperties;
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
String token = request.getHeader(jwtProperties.getHeader());
if (!StringUtils.isEmpty(token)) {
String username = jwtTokenUtil.getUsernameFromToken(token);
if (username != null && SecurityContextHolder.getContext().getAuthentication() == null){
UserDetails userDetails = userDetailsService.loadUserByUsername(username);
if (jwtTokenUtil.validateToken(token, userDetails)){
// 将用户信息存入 authentication，方便后续校验
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
// 将 authentication 存入 ThreadLocal，方便后续获取用户信息
SecurityContextHolder.getContext().setAuthentication(authentication);
}
}
}
chain.doFilter(request, response);
}
}
2.5 最后创建Spring Security配置类SecurityConfig
创建SecurityConfig继承WebSecurityConfigurerAdapter
/**
* Security 核心配置类
*
*/
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Resource
private UserDetailsService userDetailsService;
@Resource
private JwtUtils jwtUtils;
@Resource
private JwtProperties jwtProperties;
@Bean
public BCryptPasswordEncoder bCryptPasswordEncoder(){
return new BCryptPasswordEncoder();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable()
.authorizeRequests()
//跨域预检请求
.antMatchers(HttpMethod.OPTIONS,"/**").permitAll()
//登录URL
.antMatchers("/swagger**/**").permitAll()
.antMatchers("/webjars/**").permitAll()
.antMatchers("/v2/**").permitAll()
//其它身份需要认证
.anyRequest().permitAll()
.and()
.addFilter(new AuthenticationFilter(authenticationManager(),jwtUtils))
.addFilter(new AuthentizationFilter(authenticationManager(),jwtUtils,jwtProperties))
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
//退出登录器
http.logout().logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler());
}
@Bean
@Override
public AuthenticationManager authenticationManager()throws Exception{
return super.authenticationManager();
}
}
三、测试
到这里就完成了JWT+SpringSecurity的配置，接下来就要实现注册登录。
@RestController
@Api(value = "LoginController", tags = {"LoginController"}, description = "登录")
public class LoginController extends BaseController {
@Autowired
private SysUserService sysUserService;
@Autowired
private BCryptPasswordEncoder bCryptPasswordEncoder;
@PostMapping("/register")
public String registerUser(String name,String password){
SysUser user = new SysUser();
user.setUsername(name);
user.setPassword(bCryptPasswordEncoder.encode(password));
sysUserService.insert(user);
return "success";
}
}
以上的代码时注册的逻辑，因为Spring Security自带了登录接口，可以在AuthenticationFilter中配置
另外我的配置文件中配置了请求路径的设定，所以我的登录路径为localhost:8001/api/login，注册接口为localhost:8001/api/register
效果
登录效果如下：
如果需要该例子的话可以私聊我，我暂时还没放到GitHub，后续发布到GitHub会放到该处。