使用多页面的springboot2 web应用,一般用什么方式使用jwt作为token进行安全验证

Z时代
2024-03-01
分类：IT

想咨询一下
由于之前的页面存在多个页面,更新页面后,存储在页面上的信息会消失.
但是也不想使用基于session的权限安全验证

想使用多页面的springboot2 web应用,一般用什么方式使用jwt作为token进行安全验证

有没有相关例子或教程可以参考一下

回答：

我之前写的一个小玩意，代码不一定好看，参考代码https://github.com/mitu2/webm...

用的是Spring Security, 思路是这样的登陆成功后给前端发一个JWT生成的加密串，然后让前端发送请求的时候都加上TOKEN_HEADER 请求头，通过JWTTokenFilter拿到加密后JwtUtils.getUsername(token)拿到用户名，如果正确就给SecurityContextHolder.getContext() set一个UsernamePasswordAuthenticationToken，不过后面我又改成了Spring Security 的形式

public class JWTTokenFilter extends BasicAuthenticationFilter {
    private static final Logger log = LoggerFactory.getLogger(JWTTokenFilter.class);
    /**
     * Token请求头名称
     */
    public static final String TOKEN_HEADER = "Authorization";
    /**
     * Token前缀
     */
    public static final String TOKEN_PREFIX = "Bearer";
    /**
     * WebSocket
     */
    public static final String SOCKET_HEADER = "token";
    private final UserDetailsService userService;
    public JWTTokenFilter(AuthenticationManager authenticationManager, UserDetailsService userService) {
        super(authenticationManager);
        this.userService = userService;
    }
    @Override
    protected void doFilterInternal(@NotNull HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain filterChain) throws ServletException, IOException {
        final String token = getToken(request);
        //noinspection ConstantConditions
        do {
            if (token == null || isLogin()) {
                break;
            }
            final String username;
            try {
                username = JwtUtils.getUsername(token);
            } catch (Exception e) {
                if (log.isDebugEnabled()) {
                    log.debug(e.getMessage(), e);
                }
                break;
            }
            Optional.ofNullable(userService.loadUserByUsername(username))
                    .ifPresent(userDetails -> {
                        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(userDetails, token, userDetails.getAuthorities());
                        authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
                        if (log.isDebugEnabled()) {
                            log.debug("用户{}校验成功!", username);
                        }
                    });
        } while (false);
        filterChain.doFilter(request, response);
    }
    private String getToken(HttpServletRequest request) {
        boolean isWebSocket = "websocket".equalsIgnoreCase(request.getHeader("Upgrade"));
        return isWebSocket ?
                request.getParameter(SOCKET_HEADER) :
                Optional.ofNullable(request.getHeader(TOKEN_HEADER))
                        .orElse("")
                        .replaceFirst(TOKEN_PREFIX, "")
                        .replace(" ", "");
    }
    private boolean isLogin() {
        final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return authentication != null && authentication.isAuthenticated();
    }}