JWT全面解读和详细使用步骤

目录

• 前言
• JWT的数据结构

• Header
• Payload
• Signature
• Base64URL

• Maven依赖
• JWT签名发布和验证代码
• 拦截器配置无需认证的请求
• Token统一拦截器代码
• 用户登录时验证用户信息后，返回Token信息

{
"alg": "HS256",
"typ": "JWT"
}

{
"sub": "1234567890",
"name": "John Doe",
"age": "19"
}

  HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

 <dependency>
		    <groupId>com.auth0</groupId>
		    <artifactId>java-jwt</artifactId>
		    <version>3.5.0</version>
</dependency>

public class TokenUtil {
	//Token的过期时间
	private static final long EXPIRE_TIME = 30 * 60 * 1000;
	//Token的私钥
	private static final String TOKEN_SECRET = "jytoken_secret";
	/**
	 * 生成签名，30分钟过期
	 * @param **userInfo**	用户信息 用户姓名
	* @param **other** 用户其他信息 用户id
	* @return
	 */
	public static String sign(String userInfo, String other) {
	    try {
	    	// 设置过期时间
	    	Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
	    	//私钥和加密算法
	        Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
	        // 设置头部信息
	        Map<String, Object> header = new HashMap<>(2);
	        header.put("Type", "Jwt");
	        header.put("alg", "HS256");
	        // 返回token字符串
	        return JWT.create()
	                .withHeader(header)
	                .withClaim("userInfo", userInfo)
	                .withClaim("other", other)
	                .withExpiresAt(date)
	                .sign(algorithm);
	    } catch (Exception e) {
	        e.printStackTrace();
	        return null;
	    }
	}
	/**
	 * 生成签名，30分钟过期
	 * @param **userInfo**	用户信息 用户姓名
	* @param **other** 用户其他信息 用户id
	* @return
	 */
	public static String sign(String userInfo, String other,long expire) {
	    try {
	    	// 设置过期时间
	    	Date date = new Date(System.currentTimeMillis() + expire);
	    	//私钥和加密算法
	        Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
	        // 设置头部信息
	        Map<String, Object> header = new HashMap<>(2);
	        header.put("Type", "Jwt");
	        header.put("alg", "HS256");
	        // 返回token字符串
	        return JWT.create()
	                .withHeader(header)
	                .withClaim("userInfo", userInfo)
	                .withClaim("other", other)
	                .withExpiresAt(date)
	                .sign(algorithm);
	    } catch (Exception e) {
	        e.printStackTrace();
	        return null;
	    }
	}
	/**
	 * 检验token是否正确
	 * @param **token**
	* @return
	 */
	public static boolean verify(String token){
	    try {
	        Algorithm algorithm = Algorithm.HMAC256(TOKEN_SECRET);
	        JWTVerifier verifier = JWT.require(algorithm).build();
	        verifier.verify(token);//未验证通过会抛出异常
	        return true;
	    } catch (Exception e){
	        return false;
	    }
	}
	/**
	 * 从token中获取info信息
	 * @param **token**
	* @return
	 */
	public static String getUserName(String token,String info){
	    try {
	        DecodedJWT jwt = JWT.decode(token);
	        return jwt.getClaim(info).asString();
	    } catch (JWTDecodeException e){
	        e.printStackTrace();
	    }
	    return null;
	}
}

@Configuration
public class InterceptorConfig extends WebMvcConfigurationSupport  {
	@Autowired
	private TokenHandler tokenHandler;
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        List<String> excludePath = new ArrayList<>();
        String checkLogin = "/pushlogin/checkIsCanLogin";
        String login = "/pushlogin/login";
        String getVerifyCode = "/common/send";
        String verfifyMethod = "/common/validationCode";
        excludePath.add(checkLogin);
        excludePath.add(login);
        excludePath.add(getVerifyCode);
        excludePath.add(verfifyMethod);
        registry.addInterceptor(tokenHandler).excludePathPatterns(excludePath);
    }
}

@Component
@Slf4j
public class TokenHandler implements HandlerInterceptor{
		@Override
	   public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)  throws Exception {
	        String token = request.getHeader("Authentication");
	        if (token != null){
	            boolean result = TokenUtil.verify(token);
	            if(result){
	                log.info("通过拦截器");
	                return true;
	            }
	        }
	        log.info("认证失败");
	        return false;
	   }
}

 	@Override
    public UserDTO selectIsExistUserInfo(String phone) {
        //TODO 伪代码 验证用户信息 
        UserDTO info = 查询用户信息
        if (info != null) {
            String token = TokenUtil.sign(info.getUsername(), info.getUserId(), 6 * 60 * 60 * 1000);
            info.setToken(token);
        }
        return info;
    }