SpringBoot2.0整合SpringSecurity实现WEB JWT认证

相信很多做技术的朋友都做过前后端分离项目，项目分离后认证就靠JWT，费话不多说，直接上干活(写的不好还请多多见谅，大牛请绕行)

直接上代码，项目为Maven项目，结构如图：

包分类如下：

com.api.config 相关配置类

com.api.ctrl controller层

com.api.entity 相关实体类

com.api.repo jpa仓库相关

com.api.serice service层相关

ApiApplication 为启动类

主要配置核心类如下：

JWTAuthenticationFilter

package com.api.config;

import com.api.entity.User;

import com.api.repo.UserRepo;

import io.jsonwebtoken.Jwts;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

import javax.servlet.FilterChain;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.util.ArrayList;

public class JWTAuthenticationFilter extends BasicAuthenticationFilter {

    private UserRepo userRepo;

    public JWTAuthenticationFilter(AuthenticationManager authenticationManager,UserRepo userRepo) {

        super(authenticationManager);

        this.userRepo = userRepo;

    }

    @Override

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {

        String header = request.getHeader("Authorization");

        //如果不包含Bearer则退出

        if(header != null && !header.startsWith("Bearer")){

            chain.doFilter(request,response);

            return;

        }

        UsernamePasswordAuthenticationToken authenticationToken = getAuthentication(request);

        SecurityContextHolder.getContext().setAuthentication(authenticationToken);

        chain.doFilter(request,response);

    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {

        String token = request.getHeader("Authorization");

        if (token != null) {

            // parse the token.

            String user = Jwts.parser()

                    .setSigningKey("HSMyJwtSecret".getBytes())

                    .parseClaimsJws(token.replace("Bearer ", ""))

                    .getBody()

                    .getSubject();

            if (user != null) {

                Integer userId = Integer.valueOf(user.split(":")[0]);

                User currUser = userRepo.findById(userId).orElse(null);

                if(currUser != null){

                    return new UsernamePasswordAuthenticationToken(currUser, null, new ArrayList<>());

                }

                return new UsernamePasswordAuthenticationToken(new User(), null, new ArrayList<>());

            }

        }

        return null;

    }

}

JWTLoginFilter

package com.api.config;

import com.api.entity.User;

import com.fasterxml.jackson.databind.ObjectMapper;

import io.jsonwebtoken.Jwts;

import io.jsonwebtoken.SignatureAlgorithm;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import javax.servlet.FilterChain;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.util.ArrayList;

import java.util.Date;

public class JWTLoginFilter extends UsernamePasswordAuthenticationFilter {

    private AuthenticationManager authenticationManager;

    public JWTLoginFilter(AuthenticationManager authenticationManager){

        this.authenticationManager = authenticationManager;

    }

    @Override

    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {

        try {

            User user = new ObjectMapper().readValue(request.getInputStream(), User.class);

            return authenticationManager.authenticate(

              new UsernamePasswordAuthenticationToken(

                      user.getUsername(),

                      user.getPassword(),

                      new ArrayList<>()

              )

            );

        }catch (Exception e){

            throw new RuntimeException(e);

        }

    }

    @Override

    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {

        String token = Jwts.builder()

                .setSubject(((JwtUser) authResult.getPrincipal()).getUsername())

                .setExpiration(new Date(System.currentTimeMillis() + 60 * 60 * 24 * 1000))

                .signWith(SignatureAlgorithm.HS256,"HSMyJwtSecret".getBytes())

                .compact();

        response.addHeader("Authorization", "Bearer " + token);

        response.getOutputStream().println(token);

    }

}

MyUserDetailService

package com.api.config;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.authentication.AuthenticationProvider;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.stereotype.Component;

import java.util.Collection;

@Component

public class MyAuthencationProvider implements AuthenticationProvider {

    @Autowired

    private MyUserDetailService myUserDetailService;

    @Override

    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        String username = authentication.getPrincipal().toString();

        JwtUser jwtUser = (JwtUser) myUserDetailService.loadUserByUsername(username);

        Collection<? extends GrantedAuthority> authorities = jwtUser.getAuthorities();

        return new UsernamePasswordAuthenticationToken(jwtUser, jwtUser.getPassword(), authorities);

    }

    @Override

    public boolean supports(Class<?> aClass) {

        return true;

    }

}

MyUserDetailService

package com.api.config;

import com.api.entity.User;

import com.api.repo.UserRepo;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Component;

@Component

public class MyUserDetailService implements UserDetailsService {

    @Autowired

    private UserRepo userRepo;

    @Override

    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {

        User user = userRepo.findFirstByUsername(s);

        if(user != null){

            JwtUser jwtUser = new JwtUser(String.format("%s:%s",String.valueOf(user.getId()),user.getUsername()),user.getPassword());

            return jwtUser;

        }

        throw new UsernameNotFoundException("用户名未找到");

    }

}

WebSecurityConfig

package com.api.config;

import com.api.repo.UserRepo;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Configuration;

import org.springframework.core.annotation.Order;

import org.springframework.http.HttpMethod;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

@Order(-1)

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired

    private MyAuthencationProvider myAuthencationProvider;

    @Autowired

    private UserRepo userRepo;

    @Override

    protected void configure(HttpSecurity http) throws Exception {

        http.cors().and().csrf().disable().authorizeRequests()

                .antMatchers(HttpMethod.POST, "/register").permitAll()

                .anyRequest().authenticated()

                .and()

                .addFilter(new JWTLoginFilter(authenticationManager()))

                .addFilter(new JWTAuthenticationFilter(authenticationManager(),userRepo));

    }

    @Override

    public void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.authenticationProvider(myAuthencationProvider);

    }

}

JwtUser

package com.api.config;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;

public class JwtUser implements UserDetails {

    private String username;

    private String password;

    public JwtUser(String username,String password){

        this.username = username;

        this.password = password;

    }

    @Override

    public Collection<? extends GrantedAuthority> getAuthorities() {

        return null;

    }

    @Override

    public String getPassword() {

        return password;

    }

    @Override

    public String getUsername() {

        return username;

    }

    @Override

    public boolean isAccountNonExpired() {

        return false;

    }

    @Override

    public boolean isAccountNonLocked() {

        return false;

    }

    @Override

    public boolean isCredentialsNonExpired() {

        return false;

    }

    @Override

    public boolean isEnabled() {

        return false;

    }

}

MyMvcConfigurer

package com.api.config;

import org.springframework.boot.autoconfigure.AutoConfigureBefore;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.access.SecurityConfig;

import org.springframework.web.servlet.config.annotation.CorsRegistry;

import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration

@AutoConfigureBefore(SecurityConfig.class)

public class MyMvcConfigurer implements WebMvcConfigurer {

    @Override

    public void addCorsMappings(CorsRegistry registry) {

        registry.addMapping("/**")

                .allowedOrigins("*")

                .allowedMethods("*")

                .allowedHeaders("*")

                .allowCredentials(true)

                .maxAge(3600);

    }

}

以上为config包下全部内容

项目POM.xml配置如下

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

	<modelVersion>4.0.0</modelVersion>

	<parent>

		<groupId>org.springframework.boot</groupId>

		<artifactId>spring-boot-starter-parent</artifactId>

		<version>2.1.0.RELEASE</version>

		<relativePath/> <!-- lookup parent from repository -->

	</parent>

	<groupId>com.api</groupId>

	<artifactId>api</artifactId>

	<version>0.0.1-SNAPSHOT</version>

	<name>api</name>

	<description>Demo project for Spring Boot</description>

	<properties>

		<java.version>1.8</java.version>

	</properties>

	<dependencies>

		<dependency>

			<groupId>org.springframework.boot</groupId>

			<artifactId>spring-boot-starter-data-redis</artifactId>

		</dependency>

		<dependency>

			<groupId>org.springframework.boot</groupId>

			<artifactId>spring-boot-starter-jdbc</artifactId>

		</dependency>

		<dependency>

			<groupId>org.springframework.boot</groupId>

			<artifactId>spring-boot-starter-data-jpa</artifactId>

		</dependency>

		<dependency>

			<groupId>org.springframework.boot</groupId>

			<artifactId>spring-boot-starter-security</artifactId>

		</dependency>

		<dependency>

			<groupId>org.springframework.boot</groupId>

			<artifactId>spring-boot-starter-web</artifactId>

		</dependency>

		<dependency>

			<groupId>mysql</groupId>

			<artifactId>mysql-connector-java</artifactId>

			<scope>runtime</scope>

		</dependency>

		<dependency>

			<groupId>org.projectlombok</groupId>

			<artifactId>lombok</artifactId>

			<optional>true</optional>

		</dependency>

		<dependency>

			<groupId>org.springframework.boot</groupId>

			<artifactId>spring-boot-starter-test</artifactId>

			<scope>test</scope>

		</dependency>

		<dependency>

			<groupId>com.github.wenhao</groupId>

			<artifactId>jpa-spec</artifactId>

			<version>3.2.3</version>

		</dependency>

		<dependency>

			<groupId>cn.hutool</groupId>

			<artifactId>hutool-all</artifactId>

			<version>4.3.1</version>

		</dependency>

		<dependency>

			<groupId>io.jsonwebtoken</groupId>

			<artifactId>jjwt</artifactId>

			<version>0.7.0</version>

		</dependency>

	</dependencies>

	<build>

		<plugins>

			<plugin>

				<groupId>org.apache.maven.plugins</groupId>

				<artifactId>maven-compiler-plugin</artifactId>

				<version>3.5.1</version>

				<configuration>

					<compilerArgs>

						<arg>-verbose</arg>

						<arg>-Xlint:all,-options,-path</arg>

					</compilerArgs>

					<source>1.8</source>

					<target>1.8</target>

				</configuration>

			</plugin>

			<plugin>

				<groupId>org.springframework.boot</groupId>

				<artifactId>spring-boot-maven-plugin</artifactId>

			</plugin>

			<plugin>

				<artifactId>maven-jar-plugin</artifactId>

				<configuration>

					<archive>

						<manifest>

							<addClasspath>true</addClasspath>

							<classpathPrefix>lib/</classpathPrefix>

							<mainClass>com.api.ApiApplication</mainClass>

						</manifest>

					</archive>

				</configuration>

			</plugin>

			<plugin>

				<groupId>org.apache.maven.plugins</groupId>

				<artifactId>maven-resources-plugin</artifactId>

				<configuration>

					<delimiters>

						<delimiter>@</delimiter>

						<delimiter>#{*}</delimiter>

						<delimiter>#</delimiter>

					</delimiters>

				</configuration>

			</plugin>

		</plugins>

	</build>

	<repositories>

		<repository>

			<id>spring-snapshots</id>

			<name>Spring Snapshots</name>

			<url>https://repo.spring.io/snapshot</url>

			<snapshots>

				<enabled>true</enabled>

			</snapshots>

		</repository>

		<repository>

			<id>spring-milestones</id>

			<name>Spring Milestones</name>

			<url>https://repo.spring.io/milestone</url>

		</repository>

	</repositories>

	<pluginRepositories>

		<pluginRepository>

			<id>spring-snapshots</id>

			<name>Spring Snapshots</name>

			<url>https://repo.spring.io/snapshot</url>

			<snapshots>

				<enabled>true</enabled>

			</snapshots>

		</pluginRepository>

		<pluginRepository>

			<id>spring-milestones</id>

			<name>Spring Milestones</name>

			<url>https://repo.spring.io/milestone</url>

		</pluginRepository>

	</pluginRepositories>

</project>

以下为其他包结构以及类文件

以上配置成功后即可以POST方式访问

http://localhost:8080/login?username=xxx&password=xx 认证成功后会在返回jwt，下次请求认证的资源在header里边带上Authorization Bearer xxxxxx

即可。

SpringBoot2.0整合SpringSecurity实现WEB JWT认证的更多相关文章

SpringBoot2.0 整合 SpringSecurity 框架，实现用户权限安全管理
本文源码:GitHub·点这里 || GitEE·点这里一.Security简介 1.基础概念 Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方 ...
SpringBoot2.0整合SpringSecurity实现自定义表单登录
我们知道企业级权限框架一般有Shiro,Shiro虽然强大,但是却不属于Spring成员之一,接下来我们说说SpringSecurity这款强大的安全框架.费话不多说,直接上干货. pom文件引入以下 ...
springboot2.0整合springsecurity前后端分离进行自定义权限控制
在阅读本文之前可以先看看springsecurity的基本执行流程,下面我展示一些核心配置文件,后面给出完整的整合代码到git上面,有兴趣的小伙伴可以下载进行研究使用maven工程构建项目,首先需要 ...
SpringBoot2.0 整合 Swagger2 ,构建接口管理界面
一.Swagger2简介 1.Swagger2优点整合到Spring Boot中,构建强大RESTful API文档.省去接口文档管理工作,修改代码,自动更新,Swagger2也提供了强大的页面测试 ...
springboot2.0整合logback日志(详细)
<div class="post"> <h1 class="postTitle"> springboot2.0整合logback日志(详 ...
第二篇：SpringBoot2.0整合ActiveMQ
本篇开始将具体介绍SpringBoot如何整合其它项目. 如何创建SpringBoot项目访问https://start.spring.io/. 依次选择构建工具Maven Project.语言ja ...
SpringBoot2.0 整合 QuartJob ,实现定时器实时管理
一.QuartJob简介 1.一句话描述 Quartz是一个完全由java编写的开源作业调度框架,形式简易,功能强大. 2.核心API (1).Scheduler 代表一个 Quartz 的独立运行容 ...
SpringBoot2.0 整合 Dubbo框架 ,实现RPC服务远程调用
一.Dubbo框架简介 1.框架依赖图例说明: 1)图中小方块 Protocol, Cluster, Proxy, Service, Container, Registry, Monitor 代表层 ...
SpringBoot2.0 整合 Redis集群 ,实现消息队列场景
本文源码:GitHub·点这里 || GitEE·点这里一.Redis集群简介 1.RedisCluster概念 Redis的分布式解决方案,在3.0版本后推出的方案,有效地解决了Redis分布式的 ...

随机推荐

Many Equal Substrings CodeForces - 1029A (kmp next数组应用)
题目大意题目看样例也能猜到就是输出最短的循环串. 吐槽明明是div3第一题为啥子还会用到kmp的知识? 解法这个题仔细看发现是求最长可去除的后缀,也就是说去除跟下一个相同的字符串还能连接起来.这 ...
整理推荐比较好用的具有书签搜索功能的chrome插件
平时在整理学习chrome插件的过程中,经常会去试用各种大家推荐的插件.在去年我们的一篇文章:推荐六款好用的书签收藏夹剪藏型管理插件.这里面介绍的是收藏书签的插件.而随着我们使用chrome越来越频繁 ...
PYGAME学习笔记_01
01_使用PYGAME创建图形窗口 1.1_游戏的初始化和退出 pygame.init() 写入并初始化所有PYGAME模块,使用其他模块之前,必须先调用init方法 pygame.quit() 卸载 ...
洛谷 1984 [SDOI2008]烧水问题
[题解] 烧开每一杯水之后都用它去把其他没烧开的水焐热,这样显然是最优的.然后推推式子或者列表找规律就好了. #include<cstdio> #include<algorithm& ...
[bzoj3106][cqoi2013][棋盘游戏] (对抗搜索+博弈论)
Description 一个n*n(n>=2)棋盘上有黑白棋子各一枚.游戏者A和B轮流移动棋子,A先走. l A的移动规则:只能移动白棋子.可以往上下左右四个方向之一移动一格. ...
Unity常用常找（二）
本文章由cartzhang编写,转载请注明出处. 所有权利保留. 文章链接:http://blog.csdn.net/cartzhang/article/details/51315050 作者:car ...
java8 新特性 lambda过滤
1. 定义实体类 package com.atguigu.java8; public class Employee { private int id; private String name; pri ...
手写DAO框架（三）-数据库连接
-------前篇:手写DAO框架(二)-开发前的最后准备--------- 前言上一篇主要是温习了一下基础知识,然后将整个项目按照模块进行了划分.因为是个人项目,一个人开发,本人采用了自底向上的开 ...
Linux的基本配置
安装: vmvare .centos .SecureCRTPortable(免装版) 软件地址:http://pan.baidu.com/s/1eSBqegq 密码:p4ck 3.开始配置 1打开vm ...
LVS中文站点
http://blog.csdn.net/turkeyzhou/article/details/16980161 http://zh.linuxvirtualserver.org/

SpringBoot2.0整合SpringSecurity实现WEB JWT认证

SpringBoot2.0整合SpringSecurity实现WEB JWT认证的更多相关文章

随机推荐

热门专题