springboot实现token验证
时间: 2023-04-26 12:06:24 浏览: 82
Spring Boot可以使用JWT(JSON Web Token)实现Token验证。JWT是一种基于JSON的开放标准,用于在各方之间安全地传输信息。它由三部分组成:头部、载荷和签名。
在Spring Boot中,可以使用Spring Security和jjwt库来实现JWT Token验证。首先需要添加依赖:
```
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
```
然后在Spring Security的配置类中添加JWT Token验证的配置:
```
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
@Autowired
private JwtRequestFilter jwtRequestFilter;
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
// configure AuthenticationManagerBuilder
}
@Bean
public PasswordEncoder passwordEncoder() {
return NoOpPasswordEncoder.getInstance();
}
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity.csrf().disable()
.authorizeRequests().antMatchers("/authenticate").permitAll().
anyRequest().authenticated().and().
exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
}
}
```
其中,JwtAuthenticationEntryPoint是一个自定义的认证入口,用于处理未经授权的请求;JwtRequestFilter是一个自定义的过滤器,用于从请求中提取JWT Token并进行验证。
最后,需要实现一个JwtTokenUtil类,用于生成和验证JWT Token:
```
@Component
public class JwtTokenUtil {
private String secret = "mySecret";
public String generateToken(UserDetails userDetails) {
Map<String, Object> claims = new HashMap<>();
return doGenerateToken(claims, userDetails.getUsername());
}
private String doGenerateToken(Map<String, Object> claims, String subject) {
long expirationTime = 1000 * 60 * 60 * 10; // 10 hours
Date now = new Date();
Date expirationDate = new Date(now.getTime() + expirationTime);
return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(now)
.setExpiration(expirationDate).signWith(SignatureAlgorithm.HS512, secret).compact();
}
public boolean validateToken(String token, UserDetails userDetails) {
final String username = getUsernameFromToken(token);
return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
}
private boolean isTokenExpired(String token) {
final Date expiration = getExpirationDateFromToken(token);
return expiration.before(new Date());
}
private Date getExpirationDateFromToken(String token) {
return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody().getExpiration();
}
private String getUsernameFromToken(String token) {
return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody().getSubject();
}
}
```
这个类中,generateToken方法用于生成JWT Token,validateToken方法用于验证JWT Token是否有效。在生成JWT Token时,需要设置过期时间和签名算法。在验证JWT Token时,需要验证签名和过期时间。
这样就可以使用Spring Boot实现JWT Token验证了。