jwttoken+redis+springsecurity

思路

jwttoken不设置过期时间
redis管理过期时间，并且续签
redis中key="login:"+userId, value=jwtUser
再次访问时，解析token中userId，并且根据过期时间自动续签

JWT 实现登录认证 + Token 自动续期方案

pom文件配置

<!--Redis-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
    <version>2.3.5.RELEASE</version>
</dependency>

<!--JWT-->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.10.7</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.10.7</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.10.7</version>
    <scope>runtime</scope>
</dependency>

<!--spring security-->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

application.yml配置

spring:
  redis:
    database: 0
    host: redis_ip
    port: redis_port
    connect-timeout: 30000
    lettuce:
      pool:
        # 最大阻塞等待时间，负数表示没有限制
        max-wait: -1
        # 连接池中的最大空闲连接
        max-idle: 10
        # 连接池中的最小空闲连接
        min-idle: 0
        # 连接池中最大连接数，负数表示没有限制
        max-active: 50
    password: redis_password

service层logon方法

@Override
public Object login(LoginDTO loginDTO) {
  UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(loginDTO.getUsername(), loginDTO.getPassword());
  Authentication authenticate;
  try {
    // 对登录用户进行认证
    authenticate = authenticationManager.authenticate(authenticationToken);
  } catch (AuthenticationException ex) {
    throw new ServiceException(ex.getMessage());
  }
  if (Objects.isNull(authenticate)) {
    throw new ServiceException("登录失败");
  }
  JWTUser jwtUser = (JWTUser)authenticate.getPrincipal();
  if(jwtUser.getUserDO().getDeleteFlag()!=0){
    throw new ServiceException("用户已被停用,如需开启,请联系管理员");
  }
  LoginSuccessDTO loginSuccessDTO = new LoginSuccessDTO();
  loginSuccessDTO.setUserId(jwtUser.getId());
  loginSuccessDTO.setUsername(jwtUser.getUsername());
  loginSuccessDTO.setNickName(jwtUser.getUserDO().getNickName());
  loginSuccessDTO.setUserRealName(jwtUser.getUserDO().getUserRealName());
  loginSuccessDTO.setDepartment(jwtUser.getUserDO().getDepartment());
  Map<String, Object> userInfo = DataConvert.BeanPropertyNameTraverse(loginSuccessDTO);
  String token = JwtUtils.generateToken(userInfo);
  String userId = jwtUser.getId();
  Date expirationTime = JwtUtils.getExpirationTime();
  redisUtils.set("login:" + userId, jwtUser, AuthConstant.EXPIRATION_TIME_IN_SECOND, TimeUnit.SECONDS);
  loginSuccessDTO.setLoginTime(new Date());
  loginSuccessDTO.setExpireTime(expirationTime);
  loginSuccessDTO.setToken(token);
  return loginSuccessDTO;
}

@Override
public Object logout() {
  /*
   * 获取SecurityContextHolder中的userId。
   * 注销操作也是需要携带token的，spring security已经在内部对token进行验证，
   * 并能够从redis取出用户信息
   */
  UsernamePasswordAuthenticationToken authentication = (UsernamePasswordAuthenticationToken)SecurityContextHolder.getContext().getAuthentication();
  JWTUser jwtUser = (JWTUser)authentication.getPrincipal();
  String userId = jwtUser.getId();
  redisUtils.del("login:"+userId);
  return "注销成功";
}

token工具类

package cma.sxqxgxw.utils.jwt;

import cma.sxqxgxw.auth.constant.AuthConstant;
import cma.sxqxgxw.common.exception.ServiceException;
import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;

import javax.crypto.SecretKey;
import java.util.Map;
import java.util.Date;

public class JwtUtils {
    private static final String SIGNATURE = "!QW@f5g%T^U&f3r32523534634634654754ygrgfdjjuhfdsdf6";

    /**
     * 计算token的过期时间
     *
     * @return 过期时间
     */
    public static Date getExpirationTime() {
        return new Date(System.currentTimeMillis() + AuthConstant.EXPIRATION_TIME_IN_SECOND * 1000);
    }

    /**
     * 生成Token
     * @param claims 用户信息
     * @return token
     */
    public static String generateToken(Map<String, Object> claims) {
        Date createdTime = new Date();
        //Date expirationTime = getExpirationTime();
        byte[] keyBytes = SIGNATURE.getBytes();
        SecretKey key = Keys.hmacShaKeyFor(keyBytes);
        return Jwts.builder()
                .setClaims(claims)
                .setIssuedAt(createdTime)
                //.setExpiration(expirationTime)
                .signWith(key, SignatureAlgorithm.HS256)
                .compact();
    }

    /**
     * 从token中获取claim
     *
     * @param token token
     * @return claim
     */
    public static Claims getClaimsFromToken(String token) {
        try {
            return Jwts.parser()
                    .setSigningKey(SIGNATURE.getBytes())
                    .parseClaimsJws(token)
                    .getBody();
        } catch (ExpiredJwtException | UnsupportedJwtException | MalformedJwtException | IllegalArgumentException e) {
            throw new ServiceException("Token invalided.");
        }
    }

    /**
     * 获取token的过期时间
     *
     * @param token token
     * @return 过期时间
     */
    public static Date getExpirationDateFromToken(String token) {
        return getClaimsFromToken(token)
                .getExpiration();
    }

    /**
     * 判断token是否过期
     *
     * @param token token
     * @return 已过期返回true，未过期返回false
     */
    public static Boolean isTokenExpired(String token) {
        Date expiration = getExpirationDateFromToken(token);
        return expiration.before(new Date());
    }

    /**
     * 判断token是否非法
     *
     * @param token token
     * @return 未过期返回true，否则返回false
     */
    public static Boolean validateToken(String token) {
        System.out.println("token valid");
        return !isTokenExpired(token);
    }
}

redis工具类

@Slf4j
@Component
public class RedisUtils {

    private final RedisTemplate<String, Object> redisTemplate;
    @Autowired
    public RedisUtils(RedisTemplate<String, Object> redisTemplate) {
        this.redisTemplate = redisTemplate;
    }

    /**
     * 指定缓存失效时间
     *
     * @param key  键
     * @param time 时间(秒)
     * @return
     */
    public boolean expire(String key, long time) {
        try {
            if (time > 0) {
                redisTemplate.expire(key, time, TimeUnit.SECONDS);
            }
            return true;
        } catch (Exception e) {
            e.printStackTrace();
            return false;
        }
    }

    /**
     * 根据key 获取过期时间
     *
     * @param key 键 不能为null
     * @return 时间(秒) 返回0代表为永久有效
     */
    public long getExpire(String key) {
        return redisTemplate.getExpire(key, TimeUnit.SECONDS);
    }

    /**
     * 判断key是否存在
     *
     * @param key 键
     * @return true 存在 false不存在
     */
    public boolean hasKey(String key) {
        try {
            return redisTemplate.hasKey(key);
        } catch (Exception e) {
            log.info("Redis连接失败，可能是Redis服务未启动。" + e.getMessage());
            return false;
        }
    }

    /**
     * 删除缓存
     *
     * @param key 可以传一个值 或多个
     */
    @SuppressWarnings("unchecked")
    public boolean del(String... key) {
        if (key != null && key.length > 0) {
            if (key.length == 1) {
                Boolean delete = redisTemplate.delete(key[0]);
                return delete;
            } else {
                Long delete = redisTemplate.delete((Collection<String>) CollectionUtils.arrayToList(key));
                return true;
            }
        }
        return false;
    }

    //============================String=============================

    /**
     * 普通缓存获取
     *
     * @param key 键
     * @return 值
     */
    public Object get(String key) {
        return key == null ? null : redisTemplate.opsForValue().get(key);
    }

    /**
     * 普通缓存放入
     *
     * @param key   键
     * @param value 值
     * @return true成功 false失败
     */
    public boolean set(String key, Object value) {
        try {
            redisTemplate.opsForValue().set(key, value);
            return true;
        } catch (Exception e) {
            log.info("插入操作时，Redis连接失败，可能是Redis服务未启动。" + e.getMessage());
            return false;
        }
    }

    /**
     * 普通缓存放入并设置时间
     *
     * @param key   键
     * @param value 值
     * @param time  时间(秒) time要大于0 如果time小于等于0 将设置无限期
     * @return true成功 false 失败
     */
    public boolean set(String key, Object value, long time, TimeUnit timeUnit) {
        try {
            if (time > 0) {
                redisTemplate.opsForValue().set(key, value, time, timeUnit);
            } else {
                set(key, value);
            }
            return true;
        } catch (Exception e) {
            e.printStackTrace();
            return false;
        }
    }
}

jwt过滤器

生成的token中不带有过期时间，token的过期时间由redis进行管理

当redis过期时间小于10分钟时，redis过期时间续签30分钟

@Component
public class JWTAuthorizationFilter extends BasicAuthenticationFilter {
    private final RedisUtils redisUtils;

    @Autowired
    public JWTAuthorizationFilter(AuthenticationManager authenticationManager, RedisUtils redisUtils) {
        super(authenticationManager);
        this.redisUtils = redisUtils;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
        String token = request.getHeader("token");
        if (!StringUtils.hasText(token)) {
            request.setAttribute("errorMessage", "Token缺失，请检查请求Header");
            chain.doFilter(request, response);
            return;
        }
        try {
            Claims claims = JwtUtils.getClaimsFromToken(token);
            String userId = (String) claims.get("userId");
            boolean hasKey = redisUtils.hasKey("login:" + userId);
            if (!hasKey) {
                request.setAttribute("errorMessage", "Token无效或已经过期");
                throw new ServiceException("Token无效或已经过期");
            }
            // 令牌续签
            long expire = redisUtils.getExpire("login:" + userId);
            System.out.println("剩余时间： "+expire);
            if (expire < AuthConstant.RENEWAL_TIME_IN_SECOND) {
                redisUtils.expire("login:" + userId, AuthConstant.EXPIRATION_TIME_IN_SECOND);
                System.out.println("令牌续签" + AuthConstant.EXPIRATION_TIME_IN_SECOND + "秒");
            }

            JWTUser jwtUser = (JWTUser) redisUtils.get("login:" + userId);
            UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(jwtUser, null, jwtUser.getAuthorities());
            // 设置认证状态
            SecurityContextHolder.getContext().setAuthentication(authenticationToken);
            chain.doFilter(request, response);
        } catch (ServiceException e) {
            request.setAttribute("errorMessage", e.getMessage());
            chain.doFilter(request, response);
        }
    }
}

过期时间常量

public class AuthConstant {
  /**
   * 令牌有效时长
   */
  public static final Long EXPIRATION_TIME_IN_SECOND = 60*30L;

  /**
   * 过期时间剩余多少时间时续签
   */
  public static final Long RENEWAL_TIME_IN_SECOND = 60*10L;
}

Redis配置类

package cma.sxqxgxw.common.config.redis;

import com.alibaba.fastjson.support.spring.GenericFastJsonRedisSerializer;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Bean;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.serializer.GenericJackson2JsonRedisSerializer;
import org.springframework.data.redis.serializer.RedisSerializer;
import org.springframework.data.redis.serializer.StringRedisSerializer;

/**
 * Redis配置
 * 主要指定自定义序列化器,避免序列化反序列化失败
 */
@Configuration
public class RedisConfig {
    @Bean
    public RedisTemplate<String, Object> redisTemplate(RedisConnectionFactory redisConnectionFactory) {
        RedisTemplate<String, Object> redisTemplate = new RedisTemplate<>();
        // 参照StringRedisTemplate内部实现指定序列化器
        redisTemplate.setConnectionFactory(redisConnectionFactory);
        // 设置key的序列化器
        redisTemplate.setKeySerializer(keySerializer());
        redisTemplate.setHashKeySerializer(keySerializer());
        // 设置value的序列化器
        // 解决autoType is not support.xx.xx的问题
        String[] acceptNames = {"org.springframework.security.core.authority.SimpleGrantedAuthority"};
        GenericFastJsonRedisSerializer serializer = new GenericFastJsonRedisSerializer(acceptNames);
        redisTemplate.setValueSerializer(serializer);
        redisTemplate.setHashValueSerializer(serializer);
        return redisTemplate;
    }

    private RedisSerializer<String> keySerializer(){
        return new StringRedisSerializer();
    }

    //使用Jackson序列化器
    private RedisSerializer<Object> valueSerializer(){
        return new GenericJackson2JsonRedisSerializer();
    }
}

Jwt拦截器

package cma.sxqxgxw.common.interceptor;

import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Component
public class JwtInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        return true;
    }

}