一、思路
前端调用后端可以使用jwt鉴权;调用三方接口也可以使用jwt鉴权。对接多个三方则与每个third parth都约定一套token规则,因为如果使用同一套token,token串用可能造成权限越界问题,且payload交叉业务不够清晰。下面的demo包含了两套jwt,前端和一个三方(openApi)的:
1、token生成:
(1)签发给前端的token在本项目生成;
(2)签发给第三方的token,由第三方根据双方约定的算法、密钥和payload通信信息自己生成
。不能调用本项目(被调用方)接口生成,否则这个生成token的接口需要加白名单,
会造成接口攻击和token泄露的安全问题。
2、token校验:
先判断是哪个业务的token,再用各自约定的算法和业务规则校验。这里是根据url来判断的,
不能只根据audience来判断,如用前端的token访问open api接口,从token解析出audience
是前端的,再用前端的规则校验,校验通过访问成功;
二、demo
1、pom与配置文件
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<parent>
<artifactId>openapi-ta</artifactId>
<groupId>us.zoom.openapi</groupId>
<version>1.0-SNAPSHOT</version>
</parent>
<modelVersion>4.0.0</modelVersion>
<artifactId>openapi-ta-mas</artifactId>
<properties>
<maven.compiler.source>17</maven.compiler.source>
<maven.compiler.target>17</maven.compiler.target>
<ta.product.name>Mas</ta.product.name>
</properties>
<dependencies>
<dependency>
<groupId>us.zoom.openapi</groupId>
<artifactId>openapi-ta-commons</artifactId>
<version>1.0-SNAPSHOT</version>
</dependency>
<dependency>
<groupId>us.zoom.openapi.mas</groupId>
<artifactId>open-api-mas-common</artifactId>
<version>1.0.1</version>
</dependency>
<dependency>
<groupId>com.github.pagehelper</groupId>
<artifactId>pagehelper</artifactId>
<version>5.1.8</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jsr310</artifactId>
<version>2.13.0</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.8.1</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<encoding>UTF-8</encoding>
<skip>true</skip>
<executable>false</executable>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>${surefire.version}</version>
<configuration>
<systemPropertyVariables>
<org.uncommons.reportng.escape-output>false</org.uncommons.reportng.escape-output>
<spring.profiles.active>${spring.profiles.active}</spring.profiles.active>
<ta.product.name>${ta.product.name}</ta.product.name>
</systemPropertyVariables>
<skip>false</skip>
<testFailureIgnore>false</testFailureIgnore>
<argLine>
-javaagent:"${settings.localRepository}/org/aspectj/aspectjweaver/${aspectj.version}/aspectjweaver-${aspectj.version}.jar"
--add-opens java.base/java.lang=ALL-UNNAMED
</argLine>
<suiteXmlFiles>
<suiteXmlFile>${project.basedir}/src/main/resources/suites/${spring.profiles.active}/AlertRuleAPIBvtSuite.xml</suiteXmlFile>
</suiteXmlFiles>
<properties>
<usedefaultlisteners>false</usedefaultlisteners>
</properties>
</configuration>
</plugin>
</plugins>
<resources>
<resource>
<directory>src/main/resources</directory>
<filtering>true</filtering>
<includes>
<include>**/*.properties</include>
<include>**/*.xml</include>
<include>application.yml</include>
<include>application-${spring.profiles.active}.yml</include>
</includes>
</resource>
<resource>
<directory>src/main/java</directory>
<filtering>false</filtering>
</resource>
</resources>
</build>
<profiles>
<profile>
<id>dev</id>
<activation>
<!--default env-->
<activeByDefault>true</activeByDefault>
</activation>
<properties>
<spring.profiles.active>dev</spring.profiles.active>
</properties>
</profile>
<profile>
<id>go</id>
<properties>
<spring.profiles.active>go</spring.profiles.active>
</properties>
</profile>
<profile>
<id>aw1</id>
<properties>
<spring.profiles.active>aw1</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us02</id>
<properties>
<spring.profiles.active>us02</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us03</id>
<properties>
<spring.profiles.active>us03</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us04</id>
<properties>
<spring.profiles.active>us04</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us05</id>
<properties>
<spring.profiles.active>us05</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us06</id>
<properties>
<spring.profiles.active>us06</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us07</id>
<properties>
<spring.profiles.active>us07</spring.profiles.active>
</properties>
</profile>
<profile>
<id>us01</id>
<properties>
<spring.profiles.active>us01</spring.profiles.active>
</properties>
</profile>
</profiles>
</project>
server.port=6666
server.servlet.context-path=/jwtDemo
2、启动类
package com.demo.security;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.EnableMBeanExport;
import org.springframework.jmx.support.RegistrationPolicy;
@SpringBootApplication
//解决报错MXBean already registered with name org.apache.commons.pool2:type=GenericObjectPool,name=pool
@EnableMBeanExport(registration = RegistrationPolicy.IGNORE_EXISTING)
public class JWTApplication {
public static void main(String[] args) {
SpringApplication.run(JWTApplication.class, args);
}
}
3、全局配置
(1)webMVC
package com.demo.security.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
//设置跨域
@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("http://localhost:9528");
config.addAllowedHeader("*");
config.addAllowedMethod("*");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
}
(2)security
package com.demo.security.config;
import org.springframework.security.crypto.password.PasswordEncoder;
public class MyPasswordEncoder implements PasswordEncoder {
@Override
public String encode(CharSequence charSequence) {
return charSequence.toString();
}
@Override
public boolean matches(CharSequence charSequence, String s) {
return s.equals(charSequence.toString());
}
/*public DefaultPasswordEncoder() {
this(-1);
}
*//**
* @param strength
* the log rounds to use, between 4 and 31
*//*
public DefaultPasswordEncoder(int strength) {
}
public String encode(CharSequence rawPassword) {
return MD5.encrypt(rawPassword.toString());
}
public boolean matches(CharSequence rawPassword, String encodedPassword) {
return encodedPassword.equals(MD5.encrypt(rawPassword.toString()));
}*/
}
package com.demo.security.config;
import com.demo.security.filter.LoginFilter;
import com.demo.security.filter.TokenAuthenticationFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityWebConfig {
@Autowired
private UserDetailsService userDetailsService;
@Bean
public PasswordEncoder passwordEncoder() {
return new MyPasswordEncoder();
}
@Bean
public AuthenticationManager authenticationManager(
AuthenticationConfiguration authConfig) throws Exception {
return authConfig.getAuthenticationManager();
}
@Bean
public SecurityFilterChain configure(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {
http.csrf(AbstractHttpConfigurer::disable);
http.headers(AbstractHttpConfigurer::disable);
http.sessionManagement(sessionManagement -> {
sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
});
http.authorizeRequests().anyRequest().authenticated().and()
//1、登陆、退出url,均由前端拦截器控制,这里注释掉。
//1.1、前端拦截器中判断缓存token为空,为空则post请求访问/login,目的是进入LoginFilter获取token
//1.2、不为空则带token访问接口,如果AuthenticationFilter拦截token不合法则根据错误码跳转到登陆页面,重复1.1的操作
//.logout().logoutUrl("/logout").and()
//2、身份认证filter,访问系统(除了白名单接口)需要先登陆。post请求/login接口会进入这个拦截器
// 校验用户名密码是否正确,正确返回token给前端,不正确则返回异常信息
.addFilterBefore(new LoginFilter(authenticationManager), LoginFilter.class)
//3、授权filer,authenticationManager为BasicAuthenticationFilter的必传参数。所有的接口都会走到这里
// 根据用户id查询权限,连同身份一起塞入SecurityContextHolder全局变量,后面获取用户信息则直接从SecurityContextHolder中get
.addFilterBefore(new TokenAuthenticationFilter(authenticationManager,userDetailsService),TokenAuthenticationFilter.class);
return http.build();
}
@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().requestMatchers("/param/**", "/user-websocket-endpoint/**","/menu-websocket-endpoint/**");
}
}
4、security数据源
(1)常量(模拟数据库)
package com.demo.security.constant;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/**
* 模拟数据库查询数据,假设有:用户名/密码/角色/资源
* admin/123/xtgly/user_manage、role_manage、menu_manage、school_manage
* zs/123/userAdmin、roleAdmin/user_manage、role_manage、menu_manage
* ls/123/schoolAdmin/school_manage
*/
public class UserDBConstants {
public static Map<String, String> getUsers() {
Map<String,String> users = new HashMap<>();
users.put("admin","123");
users.put("zs","123");
users.put("ls","123");
return users;
}
public static Map<String,List<String>> getUserRoles() {
Map<String,List<String>> userRoles = new HashMap<>();
//admin
List<String> adminRoles = new ArrayList<>();
adminRoles.add("xtgly");
userRoles.put("admin",adminRoles);
//zs
List<String> zsRoles = new ArrayList<>();
zsRoles.add("userAdmin");
zsRoles.add("roleAdmin");
userRoles.put("zs",zsRoles);
//ls
List<String> lsRoles = new ArrayList<>();
lsRoles.add("schoolAdmin");
userRoles.put("ls",lsRoles);
return userRoles;
}
public static Map<String,List<String>> getUserPermissions() {
Map<String,List<String>> userPermissions = new HashMap<>();
List<String> lsPermissions = new ArrayList<>();
//ls
lsPermissions.add("school_manage");
userPermissions.put("ls",lsPermissions);
//zs
List<String> zsPermissions = new ArrayList<>();
zsPermissions.add("user_manage");
zsPermissions.add("role_manage");
zsPermissions.add("menu_manage");
userPermissions.put("zs",zsPermissions);
//admin
List<String> adminPermissions = new ArrayList<>();
adminPermissions.add("user_manage");
adminPermissions.add("role_manage");
adminPermissions.add("menu_manage");
adminPermissions.add("school_manage");
userPermissions.put("admin",adminPermissions);
return userPermissions;
}
}
(2)UserDetails
package com.demo.security.dto;
import lombok.Data;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.Collection;
import java.util.List;
@Data
public class UserDTO implements UserDetails {
private Integer id;
private String userName;
private String userAccount;
private List<String> roles;
private List<String> menus;
private String passWord;
public UserDTO (Integer id,String userName,String userAccount,List<String> roles,List<String> menus,String passWord){
this.id = id;
this.userAccount = userAccount;
this.userName = userName;
this.roles = roles;
this.menus = menus;
this.passWord = passWord;
}
@Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return null;
}
public List<String> getMenus() {
return menus;
}
public void setMenus(List<String> menus) {
this.menus = menus;
}
@Override
public String getPassword() {
return passWord;
}
@Override
public String getUsername() {
return this.userAccount;
}
@Override
public boolean isAccountNonExpired() {
return true;
}
@Override
public boolean isAccountNonLocked() {
return true;
}
@Override
public boolean isCredentialsNonExpired() {
return true;
}
@Override
public boolean isEnabled() {
return true;
}
}
(3)UserDetailService
package com.demo.security.service;
import com.demo.security.constant.UserDBConstants;
import com.demo.security.dto.UserDTO;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;
import java.util.List;
import java.util.Map;
/**
* 当什么也没有配置的时候,账号和密码是由 Spring Security 定义生成的。
* 而在实际项目中账号和密码都是从数据库中查询出来的。所以我们要通过自定义逻辑控制认证逻辑,
*/
@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//模拟数据库查询
Map<String, String> userMap = UserDBConstants.getUsers();
String dbPwd = userMap.get(username);
if(StringUtils.isEmpty(dbPwd)){
throw new UsernameNotFoundException("用户不存在");
}
Map<String, List<String>> userRoles = UserDBConstants.getUserRoles();
List<String> roles = userRoles.get(username);
Map<String, List<String>> userMenus = UserDBConstants.getUserPermissions();
List<String> menus = userMenus.get(username);
UserDTO userDTO = new UserDTO(null,null,username,roles,menus,dbPwd);
return userDTO;
}
}
5、filter
(1)前端登录
package com.demo.security.filter;
import com.demo.security.constant.UserDBConstants;
import com.demo.security.dto.ResponseMsg;
import com.demo.security.dto.UserDTO;
import com.demo.security.util.JwtUtil;
import com.google.gson.Gson;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.apache.http.entity.ContentType;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.util.StringUtils;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Map;
@Slf4j
public class LoginFilter extends UsernamePasswordAuthenticationFilter {
private AuthenticationManager authenticationManager;
public LoginFilter(AuthenticationManager authenticationManager) {
//super(new AntPathRequestMatcher("/login", "POST"));
this.authenticationManager = authenticationManager;
}
/**
* /login POST接口验证
* @param req
* @param res
* @return
* @throws AuthenticationException
*/
@Override
public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {
try {
logger.info("进入LoginFilter");
String userName = req.getParameter("userName");
String passWord = req.getParameter("passWord");
if (StringUtils.isEmpty(userName)) {
throw new UsernameNotFoundException("请输入账号");
}
if (StringUtils.isEmpty(passWord)) {
throw new UsernameNotFoundException("请输入密码");
}
//验证用户名密码是否正确
Map<String, String> userMap = UserDBConstants.getUsers();
if(!userMap.keySet().contains(userName)){
throw new UsernameNotFoundException("用户不存在");
}
if(!passWord.equals(userMap.get(userName))){
throw new UsernameNotFoundException("密码错误");
}
//这里权限返回空,由后面的授权过滤器查询
return authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(userName, passWord, new ArrayList<>()));
} catch (UsernameNotFoundException e) {
//返回错误信息
res.setCharacterEncoding("UTF-8");
res.setContentType("application/text;charset=utf-8");
try {
res.getWriter().write(e.getMessage());
} catch (IOException e1) {
e1.printStackTrace();
}
return null;
}catch (Exception e){
throw new RuntimeException(e);
}
}
@Override
protected void successfulAuthentication(
HttpServletRequest request,
HttpServletResponse res,
jakarta.servlet.FilterChain chain,
Authentication authResult)
throws IOException{
UserDTO userDTO = (UserDTO) authResult.getPrincipal();
String jwtToken = JwtUtil.generateWebToken(userDTO);
//返
ResponseMsg resMsg = ResponseMsg.builder().code(200).data(jwtToken).build();
res.setContentType(ContentType.TEXT_HTML.toString());
Gson gson = new Gson();
res.getWriter().write(gson.toJson(resMsg));
}
}
(2)token验证
package com.demo.security.filter;
import com.demo.security.util.JwtUtil;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.util.StringUtils;
import java.io.IOException;
@Slf4j
public class TokenAuthenticationFilter extends BasicAuthenticationFilter {
private UserDetailsService userDetailsService;
public TokenAuthenticationFilter(AuthenticationManager authenticationManager, UserDetailsService userDetailsService) {
super(authenticationManager);
this.userDetailsService = userDetailsService;
}
@Override
protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
logger.info("登陆成功后访问,url={}"+req.getRequestURI());
String token = req.getHeader("token");
res.setCharacterEncoding("UTF-8");
res.setContentType("application/text;charset=utf-8");
//1、必填token
if(StringUtils.isEmpty(token)){
logger.info("登陆成功后访问,url={},token为空"+req.getRequestURI());
res.getWriter().write("token为空");
return;
}
//2、校验token是否合法,合法则解析出userName
//token可能是前端的,也可能是open api的
String userName = JwtUtil.getUserNameByToken(req,token);
if(StringUtils.isEmpty(userName)){
logger.info("登陆成功后访问,url={},token错误或失效"+req.getRequestURI());
res.getWriter().write("token错误或者失效");
return;
}
//3、根据userName获取user实体,存入全局
UserDetails currentUser = userDetailsService.loadUserByUsername(userName);
UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(currentUser,null,currentUser.getAuthorities());
SecurityContextHolder.getContext().setAuthentication(authentication);
chain.doFilter(req, res);
}
}
6、一些dto和常量
package com.demo.security.dto;
import lombok.Builder;
import lombok.Data;
@Data
@Builder
public class ResponseMsg {
private Object data;
private Integer code;
}
package com.demo.security.constant;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import java.util.List;
public class UrlConstants {
public static final String WEB_API_PRE = "/v1/**";
public static final String OPEN_API_PRE = "/openApi/**";
public static final List<AntPathRequestMatcher> WEB_MATCHERS = List.of(
new AntPathRequestMatcher(WEB_API_PRE));
public static final List<AntPathRequestMatcher> OPEN_API_MATCHERS =
List.of(
new AntPathRequestMatcher(OPEN_API_PRE));
}
7、JWTUtil
package com.demo.security.util;
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.Claim;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.demo.security.constant.UrlConstants;
import com.demo.security.dto.UserDTO;
import jakarta.servlet.http.HttpServletRequest;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.Optional;
@Slf4j
public class JwtUtil {
//签发方
private static final String APPLICATION_ISSUER = "jwt_demo";
//签发给
private static final String TO_WEB = "to_web";
private static final String TO_OPEN_API = "to_open_api";
//密钥
private static final String WEB_SECRET = "web-secret";
private static final String OPEN_API_SECRET = "open-api-secret";
//jwt过期事件
public static final int EXPIRE_TIME = 30 * 60 * 1000;
/**
* 生成给前端的签名
* @return 加密的token
*/
public static String generateWebToken(UserDTO userDTO) {
Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
Algorithm algorithm = Algorithm.HMAC256(WEB_SECRET);
// 附带username信息
return JWT.create()
//iss:签发方
.withIssuer(APPLICATION_ISSUER)
//aud:接收jwt的一方
.withAudience(TO_WEB)
//exp:jwt的过期时间,这个过期时间必须要大于签发时间
//.withExpiresAt()
//其他自定义通信信息
.withClaim("userName", userDTO.getUsername())
//.withClaim("age",userDTO.getAge());
.withExpiresAt(date)
.sign(algorithm);
}
/**
* open api的签名生成
* 此处是给单元测试用的,调用方项目应该自己生成
* @return 加密的token
*/
public static String generateOpenApiToken(String userName) {
Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
Algorithm algorithm = Algorithm.HMAC256(OPEN_API_SECRET);
// 附带username信息
return JWT.create()
//iss:签发方
.withIssuer(APPLICATION_ISSUER)
//aud:接收jwt的一方
.withAudience(TO_OPEN_API)
//exp:jwt的过期时间,这个过期时间必须要大于签发时间
//.withExpiresAt()
//其他自定义通信信息
.withClaim("userName", userName)
//.withClaim("age",age);
.withExpiresAt(date)
.sign(algorithm);
}
public static String getUserNameByToken(HttpServletRequest req, String token) {
DecodedJWT jwt = JWT.decode(token);
//1、是否过期
Date expireDate = jwt.getExpiresAt();
if(expireDate.before(new Date())){
log.error("token已过期");
return null;
}
//2、签发方是否正确
if(!APPLICATION_ISSUER.equals(jwt.getIssuer())){
log.error("不是本项目签发的token");
return null;
}
//3、是否合法
String audience = jwt.getAudience().get(0);
boolean check = preCheckToken(audience,token,req);
if(!check){
return null;
}
Map<String, Claim> claims = jwt.getClaims();
String userName = claims.get("userName").asString();
return userName;
}
/**
* 根据url来判断是web还是open api更准确,
* 如果只根据audience来判断,则web的token也可以访问open api;
*
* @param audience
* @param token
* @param req
* @return
*/
private static boolean preCheckToken(String audience, String token, HttpServletRequest req) {
if(TO_WEB.equals(audience) && urlMatches(req, UrlConstants.WEB_MATCHERS)){
log.info("这是前端token");
return verifyToken(WEB_SECRET,token);
}else if(TO_OPEN_API.equals(audience) && urlMatches(req,UrlConstants.OPEN_API_MATCHERS)){
log.info("这是open api token");
return verifyToken(OPEN_API_SECRET,token);
}
log.error("token来源不合法");
return false;
}
public static boolean urlMatches(HttpServletRequest request, List<AntPathRequestMatcher> matchers) {
Optional<AntPathRequestMatcher> first = matchers.stream().filter(m -> m.matches(request)).findFirst();
return first.isPresent();
}
private static boolean verifyToken(String secret, String token) {
Algorithm algorithm = Algorithm.HMAC256(secret);
try{
JWTVerifier verifier = JWT.require(algorithm).build();
verifier.verify(token);
return true;
}catch (Exception e){
log.error("token非法");
return false;
}
}
}
8、checkUtil
package com.demo.security.check;
import com.demo.security.dto.UserDTO;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import java.awt.*;
import java.util.List;
@Component("menuAuthorizationCheck")
public class MenuAuthorizationCheck {
public boolean hasMenuAuthorization(String menuCode) {
UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
List<String> menus = currentUser.getMenus();
return menus.contains(menuCode);
}
/* *//**
* open api是否有权限访问
* @param menuCode
* @return
*//*
public boolean hasOpenMenuAuthorization(String menuCode) {
UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
List<String> menus = currentUser.getMenus();
return menus.contains(menuCode);
}*/
}
9、controller
(1)前端业务接口
package com.demo.security.controller;
import com.demo.security.dto.ResponseMsg;
import com.demo.security.dto.UserDTO;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/v1/user")
@RestController
public class UserController {
@RequestMapping("/test")
public String test(){
return "这是user test";
}
@RequestMapping("/getCurrentUser")
public ResponseMsg getCurrentUser() {
UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
System.out.println("当前用户为:"+currentUser);
return ResponseMsg.builder().code(200).data(currentUser).build();
}
}
package com.demo.security.controller;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/v1/menu")
@RestController
public class MenuManageController {
@PreAuthorize("@menuAuthorizationCheck.hasMenuAuthorization('menu_manage')")
@RequestMapping("/test")
public String test(){
return "这是菜单管理";
}
}
package com.demo.security.controller;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/v1/school")
@RestController
@Slf4j
public class SchoolManageController {
@RequestMapping("/test")
public String test(){
log.info("这是学校管理controller");
return "这是学校管理";
}
}
package com.demo.security.controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/v1/role")
@RestController
public class RoleManageController {
@RequestMapping("/test")
public String test(){
return "这是角色管理";
}
}
(2)open api业务接口
package com.demo.security.openapi;
import com.demo.security.dto.ResponseMsg;
import com.demo.security.dto.UserDTO;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/openApi/user")
@RestController
public class OpenUserController {
@RequestMapping("/test")
public String test(){
return "这是open api user test";
}
@RequestMapping("/getCurrentUser")
public ResponseMsg getCurrentUser() {
UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
System.out.println("当前用户为:"+currentUser);
return ResponseMsg.builder().code(200).data(currentUser).build();
}
}
package com.demo.security.openapi;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/openApi/menu")
@RestController
public class OpenMenuController {
@PreAuthorize("@menuAuthorizationCheck.hasMenuAuthorization('menu_manage')")
@RequestMapping("/test")
public String test(){
return "这是open api菜单管理";
}
}
package com.demo.security.openapi;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RequestMapping("/openApi/school")
@RestController
@Slf4j
public class OpenSchoolController {
@RequestMapping("/test")
public String test(){
log.info("这是学校管理controller");
return "这是open api学校管理";
}
}
测试验证
(1)模拟前端调用
① 登录,访问 localhost:6666/jwtDemo/login?userName=admin&passWord=123
使用返回的token调用业务接口:
② 访问 localhost:6666/jwtDemo/v1/user/test
③ 访问localhost:6666/jwtDemo/v1/user/getCurrentUser
④ 访问localhost:6666/jwtDemo/v1/menu/test
⑤ 访问 localhost:6666/jwtDemo/v1/school/test
(2)模拟openapi调用
① 使用单元测试生成一个token
package com.demo.jwt.openapi;
import com.demo.security.JWTApplication;
import com.demo.security.util.JwtUtil;
import lombok.extern.slf4j.Slf4j;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.junit4.SpringRunner;
@SpringBootTest(classes = {JWTApplication.class}, webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@RunWith(SpringRunner.class)
@Slf4j
public class MyTest {
/**
* 模拟open api调用方生成token。
* open api应该自己生成token,双方约定好生成的算法、密钥和payload通信字段;
* 不能调用本项目(被调用方)接口生成,否则对于生成token的接口需要加白名单,会造成接口攻击和token泄露的安全问题
*
*/
@Test
public void createOpenApiToken(){
String userName = "zs";
String token = JwtUtil.generateOpenApiToken(userName);
log.info("生成token:{}",token);
}
}
使用这个token调用业务接口:
② 访问 localhost:6666/jwtDemo/openApi/user/getCurrentUser
③ 访问 localhost:6666/jwtDemo/openApi/school/test
④ 访问 localhost:6666/jwtDemo/openApi/menu/test
(3)前端使用openapi的token调用接口
都报错
(4)openapi使用前端的token调用接口
同样都报错