Spring Security + JWT + Swagger2 登录验证一套流程小结 - ToB企服应用市场:ToB评测及商务社交产业平台

<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>com.baomidou</groupId>
<artifactId>mybatis-plus-boot-starter</artifactId>
<version>3.3.1.tmp</version>
</dependency>
<dependency>
<groupId>io.springfox</groupId>
<artifactId>springfox-swagger2</artifactId>
<version>2.7.0</version>
</dependency>
<dependency>
<groupId>com.github.xiaoymin</groupId>
<artifactId>swagger-bootstrap-ui</artifactId>
<version>1.9.6</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt</artifactId>
<version>0.9.1</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-pool2</artifactId>
</dependency>
</dependencies>

复制代码

create table user(
id int primary key auto_increment,
username varchar not null,
password varchar not null,
info varchar(200),
enabled tinyint(1) default 1
)
insert into user values(default,"admin","$2a$10$Himwt.wu3MPOLnNQ9YUH8O2quxgi7bMuomiNeFsVKRay87.qG5dgy","管理员 info ...",default)

复制代码

server:
port: 8082
spring:
datasource:
driver-class-name: com.mysql.cj.jdbc.Driver
url: jdbc:mysql://localhost:3306/dbtest16?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai
username: admin
password: admin
hikari:
# 连接池名字
pool-name: DateHikari
# 最小空闲连接数
minimum-idle: 5
# 空闲连接存活最大事件，默认10分钟（600000）
idle-timeout: 180000
# 最大连接数：默认 10
maximum-pool-size: 10
# 从连接池返回的连接自动提交
auto-commit: true
# 连接最大存活时间，0 表示永久存活，默认 1800000（30 min）
max-lifetime: 1800000
# 连接超时事件 30 s
connection-timeout: 30000
# 测试连接是否可用的查询语句
connection-test-query: SELECT 1
# MP 配置
mybatis-plus:
# 配置 Mapper 映射文件
mapper-locations: classpath*:/mapper/*Mapper.xml
# 实体类的别名包
type-aliases-package: com.cnda.pojo
configuration:
# 自动驼峰命名
map-underscore-to-camel-case: false
# MyBatis 的 SQL 打印是方法接口所在的包
logging:
level:
com.cnda.mapper: debug
# JWT 配置
jwt:
# JWT 存储的请求头
tokenHeader: Authorization
# JWT 加密使用的密钥
secret: test-cnda-secret
# JWT 的有效时间 (60*60*24)
expiration: 604800
# JWT 负载中拿到开头规定
tokenHead: Bearer

复制代码

@Data
@AllArgsConstructor
@NoArgsConstructor
public class User {
private Integer id;
private String username;
private String password;
private String info;
private Boolean enabled;
}

复制代码

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
super.configure(auth);
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(
"/hello",
// 下面是对静态资源以及 swagger2 UI 的放行。
"/css/**",
"/js/**",
"/img/**",
"/index.html",
"favicon.ico",
"/doc.html",
"/webjars/**",
"/swagger-resources/**",
"/v2/api-docs/**",
"/ws/**"
);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
}
}

复制代码

@RestController
public class LoginController {
@RequestMapping("/hello")
public String hello(){
return "Hello Word!";
}
}

复制代码

@Configuration
@EnableSwagger2
public class Swagger2Config {
@Bean
public Docket docket(){
return new Docket(DocumentationType.SWAGGER_2)
.apiInfo(apiInfo()) // 配置 apiInfo
.select() // 选择那些路径和api会生成document
.apis(RequestHandlerSelectors.basePackage("com.cnda.controller")) // // 对哪些 api进行监控，RequestHandlerSelectors.basePackage 基于包扫描
.paths(PathSelectors.any()) // 对所有路径进行监控
.build();
}
private ApiInfo apiInfo(){
return new ApiInfoBuilder()
.title("在线接口文档")
.description("在线接口文档")
.contact(new Contact("cnda","http://localhost:8082/doc.html","xxx@xxx.com"))
.build();
}
}

复制代码

@Component
public class JwtUtil {
// 准备两个存放在荷载的内容
private static final String CLAIM_KEY_SUB = "sub";
private static final String CLAIM_KEY_CREATE = "ibt";
// 提取 application.yml 中 JWT 的参数：
// 1. expiration Long
@Value("${jwt.expiration}")
private Long expiration;
// 2. secret String
@Value("${jwt.secret}")
private String secret; // 密钥
// 根据用户名构建 token
public String foundJWT(UserDetails userDetails) {
String username = userDetails.getUsername();
Map<String, Object> claims = new HashMap<>();
claims.put(CLAIM_KEY_SUB, username);
claims.put(CLAIM_KEY_CREATE, new Date());
return foundJWT(claims);
}
// 根据荷载 map 构建 token
private String foundJWT(Map<String, Object> claims) {
return Jwts.builder()
.setClaims(claims)
.setExpiration(getExpiration()) // 过期时间
.signWith(SignatureAlgorithm.HS512, secret) // 设置签名算法和密钥
.compact();
}
// 判断 token 是否有效
public boolean validateToken(String token,UserDetails userDetails){
// 从 token 中获取 username 与 userDetails 中的username 对比
String username = getUsernameInToken(token);
// 判断 username 是否一致以及 token 是否过期
return username.equals(userDetails.getUsername()) && !isExpired(token);
}
// 判断 token 是否过期
// true 过期 false 没过期
private boolean isExpired(String token) {
Date expiration = getClaimsInToken(token).getExpiration();
return expiration.before(new Date());
}
// 从 token 中提取荷载信息
public Claims getClaimsInToken(String token){
Claims claims = null;
try {
claims = Jwts.parser()
.setSigningKey(secret)
.parseClaimsJws(token)
.getBody();
}catch (Exception e){
e.printStackTrace();
}
return claims;
}
// 从 token 中提取用户名信息
public String getUsernameInToken(String token){
String username;
try {
username = getClaimsInToken(token).getSubject();
}catch (Exception e){
username = null;
}
return username;
}
// token 是否能刷新
public boolean tokenCanRef(String token){
return !isExpired(token); // 有效地 token 才能被刷新
}
// 刷新 token
public String refToken(String token){
Claims claimsInToken = getClaimsInToken(token);
claimsInToken.put(CLAIM_KEY_CREATE,new Date());
return foundJWT(claimsInToken);
}
// 设置过期时间
private Date getExpiration() {
return new Date(System.currentTimeMillis() + expiration * 1000);
}
}

复制代码

@Data
@AllArgsConstructor
@NoArgsConstructor
public class RespBean {
private long code;
private String message;
private Object obj;
/**
* 返回响应结果
*/
private static RespBean result(long code, String message, Object obj) {
return new RespBean(code, message, obj);
}
/*
返回成功响应
*/
public static RespBean success(String message) {
return result(200, message, null);
}
/*
返回成功响应以及数据体
*/
public static RespBean success(String message, Object obj) {
return result(200, message, obj);
}
/*
返回错误响应
*/
public static RespBean error(String message) {
return result(500, message, null);
}
}

复制代码