SpringBoot+SpringSecurity6+Jwt最小化程式碼

卤香味泡面發表於2024-04-16

SpringBoot+SpringSecurity6+Jwt最小化程式碼

[toc]

零、參考資料

https://blog.csdn.net/m0_71273766/article/details/132942056

一、快速開始

1.1、引入依賴

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.4</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.cyw</groupId>
    <artifactId>spring-security-demo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>spring-security-demo</name>
    <description>spring-security-demo</description>
    <properties>
        <java.version>17</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-spring-boot3-starter</artifactId>
            <version>3.5.5</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.1</version>
        </dependency>

<!-- 以下依賴是為了解決高版本JDK+jjwt庫時的報錯 -->
        <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
            <version>2.4.0-b180830.0359</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>3.0.0-M4</version>
        </dependency>
        <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-core</artifactId>
            <version>3.0.0-M4</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>activation</artifactId>
            <version>1.1.1</version>
        </dependency>


    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

1.2、JwtUtil


import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jws;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;

import java.util.Date;

@Slf4j
@Component
public class JwtUtil {

    //常量
    public static final long EXPIRE = 1000 * 60 * 60 * 4; //token過期時間,4個小時
    public static final String APP_SECRET = "amRiYzpteXNxbDovL2xvY2FsaG9zdDozMzA2L2RiX3NlY3VyaXR5P3VzZVNTTD1mYWxzZSZzZXJ2ZXJUaW1lem9uZT1VVEMmY2hhcmFjdGVyRW5jb2Rpbmc9dXRmOA=="; //秘鑰

    //生成token字串的方法
    public String getToken(String userName){
        log.info(userName);
        return Jwts.builder()
                .setHeaderParam("typ", "JWT")
                .setHeaderParam("alg", "HS256")
                .setSubject("user")
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + EXPIRE))
                .claim("userName", userName)//設定token主體部分 ，儲存使用者資訊
                .signWith(SignatureAlgorithm.HS256, APP_SECRET)
                .compact();
    }

    //驗證token字串是否是有效的  包括驗證是否過期
    public boolean checkToken(String jwtToken) {
        if(jwtToken == null || jwtToken.isEmpty()){
            log.error("Jwt is empty");
            return false;
        }
        try {
            Jws<Claims> claims = Jwts.parser().setSigningKey(APP_SECRET).parseClaimsJws(jwtToken);
            Claims body = claims.getBody();
            if ( body.getExpiration().after(new Date(System.currentTimeMillis()))){
                return true;
            } else
                return false;
        } catch (Exception e) {
            log.error(e.getMessage());
            return false;
        }
    }

    public Claims getTokenBody(String jwtToken){
        if(jwtToken == null || jwtToken.isEmpty()){
            log.error("Jwt is empty");
            return null;
        }
        try {
            return Jwts.parser().setSigningKey(APP_SECRET).parseClaimsJws(jwtToken).getBody();
        } catch (Exception e){
            log.error(e.getMessage());
            return null;
        }
    }
}

1.3、JwtFilter


import com.cyw.springsecuritydemo.utils.JwtUtil;
import io.jsonwebtoken.Claims;
import jakarta.annotation.Resource;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
public class JwtFilter extends OncePerRequestFilter {

    @Resource
    private JwtUtil jwtUtil;

    @Resource
    private MyUserDetailsService myUserDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String jwtToken = request.getHeader("token");//從請求頭中獲取token
        if (jwtToken != null && !jwtToken.isEmpty() && jwtUtil.checkToken(jwtToken)){
            try {//token可用
                Claims claims = jwtUtil.getTokenBody(jwtToken);
                String userName = (String) claims.get("userName");
                UserDetails user = myUserDetailsService.loadUserByUsername(userName);
                if (user != null){
                    UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
                    SecurityContextHolder.getContext().setAuthentication(auth);
                }
            } catch (Exception e){
                log.error(e.getMessage());
            }
        }else {
            log.warn("jwt為空，請確定是否要登入");
        }
        filterChain.doFilter(request, response);//繼續過濾
    }
}

1.4、MyUser（UserDetails的實現類）


import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import java.util.Collection;


public class MyUser extends User {
    // todo 其他自定義的欄位

    public MyUser(String username, String password, Collection<? extends GrantedAuthority> authorities) {
        super(username, password, true,true,true,true,authorities);
    }

    public MyUser(String username, String password, boolean enabled, boolean accountNonExpired, boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
        super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
    }
}

1.5、AuthController 登入介面


import com.cyw.springsecuritydemo.pojo.Rst;
import com.cyw.springsecuritydemo.pojo.vo.LoginVo;
import com.cyw.springsecuritydemo.utils.JwtUtil;
import jakarta.annotation.Resource;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

@Slf4j
@RestController
public class AuthController{
    @Resource
    AuthenticationManager authenticationManager;

    @Autowired
    private JwtUtil jwtUtil;

    @PostMapping("/auth/login")
    public Rst login(LoginVo loginVo) {
        if (loginVo==null || !StringUtils.hasText(loginVo.getUsername())) {
            return Rst.err("使用者名稱或密碼不能為空！");
        }

        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(loginVo.getUsername(), loginVo.getPassword());

        Authentication authentication = authenticationManager.authenticate(token);
        SecurityContextHolder.getContext().setAuthentication(authentication);
        MyUser myUser = (MyUser) authentication.getPrincipal();
        String jwtToken = jwtUtil.getToken(myUser.getUsername());
        return Rst.ok("登入成功",jwtToken);
    }
}

1.6、MyUserDetailsService（UserDetailsService的實現類）


import com.cyw.springsecuritydemo.mapper.TbUserMapper;
import com.cyw.springsecuritydemo.pojo.TbUser;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Component;

import java.util.List;

@Slf4j
@Component
public class MyUserDetailsService implements UserDetailsService {
    @Autowired
    private TbUserMapper tbUserMapper;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        log.info("進入了 MyUserDetailsService 類");
        TbUser tbUser = tbUserMapper.findUserWithAuthority(username);

        if (tbUser == null) {
            throw new UsernameNotFoundException("該使用者不存在");
        }
        List<GrantedAuthority> grantedAuthorities = AuthorityUtils.commaSeparatedStringToAuthorityList(tbUser.getAuthorityListStr());
        return new MyUser(username, tbUser.getPwd(), grantedAuthorities);
    }

}

1.8、SpringSecurity的配置類


import com.cyw.springsecuritydemo.auth.JwtFilter;
import com.cyw.springsecuritydemo.auth.MyUserDetailsService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;


@EnableWebSecurity
@Configuration
public class SecurityConfig {

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
        return configuration.getAuthenticationManager();
    }

    @Bean
    public AuthenticationProvider authenticationProvider(BCryptPasswordEncoder bCryptPasswordEncoder,MyUserDetailsService myUserDetailsService){
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(bCryptPasswordEncoder);
        provider.setUserDetailsService(myUserDetailsService);
        return provider;
    }


    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, AuthenticationProvider authenticationProvider, JwtFilter jwtFilter) throws Exception {
        http
                .formLogin(AbstractHttpConfigurer::disable) //取消預設登入頁面的使用
                .logout(AbstractHttpConfigurer::disable)    //取消預設登出頁面的使用
                .authorizeHttpRequests((authorize) -> authorize
                        .requestMatchers("/auth/login","/auth/register").permitAll() // 允許訪問登入介面、註冊介面
                        .anyRequest().authenticated()    // 其他介面需要登入才能訪問
                )
                .authenticationProvider(authenticationProvider)
                .csrf(AbstractHttpConfigurer::disable)
                .httpBasic(AbstractHttpConfigurer::disable)
                .sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
//                .exceptionHandling((exceptions) -> exceptions
//                        .authenticationEntryPoint(new BearerTokenAuthenticationEntryPoint())
//                        .accessDeniedHandler(new BearerTokenAccessDeniedHandler())
//                )
                ;
        return http.build();
    }
}

1.9、UserMapper.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.cyw.springsecuritydemo.mapper.TbUserMapper">

    <resultMap id="rstMap" type="com.cyw.springsecuritydemo.pojo.TbUser">
        <id column="id" property="id"/>
        <result column="user_name" property="userName"/>
        <result column="pwd" property="pwd"/>
        <result column="perm_names" property="authorityListStr"/>
    </resultMap>

    <select id="findUserWithAuthority" resultMap="rstMap">
        SELECT DISTINCT u.id,
                        u.user_name,
                        u.pwd,
                        GROUP_CONCAT(distinct r.role_name SEPARATOR ',') AS role_names,
                        GROUP_CONCAT(distinct p.perm_name SEPARATOR ',') AS perm_names
        FROM tb_user u
                 LEFT JOIN tb_mid_user_role ur ON u.id = ur.uid
                 left join tb_role r on ur.role_id = r.id
                 LEFT JOIN tb_mid_role_perm rp ON ur.role_id = rp.role_id
                 LEFT JOIN tb_perm p ON p.id = rp.perm_id
        <where>
            u.del=0
            <if test="userName != null and userName != ''">
                and user_name = #{userName}
            </if>
        </where>
        GROUP BY u.id
    </select>
</mapper>

最小化的 Google Analytics 程式碼
2019-01-18
Go
QT最小化程式到托盤執行
2023-12-06
QT
C#一行程式碼實現（01）最小化到通知區域
2020-10-24
C#行程
win10關閉程式視窗、最大化最小化快捷鍵是什麼_win10關閉程式視窗、最大化最小化快捷鍵使用方法
2020-06-12
Win10
最小化醫療保健中應用程式威脅風險的幾種方法
2022-11-08
前端框架Astro實現最小化JavaScript
2021-06-10
前端框架ASTJavaScript
短視訊app原始碼，連麥時最小化出現可移動懸浮窗
2022-01-24
APP原始碼
靜態WEB容器映象最小化實踐
2022-11-22
Web
《程式碼大全》程式碼生成
2018-06-17
2439. 最小化陣列中的最大值
2024-07-19
陣列
PyQT5之視窗最大化最小化
2024-06-11
QT
Google 要求 Chrome 擴充套件最小化資料收集
2019-07-30
GoChrome套件
基於 Babel 的 npm 包的最小化設定
2019-03-05
BabelNPM
低程式碼VS無程式碼
2022-05-09
CentOS 7最小化安裝對系統初始化
2023-01-30
CentOS
低程式碼優於無程式碼？
2024-05-06
程式碼安全兩種程式碼漏洞
2022-07-05
.Net Core——用程式碼寫程式碼？
2021-05-21
JNI：Java程式碼呼叫原生程式碼
2022-03-02
Java
Flutter 程式碼混淆混淆Dart程式碼
2021-08-19
FlutterDart
程式碼
2024-07-09
vxe-modal 實現視窗最大化與最小化
2024-11-25
【程式碼混淆】react-native 程式碼混淆
2023-12-26
React
程式碼整潔 vs 程式碼骯髒
2021-12-22
程式碼壞味道之程式碼臃腫
2019-03-07
控制程式碼表篇——程式控制程式碼表
2022-01-19
微信小程式：小程式碼、小程式二維碼、普通二維碼
2018-04-27
微信小程式
碼農深耕 - 什麼樣的程式碼才是好程式碼？
2018-10-29
如何在 Linux 最小化安裝中設定網際網路
2021-09-02
Linux
Linklist程式碼實現以及程式碼解讀
2024-10-23
程式碼安全之程式碼混淆及加固（Android）?
2023-11-15
Android
藉助ai來分析程式碼，理解程式碼
2024-04-02
AI
低程式碼和無程式碼的區別
2021-07-30
微信小程式掃碼解析小程式碼
2020-08-13
微信小程式
程式碼模板 | 我的程式碼沒有else
2020-03-31
GO程式碼生成程式碼小思小試
2019-07-05
Go
js程式碼與html程式碼分離示例
2018-06-17
JSHTML
各省程式碼
2024-08-29

SpringBoot+SpringSecurity6+Jwt最小化程式碼

SpringBoot+SpringSecurity6+Jwt最小化程式碼

零、參考資料

一、快速開始

1.1、引入依賴

1.2、JwtUtil

1.3、JwtFilter

1.4、MyUser（UserDetails的實現類）

1.5、AuthController 登入介面

1.6、MyUserDetailsService（UserDetailsService的實現類）

1.8、SpringSecurity的配置類

1.9、UserMapper.xml

相關文章