首頁>網絡編程教程>Java教程

Spring Security結合JWT的方法教程

作者：Eve Cole 更新時間：2025-08-28 00:00:03

概述

眾所周知使用JWT 做權限驗證，相比Session 的優點是，Session 需要佔用大量服務器內存，並且在多服務器時就會涉及到共享Session 問題，在手機等移動端訪問時比較麻煩

而JWT 無需存儲在服務器，不佔用服務器資源（也就是無狀態的），用戶在登錄後拿到Token 後，訪問需要權限的請求時附上Token（一般設置在Http請求頭），JWT 不存在多服務器共享的問題，也沒有手機移動端訪問問題，若為了提高安全，可將Token 與用戶的IP 地址綁定起來

前端流程

用戶通過AJAX 進行登錄得到一個Token

之後訪問需要權限請求時附上Token 進行訪問

<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>Title</title> <script src="http://apps.bdimg.com/libs/jquery/2.1.4/jquery.min.js"></script> <script type="application/javascript"> var header = ""; function login() { $.post("http://localhost:8080/auth/login", { username: $("#username").val(), password: $("#password").val() }, function (data) { console.log(data); header = data; }) } function toUserPageBtn() { $.ajax({ type: "get", url: "http://localhost:8080/userpage", beforeSend: function (request) { request.setRequestHeader("Authorization", header); }, success: function (data) { console.log(data); } }); } </script></head><body> <fieldset> <legend>Please Login</legend> <label>UserName</label><input type="text" id="username"> <label>Password</label><input type="text" id="password"> <input type="button" onclick="login()" value="Login"> </fieldset> <button id="toUserPageBtn" onclick="toUserPageBtn()">訪問UserPage</button></body></html>

後端流程（Spring Boot + Spring Security + JJWT）

思路：

  • 創建用戶、權限實體類與數據傳輸對象
  • 編寫Dao 層接口，用於獲取用戶信息
  • 實現UserDetails（Security 支持的用戶實體對象，包含權限信息）
  • 實現UserDetailsSevice（從數據庫中獲取用戶信息，並包裝成UserDetails）
  • 編寫JWTToken 生成工具，用於生成、驗證、解析Token
  • 配置Security，配置請求處理與設置UserDetails 獲取方式為自定義的UserDetailsSevice
  • 編寫LoginController，接收用戶登錄名密碼並進行驗證，若驗證成功返回Token 給用戶
  • 編寫過濾器，若用戶請求頭或參數中包含Token 則解析，並生成Authentication，綁定到SecurityContext ，供Security 使用
  • 用戶訪問了需要權限的頁面，卻沒附上正確的Token，在過濾器處理時則沒有生成Authentication，也就不存在訪問權限，則無法訪問，否之訪問成功

編寫用戶實體類，並插入一條數據

User（用戶）實體類

@Data@Entitypublic class User { @Id @GeneratedValue private int id; private String name; private String password; @ManyToMany(cascade = {CascadeType.REFRESH}, fetch = FetchType.EAGER) @JoinTable(name = "user_role", joinColumns = {@JoinColumn(name = "uid", referencedColumnName = "id")}, inverseJoinColumns = {@JoinColumn(name = "rid", referencedColumnName = "id")}) private List<Role> roles;}

Role（權限）實體類

@Data@Entitypublic class Role { @Id @GeneratedValue private int id; private String name; @ManyToMany(mappedBy = "roles") private List<User> users;}

插入數據

User 表

id name password
1 linyuan 123

Role 表

id name
1 USER

User_ROLE 表

uid rid
1 1

Dao 層接口，通過用戶名獲取數據，返回值為Java8 的Optional 對象

public interface UserRepository extends Repository<User,Integer> { Optional<User> findByName(String name);}

編寫LoginDTO，用於與前端之間數據傳輸

@Datapublic class LoginDTO implements Serializable { @NotBlank(message = "用戶名不能為空") private String username; @NotBlank(message = "密碼不能為空") private String password;}

編寫Token 生成工具，利用JJWT 庫創建，一共三個方法：生成Token（返回String）、解析Token（返回Authentication認證對象）、驗證Token（返回布爾值）

 @Componentpublic class JWTTokenUtils { private final Logger log = LoggerFactory.getLogger(JWTTokenUtils.class); private static final String AUTHORITIES_KEY = "auth"; private String secretKey; //簽名密鑰private long tokenValidityInMilliseconds; //失效日期private long tokenValidityInMillisecondsForRememberMe; //（記住我）失效日期@PostConstruct public void init() { this.secretKey = "Linyuanmima"; int secondIn1day = 1000 * 60 * 60 * 24; this.tokenValidityInMilliseconds = secondIn1day * 2L; this.tokenValidityInMillisecondsForRememberMe = secondIn1day * 7L; } private final static long EXPIRATIONTIME = 432_000_000; //創建Token public String createToken(Authentication authentication, Boolean rememberMe){ String authorities = authentication.getAuthorities().stream() //獲取用戶的權限字符串，如USER,ADMIN .map(GrantedAuthority::getAuthority) .collect(Collectors.joining(",")); long now = (new Date()).getTime(); //獲取當前時間戳Date validity; //存放過期時間if (rememberMe){ validity = new Date(now + this.tokenValidityInMilliseconds); }else { validity = new Date(now + this.tokenValidityInMillisecondsForRememberMe); } return Jwts.builder() //創建Token令牌.setSubject(authentication.getName()) //設置面向用戶.claim(AUTHORITIES_KEY,authorities) //添加權限屬性.setExpiration(validity) //設置失效時間.signWith(SignatureAlgorithm.HS512,secretKey) //生成簽名.compact(); } //獲取用戶權限public Authentication getAuthentication(String token){ System.out.println("token:"+token); Claims claims = Jwts.parser() //解析Token的payload .setSigningKey(secretKey) .parseClaimsJws(token) .getBody(); Collection<? extends GrantedAuthority> authorities = Arrays.stream(claims.get(AUTHORITIES_KEY).toString().split(",")) //獲取用戶權限字符串.map(SimpleGrantedAuthority::new) .collect(Collectors.toList()); //將元素轉換為GrantedAuthority接口集合User principal = new User(claims.getSubject(), "", authorities); return new UsernamePasswordAuthenticationToken(principal, "", authorities); } //驗證Token是否正確public boolean validateToken(String token){ try { Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token); //通過密鑰驗證Token return true; }catch (SignatureException e) { //簽名異常log.info("Invalid JWT signature."); log.trace("Invalid JWT signature trace: {}", e); } catch (MalformedJwtException e) { //JWT格式錯誤log.info("Invalid JWT token."); log.trace("Invalid JWT token trace: {}", e); } catch (ExpiredJwtException e) { //JWT過期log.info("Expired JWT token."); log.trace("Expired JWT token trace: {}", e); } catch (UnsupportedJwtException e) { //不支持該JWT log.info("Unsupported JWT token."); log.trace("Unsupported JWT token trace: {}", e); } catch (IllegalArgumentException e) { //參數錯誤異常log.info("JWT token compact of handler are invalid."); log.trace("JWT token compact of handler are invalid trace: {}", e); } return false; }}

實現UserDetails 接口，代表用戶實體類，在我們的User 對像上在進行包裝，包含了權限等性質，可以供Spring Security 使用

public class MyUserDetails implements UserDetails{ private User user; public MyUserDetails(User user) { this.user = user; } @Override public Collection<? extends GrantedAuthority> getAuthorities() { List<Role> roles = user.getRoles(); List<GrantedAuthority> authorities = new ArrayList<>(); StringBuilder sb = new StringBuilder(); if (roles.size()>=1){ for (Role role : roles){ authorities.add(new SimpleGrantedAuthority(role.getName())); } return authorities; } return AuthorityUtils.commaSeparatedStringToAuthorityList(""); } @Override public String getPassword() { return user.getPassword(); } @Override public String getUsername() { return user.getName(); } @Override public boolean isAccountNonExpired() { return true; } @Override public boolean isAccountNonLocked() { return true; } @Override public boolean isCredentialsNonExpired() { return true; } @Override public boolean isEnabled() { return true; }}

實現UserDetailsService 接口，該接口僅有一個方法，用來獲取UserDetails，我們可以從數據庫中獲取User 對象，然後將其包裝成UserDetails 並返回

@Servicepublic class MyUserDetailsService implements UserDetailsService { @Autowired UserRepository userRepository; @Override public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException { //從數據庫中加載用戶對象Optional<User> user = userRepository.findByName(s); //調試用，如果值存在則輸出下用戶名與密碼user.ifPresent((value)->System.out.println("用戶名:"+value.getName()+" 用戶密碼："+value.getPassword())); //若值不再則返回null return new MyUserDetails(user.orElse(null)); }}

編寫過濾器，用戶如果攜帶Token 則獲取Token，並根據Token 生成Authentication 認證對象，並存放到SecurityContext 中，供Spring Security 進行權限控制

public class JwtAuthenticationTokenFilter extends GenericFilterBean { private final Logger log = LoggerFactory.getLogger(JwtAuthenticationTokenFilter.class); @Autowired private JWTTokenUtils tokenProvider; @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { System.out.println("JwtAuthenticationTokenFilter"); try { HttpServletRequest httpReq = (HttpServletRequest) servletRequest; String jwt = resolveToken(httpReq); if (StringUtils.hasText(jwt) && this.tokenProvider.validateToken(jwt)) { //驗證JWT是否正確Authentication authentication = this.tokenProvider.getAuthentication(jwt); //獲取用戶認證信息SecurityContextHolder.getContext().setAuthentication(authentication); //將用戶保存到SecurityContext } filterChain.doFilter(servletRequest, servletResponse); }catch (ExpiredJwtException e){ //JWT失效log.info("Security exception for user {} - {}", e.getClaims().getSubject(), e.getMessage()); log.trace("Security exception trace: {}", e); ((HttpServletResponse) servletResponse).setStatus(HttpServletResponse.SC_UNAUTHORIZED); } } private String resolveToken(HttpServletRequest request){ String bearerToken = request.getHeader(WebSecurityConfig.AUTHORIZATION_HEADER); //從HTTP頭部獲取TOKEN if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")){ return bearerToken.substring(7, bearerToken.length()); //返回Token字符串，去除Bearer } String jwt = request.getParameter(WebSecurityConfig.AUTHORIZATION_TOKEN); //從請求參數中獲取TOKEN if (StringUtils.hasText(jwt)) { return jwt; } return null; }}

編寫LoginController，用戶通過用戶名、密碼訪問/auth/login，通過LoginDTO 對象接收，創建一個Authentication 對象，代碼中為UsernamePasswordAuthenticationToken，判斷對像是否存在，通過AuthenticationManager 的authenticate 方法對認證對象進行驗證，AuthenticationManager 的實現類ProviderManager 會通過AuthentionProvider（認證處理） 進行驗證，默認ProviderManager 調用DaoAuthenticationProvider 進行認證處理，DaoAuthenticationProvider 中會通過UserDetailsService（認證信息來源） 獲取UserDetails ，若認證成功則返回一個包含權限的Authention，然後通過SecurityContextHolder.getContext().setAuthentication() 設置到SecurityContext 中，根據Authentication 生成Token，並返回給用戶

@RestControllerpublic class LoginController { @Autowired private UserRepository userRepository; @Autowired private AuthenticationManager authenticationManager; @Autowired private JWTTokenUtils jwtTokenUtils; @RequestMapping(value = "/auth/login",method = RequestMethod.POST) public String login(@Valid LoginDTO loginDTO, HttpServletResponse httpResponse) throws Exception{ //通過用戶名和密碼創建一個Authentication 認證對象，實現類為UsernamePasswordAuthenticationToken UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginDTO.getUsername(),loginDTO.getPassword()); //如果認證對像不為空if (Objects.nonNull(authenticationToken)){ userRepository.findByName(authenticationToken.getPrincipal().toString()) .orElseThrow(()->new Exception("用戶不存在")); } try { //通過AuthenticationManager（默認實現為ProviderManager）的authenticate方法驗證Authentication 對象Authentication authentication = authenticationManager.authenticate(authenticationToken); //將Authentication 綁定到SecurityContext SecurityContextHolder.getContext().setAuthentication(authentication); //生成Token String token = jwtTokenUtils.createToken(authentication,false); //將Token寫入到Http頭部httpResponse.addHeader(WebSecurityConfig.AUTHORIZATION_HEADER,"Bearer "+token); return "Bearer "+token; }catch (BadCredentialsException authentication){ throw new Exception("密碼錯誤"); } }}

編寫Security 配置類，繼承WebSecurityConfigurerAdapter，重寫configure 方法

@Configuration@EnableWebSecurity@EnableGlobalMethodSecurity(prePostEnabled = true)public class WebSecurityConfig extends WebSecurityConfigurerAdapter { public static final String AUTHORIZATION_HEADER = "Authorization"; public static final String AUTHORIZATION_TOKEN = "access_token"; @Autowired private UserDetailsService userDetailsService; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth //自定義獲取用戶信息.userDetailsService(userDetailsService) //設置密碼加密.passwordEncoder(passwordEncoder()); } @Override protected void configure(HttpSecurity http) throws Exception { //配置請求訪問策略http //關閉CSRF、CORS .cors().disable() .csrf().disable() //由於使用Token，所以不需要Session .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() //驗證Http請求.authorizeRequests() //允許所有用戶訪問首頁與登錄.antMatchers("/","/auth/login").permitAll() //其它任何請求都要經過認證通過.anyRequest().authenticated() //用戶頁面需要用戶權限.antMatchers("/userpage").hasAnyRole("USER") .and() //設置登出.logout().permitAll(); //添加JWT filter 在http .addFilterBefore(genericFilterBean(), UsernamePasswordAuthenticationFilter.class); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Bean public GenericFilterBean genericFilterBean() { return new JwtAuthenticationTokenFilter(); }}

編寫用於測試的Controller

 @RestControllerpublic class UserController { @PostMapping("/login") public String login() { return "login"; } @GetMapping("/") public String index() { return "hello"; } @GetMapping("/userpage") public String httpApi() { System.out.println(SecurityContextHolder.getContext().getAuthentication().getPrincipal()); return "userpage"; } @GetMapping("/adminpage") public String httpSuite() { return "userpage"; }}

案例源碼下載（本地下載）

總結

以上就是這篇文章的全部內容了，希望本文的內容對大家的學習或者工作具有一定的參考學習價值，如果有疑問大家可以留言交流，謝謝大家對武林網的支持。

相關文章