使用多页面的springboot2 web应用,一般用什么方式使用jwt作为token进行安全验证

Question

想咨询一下
由于之前的页面存在多个页面,更新页面后,存储在页面上的信息会消失.
但是也不想使用基于session的权限安全验证

想使用多页面的springboot2 web应用,一般用什么方式使用jwt作为token进行安全验证

有没有相关例子或教程可以参考一下

Answer 1

我之前写的一个小玩意，代码不一定好看，参考代码https://github.com/mitu2/webm...

用的是Spring Security, 思路是这样的登陆成功后给前端发一个JWT生成的加密串，然后让前端发送请求的时候都加上TOKEN_HEADER 请求头，通过JWTTokenFilter拿到加密后JwtUtils.getUsername(token)拿到用户名， 如果正确就给SecurityContextHolder.getContext() set一个UsernamePasswordAuthenticationToken， 不过后面我又改成了Spring Security 的形式

public class JWTTokenFilter extends BasicAuthenticationFilter {

    private static final Logger log = LoggerFactory.getLogger(JWTTokenFilter.class);

    /**
     * Token请求头名称
     */
    public static final String TOKEN_HEADER = "Authorization";
    /**
     * Token前缀
     */
    public static final String TOKEN_PREFIX = "Bearer";

    /**
     * WebSocket
     */
    public static final String SOCKET_HEADER = "token";

    private final UserDetailsService userService;

    public JWTTokenFilter(AuthenticationManager authenticationManager, UserDetailsService userService) {
        super(authenticationManager);
        this.userService = userService;
    }


    @Override
    protected void doFilterInternal(@NotNull HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain filterChain) throws ServletException, IOException {
        final String token = getToken(request);
        //noinspection ConstantConditions
        do {
            if (token == null || isLogin()) {
                break;
            }
            final String username;
            try {
                username = JwtUtils.getUsername(token);
            } catch (Exception e) {
                if (log.isDebugEnabled()) {
                    log.debug(e.getMessage(), e);
                }
                break;
            }
            Optional.ofNullable(userService.loadUserByUsername(username))
                    .ifPresent(userDetails -> {
                        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, token, userDetails.getAuthorities());
                        authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
                        if (log.isDebugEnabled()) {
                            log.debug("用户{}校验成功!", username);
                        }
                    });

        } while (false);
        filterChain.doFilter(request, response);
    }

    private String getToken(HttpServletRequest request) {
        boolean isWebSocket = "websocket".equalsIgnoreCase(request.getHeader("Upgrade"));
        return isWebSocket ?
                request.getParameter(SOCKET_HEADER) :
                Optional.ofNullable(request.getHeader(TOKEN_HEADER))
                        .orElse("")
                        .replaceFirst(TOKEN_PREFIX, "")
                        .replace(" ", "");
    }

    private boolean isLogin() {
        final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return authentication != null && authentication.isAuthenticated();
    }

}

---

与答案无关: JWT就是一个加密工具，你用其他加密工具也可以无非就是换一种方式而已