SpringBoot2-Jwt

1.官网

jwt.io/libraries

2.选jose4j

    pom

   org.bitbucket.b_c
   jose4j
   0.9.4

3.创建jwt工具

public class JwtUtil {

    private static  String secret = "e0e775bfcad04ecc94807b028dfca4d5";// "12345678123456781234567812345678"; // 注意密钥长短（最少32个字符）
    private static String Issuer = "QiXiao";
    private static String Audience = "WangPeng";

    public static String CreateToken(UserEntity user)  {

        try {
            JsonWebSignature jws = new JsonWebSignature();

            //Claim
            JwtClaims claims = new JwtClaims();
            claims.setIssuer(Issuer);  // who creates the token and signs it
            claims.setAudience(Audience); // to whom the token is intended to be sent
            claims.setExpirationTimeMinutesInTheFuture(10); // 过期时间
            claims.setGeneratedJwtId();                     // 为 JWT 设置一个自动生成的唯一 ID
            claims.setIssuedAtToNow();                      // 设置 Token 发布/创建 时间为当前时间
            claims.setNotBeforeMinutesInThePast(2);         // 设置生效时间为 2 分钟前
            claims.setSubject("Bearer"); // the subject/principal is whom the token is about
            claims.setClaim("UserSN", user.getSN());
            claims.setClaim("email","[email protected]"); // additional claims/attributes about the subject can be added

            jws.setPayload(claims.toJson());

            //Header
            jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.HMAC_SHA256);
            jws.setHeader("typ", "JWT");

            //签名
            Key hmacKey = CreateKey();
            jws.setKey(hmacKey);
            jws.setDoKeyValidation(false);

            String jwt = jws.getCompactSerialization();
            System.out.println(jwt);
            return jwt;
        }
        catch (JoseException ex)
        {
            throw new RuntimeException(ex.getMessage());
        }

    }

    private static Key CreateKey()
    {
        Key hmacKey = new HmacKey(secret.getBytes());
        return hmacKey;
    }

    public static JwtClaims ValidateToken(String jwt) throws MalformedClaimException {

        String message = "";
        Key key = CreateKey();
        JwtClaims jwtClaims = new JwtClaims();

        // 验证令牌
        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                .setAllowedClockSkewInSeconds(30)
                .setRequireExpirationTime()     // 必须设置过期时间
                .setRequireSubject()            // 必须设置 Subject
                .setExpectedIssuer(Issuer)    // 必须设置 Token 签发者
                .setExpectedAudience(Audience)// 必须设置 Token 签发给谁
                .setVerificationKey(key)    // 设置用于验证签名的公钥
                // 设置允许的预期签名算法
                .setJwsAlgorithmConstraints(
                        AlgorithmConstraints.ConstraintType.WHITELIST, AlgorithmIdentifiers.HMAC_SHA256)
                .build();

        try {
            jwtClaims = jwtConsumer.processToClaims(jwt);
        }
        catch(InvalidJwtException e)
        {
            jwtClaims = new JwtClaims();
            message = handleException(e);
            jwtClaims.setClaim("error", message);
        }

        return jwtClaims;
    }

    private static String handleException(InvalidJwtException e){
        String message = "";

        try {
            JwtClaims jwtClaims = e.getJwtContext().getJwtClaims();

            List errorDetails = e.getErrorDetails();

            // 异常是否因 JWT 过期触发
            if (e.hasExpired())
            {
                message = "token已经过期, 过期时间在" + jwtClaims.getExpirationTime();
            }

            // 异常是否因 Audience 无效触发
            if(e.hasErrorCode(ErrorCodes.AUDIENCE_INVALID))
            {
                message = "无效audience:" + jwtClaims.getAudience();
            }

            // 异常是否因缺少 Audience 触发
            if (e.hasErrorCode(ErrorCodes.AUDIENCE_MISSING)) {
                message = "Audience丢失";
            }

            // 异常是否因缺少过期时间触发
            if (e.hasErrorCode(ErrorCodes.EXPIRATION_MISSING)) {
                message = "缺少过期时间";
            }


            // 异常是否因过期时间太长触发
            if (e.hasErrorCode(ErrorCodes.EXPIRATION_TOO_FAR_IN_FUTURE)) {
                message = "过期时间太";
            }
            // 异常是否因缺乏完整性触发
            if (e.hasErrorCode(ErrorCodes.INTEGRITY_MISSING)) {
                message = "缺乏完整性";
            }
            // 异常是否因发布时间无效触发
            if (e.hasErrorCode(ErrorCodes.ISSUED_AT_INVALID_FUTURE) || e.hasErrorCode(ErrorCodes.ISSUED_AT_INVALID_PAST)) {
                message = "发布时间无效:" + jwtClaims.getIssuedAt();
            }

            // 异常是否因缺少发布时间触发
            if (e.hasErrorCode(ErrorCodes.ISSUED_AT_MISSING)) {
                message = "缺少发布时间:";
            }
            // 异常是否因签发者无效触发
            if (e.hasErrorCode(ErrorCodes.ISSUER_INVALID)) {
                message = "签发者无效:" + jwtClaims.getIssuer();
            }
            // 异常是否因缺少签发者触发
            if (e.hasErrorCode(ErrorCodes.ISSUER_MISSING)) {
                message = "缺少签发者";
            }
            // 异常是否因 JSON 无效触发
            if (e.hasErrorCode(ErrorCodes.JSON_INVALID)) {
                message = "JSON 无效";
            }
            // 异常是否因缺少 JWT ID 触发
            if (e.hasErrorCode(ErrorCodes.JWT_ID_MISSING)) {
                message = "缺少 JWT ID";
            }
            // 异常是否因 JwtClaims 格式错误触发
            if (e.hasErrorCode(ErrorCodes.MALFORMED_CLAIM)) {
                message = "JwtClaims 格式错误";
            }
            // 异常是否因缺少生效时间触发
            if (e.hasErrorCode(ErrorCodes.NOT_BEFORE_MISSING)) {
                message = "缺少生效时间";
            }
            // 异常是否因 Token 尚未生效触发
            if (e.hasErrorCode(ErrorCodes.NOT_YET_VALID)) {
                message = "Token 尚未生效";
            }
            // 异常是否因 Token 的 Signature 部分无效触发
            if (e.hasErrorCode(ErrorCodes.SIGNATURE_INVALID)) {
                message = "Token 的 Signature 部分无效";
            }
            // 异常是否因 Token 的 Signature 部分缺失触发
            if (e.hasErrorCode(ErrorCodes.SIGNATURE_MISSING)) {
                message = "Token 的 Signature 部分缺失";
            }
            // 异常是否因 Subject 无效触发
            if (e.hasErrorCode(ErrorCodes.SUBJECT_INVALID)) {
                message = "Subject 无效";
            }
            // 异常是否因 Subject 缺失触发
            if (e.hasErrorCode(ErrorCodes.SUBJECT_MISSING)) {
                message = "Subject 缺失";
            }
            // 异常是否因 Type 无效触发
            if (e.hasErrorCode(ErrorCodes.TYPE_INVALID)) {
                message = "Type 无效";
            }
            // 异常是否因 Type 缺失触发
            if (e.hasErrorCode(ErrorCodes.TYPE_MISSING)) {
                message = "Type 缺失";
            }

            if(message == "")
            {
                message = e.getMessage();
            }
        }
        catch (MalformedClaimException e1) {
            message = e.getMessage();
        }

        return message;
    }
}

4.CreateToken方法在登录时用

5.验证token的方法ValidateToken在拦截器用

public class JwtHandlerInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

        boolean bOK = HandlerInterceptor.super.preHandle(request, response, handler);

        String header = request.getHeader("Authorization");

        // 请求头不为空进行解析
        if (StringUtils.isNotBlank(header) && header.startsWith("Bearer ")) {

            // 得到令牌
            String jwt = header.substring(7);
            JwtClaims jwtClaims = JwtUtil.ValidateToken(jwt);

            Object msg = jwtClaims.getClaimValue("error");
            if(msg != null)
            {
                response.setContentType("text/html;charset=UTF-8");
                response.getWriter().write((String) msg);
            }
            else
            {
                Map map = new HashMap<>();
                map.put("UserSN", jwtClaims.getClaimValue("UserSN"));
                request.setAttribute("UserInfo", map);
            }

            return msg == null;

        }
        return false;
    }


    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        HandlerInterceptor.super.postHandle(request, response, handler, modelAndView);
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        HandlerInterceptor.super.afterCompletion(request, response, handler, ex);
    }
}

6.获取UserSN

Controller里要用到token的UserSN,通过RequestContextHolder可以获取,创建WebUtil

import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import javax.servlet.http.HttpServletRequest;
import java.util.Map;
 
public class WebUtil {

    private static HttpServletRequest request;

    static
    {
        if(request == null)
        {
            request =  ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();
        }
    }

    public static long getUserSN()
    {
        Object attribute = request.getAttribute("UserInfo");
        if(attribute != null && attribute instanceof Map)
        {
            Map map =   (Map)attribute;

            return (long) map.get("UserSN");
        }
        return 0;
    }
}

7.