https://cloud.tencent.com/developer/article/1699801

前言

轻松上手SpringBoot Security JWT Hello World示例 - 图1
在本教程中，我们将开发一个Spring Boot应用程序，该应用程序使用JWT身份验证来保护公开的REST API。在此示例中，我们将使用硬编码的用户和密码进行用户身份验证。
在下一个教程中，我们将实现Spring Boot + JWT + MySQL JPA,用于存储和获取用户凭证。任何用户只有拥有有效的JSON Web Token(JWT)才能使用此API。在之前的教程中，我们学习了《什么是JWT?》 以及何时并如何使用它。
为了更好地理解，我们将分阶段开发此项目:

  1. 开发一个Spring Boot应用程序，该应用程序使用/hello路径地址公开一个简单的GET RESTAPI。
  2. 为JWT配置Spring Security, 暴露路径地址/authenticate POST RESTAPI。使用该映射，用户将获得有效的JSON Web Token。然后，仅在具有有效令牌的情况下，才允许用户访问API /hello。

轻松上手SpringBoot Security JWT Hello World示例 - 图2

搭建SpringBoot应用程序

目录结构

轻松上手SpringBoot Security JWT Hello World示例 - 图3 

  1. Pom.xml
  2. <dependencies>
  3.         <dependency>
  4.             <groupId>org.springframework.boot</groupId>
  5.             <artifactId>spring-boot-starter-web</artifactId>
  6.         </dependency>
  7. </dependencies>
  1. HelloWorld API
  2. package iot.technology.jwt.without.controller;import org.springframework.web.bind.annotation.CrossOrigin;
  3. import org.springframework.web.bind.annotation.RequestMapping;
  4. import org.springframework.web.bind.annotation.RestController;/**
  5.  * @author james mu
  6.  * @date 2020/9/7 19:18
  7.  */
  8. @RestController
  9. @CrossOrigin
  10. public class HelloWorldController {    @RequestMapping({ "/hello" })
  11.     public String hello() {
  12.         return "Hello World";  
  13.     }}

  1. 创建bootstrap引导类
  2. package iot.technology.jwt.without;import org.springframework.boot.SpringApplication;
  3. import org.springframework.boot.autoconfigure.SpringBootApplication;/**
  4.  * @author james mu
  5.  * @date 2020/9/7 17:59
  6.  */
  7. @SpringBootApplication(scanBasePackages = {"iot.technology.jwt.without"})
  8. public class JwtWithoutJpaApplication {    public static void main(String[] args) {
  9.         SpringApplication.run(JwtWithoutJpaApplication.class, args);
  10.     }


}

编译并将JwtWithoutJpaApplication.java作为Java应用程序运行。在网页输入localhost:8080/hello。
轻松上手SpringBoot Security JWT Hello World示例 - 图4

Spring Security和JWT配置

我们将配置Spring Security和JWT来执行两个操作

  • 生成JWT—-暴露/authenticate接口。传递正确的用户名和密码后，它将生成一个JSON Web Token(JWT)。
  • 验证JWT—-如果用户尝试使用接口/hello，仅当请求具有有效的JSON Web Token(JWT)，它才允许访问。

    目录结构

    轻松上手SpringBoot Security JWT Hello World示例 - 图5

    生成JWT时序图

    轻松上手SpringBoot Security JWT Hello World示例 - 图6
    轻松上手SpringBoot Security JWT Hello World示例 - 图7

    验证JWT时序图

    轻松上手SpringBoot Security JWT Hello World示例 - 图8
    1. 添加Spring Security和JWT依赖项
    2. <dependency>
    3.   <groupId>org.springframework.boot</groupId>
    4.   <artifactId>spring-boot-starter-web</artifactId>
    5. </dependency>
    6. <dependency>
    7.   <groupId>org.springframework.boot</groupId>
    8.   <artifactId>spring-boot-starter-security</artifactId>
    9. </dependency>
    10. <dependency>
    11.   <groupId>io.jsonwebtoken</groupId>
    12.   <artifactId>jjwt</artifactId>
    13. </dependency>



    定义application.properties。正如在先前的JWT教程中所见，我们指定了用于哈希算法的密钥。密钥与标头和有效载荷结合在一起以创建唯一的哈希。如果您拥有密钥，我们只能验证此哈希。
    jwt.secret=iot.technology

代码剖析

  1. JwtTokenUtil
  2. package iot.technology.jwt.without.config;import io.jsonwebtoken.Claims;
  3. import io.jsonwebtoken.Jwts;
  4. import io.jsonwebtoken.SignatureAlgorithm;
  5. import org.springframework.beans.factory.annotation.Value;
  6. import org.springframework.security.core.userdetails.UserDetails;
  7. import org.springframework.stereotype.Component;import java.io.Serializable;
  8. import java.util.Date;
  9. import java.util.HashMap;
  10. import java.util.Map;
  11. import java.util.function.Function;/**
  12.  * @author james mu
  13.  * @date 2020/9/7 19:12
  14.  */
  15. @Component
  16. public class JwtTokenUtil implements Serializable {    private static final long serialVersionUID = -2550185165626007488L;    public static final long JWT_TOKEN_VALIDITY = 5*60*60;    @Value("${jwt.secret}")
  17.     private String secret;    public String getUsernameFromToken(String token) {
  18.         return getClaimFromToken(token, Claims::getSubject);
  19.     }    public Date getIssuedAtDateFromToken(String token) {
  20.         return getClaimFromToken(token, Claims::getIssuedAt);
  21.     }    public Date getExpirationDateFromToken(String token) {
  22.         return getClaimFromToken(token, Claims::getExpiration);
  23.     }    public <T> T getClaimFromToken(String token, Function<Claims, T> claimsResolver) {
  24.         final Claims claims = getAllClaimsFromToken(token);
  25.         return claimsResolver.apply(claims);
  26.     }    private Claims getAllClaimsFromToken(String token) {
  27.         return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
  28.     }    private Boolean isTokenExpired(String token) {
  29.         final Date expiration = getExpirationDateFromToken(token);
  30.         return expiration.before(new Date());
  31.     }    private Boolean ignoreTokenExpiration(String token) {
  32.         // here you specify tokens, for that the expiration is ignored
  33.         return false;
  34.     }    public String generateToken(UserDetails userDetails) {
  35.         Map<String, Object> claims = new HashMap<>();
  36.         return doGenerateToken(claims, userDetails.getUsername());
  37.     }    private String doGenerateToken(Map<String, Object> claims, String subject) {        return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(new Date(System.currentTimeMillis()))
  38.                 .setExpiration(new Date(System.currentTimeMillis() + JWT_TOKEN_VALIDITY*1000)).signWith(SignatureAlgorithm.HS512, secret).compact();
  39.     }    public Boolean canTokenBeRefreshed(String token) {
  40.         return (!isTokenExpired(token) || ignoreTokenExpiration(token));
  41.     }    public Boolean validateToken(String token, UserDetails userDetails) {
  42.         final String username = getUsernameFromToken(token);
  43.         return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));


}}

JWTUserDetailsService

JWTUserDetailsService实现了Spring Security UserDetailsService接口。它会覆盖loadUserByUsername,以便使用用户名从数据库中获取用户详细信息。当对用户提供的用户详细信息进行身份验证时，Spring Security Authentication Manager调用此方法从数据库中获取用户详细信息。在这里，我们从硬编码的用户列表中获取用户详细信息。在接下来的教程中，我们将增加从数据库中获取用户详细信息的DAO实现。用户密码也使用BCrypt以加密格式存储。在这里，您可以使用在线Bcrypt生成器为密码生成Bcrypt。

  1. package iot.technology.jwt.without.service;import org.springframework.security.core.userdetails.User;
  2. import org.springframework.security.core.userdetails.UserDetails;
  3. import org.springframework.security.core.userdetails.UserDetailsService;
  4. import org.springframework.security.core.userdetails.UsernameNotFoundException;
  5. import org.springframework.stereotype.Service;import java.util.ArrayList;/**
  6.  * @author james mu
  7.  * @date 2020/9/7 18:16
  8.  */
  9. @Service
  10. public class JwtUserDetailsService implements UserDetailsService {    @Override
  11.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
  12.         if ("iot.technology".equals(username)) {
  13.             return new User("iot.technology", "$2a$10$slYQmyNdGzTn7ZLBXBChFOC9f6kFjAqPhccnP6DxlWXx2lPk1C3G6",
  14.                     new ArrayList<>());
  15.         } else {
  16.             throw new UsernameNotFoundException("User not found with username: " + username);
  17.         }
  18.     }
  19. }

JWTAuthenticationController

使用JwtAuthenticationController暴露/authenticate。使用Spring Authentication Manager验证用户名和密码。如果凭据有效，则会使用JWTTokenUtil创建一个JWT令牌并将其提供给客户端。

  1. package iot.technology.jwt.without.controller;import iot.technology.jwt.without.config.JwtTokenUtil;
  2. import iot.technology.jwt.without.model.JwtRequest;
  3. import iot.technology.jwt.without.model.JwtResponse;
  4. import org.springframework.http.ResponseEntity;
  5. import org.springframework.security.authentication.AuthenticationManager;
  6. import org.springframework.security.authentication.BadCredentialsException;
  7. import org.springframework.security.authentication.DisabledException;
  8. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  9. import org.springframework.security.core.userdetails.UserDetails;
  10. import org.springframework.security.core.userdetails.UserDetailsService;
  11. import org.springframework.web.bind.annotation.*;import java.util.Objects;/**
  12.  * @author james mu
  13.  * @date 2020/9/7 19:19
  14.  */
  15. @RestController
  16. @CrossOrigin
  17. public class JwtAuthenticationController {    private final AuthenticationManager authenticationManager;
  18.     private final JwtTokenUtil jwtTokenUtil;
  19.     private final UserDetailsService jwtInMemoryUserDetailsService;    public JwtAuthenticationController(AuthenticationManager authenticationManager,
  20.                                        JwtTokenUtil jwtTokenUtil,
  21.                                        UserDetailsService jwtInMemoryUserDetailsService) {
  22.         this.authenticationManager = authenticationManager;
  23.         this.jwtTokenUtil = jwtTokenUtil;
  24.         this.jwtInMemoryUserDetailsService = jwtInMemoryUserDetailsService;
  25.     }    @RequestMapping(value = "/authenticate", method = RequestMethod.POST)
  26.     public ResponseEntity<?> createAuthenticationToken(@RequestBody JwtRequest authenticationRequest)
  27.             throws Exception {        authenticate(authenticationRequest.getUsername(), authenticationRequest.getPassword());        final UserDetails userDetails = jwtInMemoryUserDetailsService
  28.                 .loadUserByUsername(authenticationRequest.getUsername());        final String token = jwtTokenUtil.generateToken(userDetails);        return ResponseEntity.ok(new JwtResponse(token));
  29.     }    private void authenticate(String username, String password) throws Exception {
  30.         Objects.requireNonNull(username);
  31.         Objects.requireNonNull(password);        try {
  32.             authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
  33.         } catch (DisabledException e) {
  34.             throw new Exception("USER_DISABLED", e);
  35.         } catch (BadCredentialsException e) {
  36.             throw new Exception("INVALID_CREDENTIALS", e);
  37.         }
  38.     }
  39. }

JwtRequest

JwtRequest是存储我们从客户端收到的用户名和密码所必须的类。

  1. package iot.technology.jwt.without.model;import java.io.Serializable;/**
  2.  * @author james mu
  3.  * @date 2020/9/7 18:30
  4.  */
  5. public class JwtRequest implements Serializable {    private static final long serialVersionUID = 5926468583005150707L;    private String username;
  6.     private String password;    //need default constructor for JSON Parsing
  7.     public JwtRequest()
  8.     {    }    public JwtRequest(String username, String password) {
  9.         this.setUsername(username);
  10.         this.setPassword(password);
  11.     }    public String getUsername() {
  12.         return this.username;
  13.     }    public void setUsername(String username) {
  14.         this.username = username;
  15.     }    public String getPassword() {
  16.         return this.password;
  17.     }    public void setPassword(String password) {
  18.         this.password = password;
  19.     }
  20. }

JwtResponse

这是创建包含要返回给用户的JWT响应所必须的类。

  1. package iot.technology.jwt.without.model;import java.io.Serializable;/**
  2.  * @author james mu
  3.  * @date 2020/9/7 19:11
  4.  */
  5. public class JwtResponse implements Serializable {
  6.     private static final long serialVersionUID = -8091879091924046844L;
  7.     private final String jwttoken;    public JwtResponse(String jwttoken) {
  8.         this.jwttoken = jwttoken;
  9.     }    public String getToken() {
  10.         return this.jwttoken;
  11.     }
  12. }

JwtRequestFilter

JwtRequestFilter继承了Spring Web的OncePerRequestFilter类。对于任何传入请求，都会执行此Filter类。它检查请求是否具有有效的JWT令牌。如果它具有有效的JWT令牌，则它将在上下文中设置Authentication，以指定当前用户已通过身份验证。

  1. package iot.technology.jwt.without.config;import io.jsonwebtoken.ExpiredJwtException;
  2. import iot.technology.jwt.without.service.JwtUserDetailsService;
  3. import lombok.extern.slf4j.Slf4j;
  4. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
  5. import org.springframework.security.core.context.SecurityContextHolder;
  6. import org.springframework.security.core.userdetails.UserDetails;
  7. import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
  8. import org.springframework.stereotype.Component;
  9. import org.springframework.web.filter.OncePerRequestFilter;import javax.servlet.FilterChain;
  10. import javax.servlet.ServletException;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import java.io.IOException;/**
  14.  * @author james mu
  15.  * @date 2020/9/7 19:14
  16.  */
  17. @Slf4j
  18. @Component
  19. public class JwtRequestFilter extends OncePerRequestFilter {    private final JwtUserDetailsService jwtUserDetailsService;
  20.     private final JwtTokenUtil jwtTokenUtil;    public JwtRequestFilter(JwtUserDetailsService jwtUserDetailsService, JwtTokenUtil jwtTokenUtil) {
  21.         this.jwtTokenUtil = jwtTokenUtil;
  22.         this.jwtUserDetailsService = jwtUserDetailsService;
  23.     }    @Override
  24.     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
  25.             throws ServletException, IOException {        final String requestTokenHeader = request.getHeader("Authorization");        String username = null;
  26.         String jwtToken = null;
  27.         // JWT Token is in the form "Bearer token". Remove Bearer word and get only the Token
  28.         if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")) {
  29.             jwtToken = requestTokenHeader.substring(7);
  30.             try {
  31.                 username = jwtTokenUtil.getUsernameFromToken(jwtToken);
  32.             } catch (IllegalArgumentException e) {
  33.                 log.error("Unable to get JWT Token");
  34.             } catch (ExpiredJwtException e) {
  35.                 log.error("JWT Token has expired");
  36.             }
  37.         } else {
  38.             logger.warn("JWT Token does not begin with Bearer String");
  39.         }        //Once we get the token validate it.
  40.         if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {            UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);            // if token is valid configure Spring Security to manually set authentication
  41.             if (jwtTokenUtil.validateToken(jwtToken, userDetails)) {                UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
  42.                         userDetails, null, userDetails.getAuthorities());
  43.                 usernamePasswordAuthenticationToken
  44.                         .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
  45.                 // After setting the Authentication in the context, we specify
  46.                 // that the current user is authenticated. So it passes the Spring Security Configurations successfully.
  47.                 SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
  48.             }
  49.         }
  50.         chain.doFilter(request, response);
  51.     }
  52. }

JwtAuthenticationEntryPoint

此类继承Spring Security的AuthenticationEntryPoint类，并重写其commence。它拒绝每个未经身份验证的请求并发送错误代码401。

  1. package iot.technology.jwt.without.config;import org.springframework.security.core.AuthenticationException;
  2. import org.springframework.security.web.AuthenticationEntryPoint;
  3. import org.springframework.stereotype.Component;import javax.servlet.http.HttpServletRequest;
  4. import javax.servlet.http.HttpServletResponse;
  5. import java.io.IOException;
  6. import java.io.Serializable;/**
  7.  * @author james mu
  8.  * @date 2020/9/7 19:17
  9.  */
  10. @Component
  11. public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable {    private static final long serialVersionUID = -7858869558953243875L;    @Override
  12.     public void commence(HttpServletRequest request, HttpServletResponse response,
  13.                          AuthenticationException authException) throws IOException {        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
  14.     }
  15. }

WebSecurityConfig

此类扩展了WebSecurityConfigurerAdapter,它为WebSecurity和HttpSecurity进行自定义提供了便捷性。

  1. package iot.technology.jwt.without.config;import org.springframework.beans.factory.annotation.Autowired;
  2. import org.springframework.context.annotation.Bean;
  3. import org.springframework.context.annotation.Configuration;
  4. import org.springframework.security.authentication.AuthenticationManager;
  5. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  6. import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  7. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  8. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  9. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  10. import org.springframework.security.config.http.SessionCreationPolicy;
  11. import org.springframework.security.core.userdetails.UserDetailsService;
  12. import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  13. import org.springframework.security.crypto.password.PasswordEncoder;
  14. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;/**
  15.  * @author james mu
  16.  * @date 2020/9/7 19:16
  17.  */
  18. @Configuration
  19. @EnableWebSecurity
  20. @EnableGlobalMethodSecurity(prePostEnabled = true)
  21. public class WebSecurityConfig extends WebSecurityConfigurerAdapter {    private final JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
  22.     private final UserDetailsService jwtUserDetailsService;
  23.     private final JwtRequestFilter jwtRequestFilter;    public WebSecurityConfig(JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint,
  24.                              UserDetailsService jwtUserDetailsService,
  25.                              JwtRequestFilter jwtRequestFilter) {
  26.         this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
  27.         this.jwtUserDetailsService = jwtUserDetailsService;
  28.         this.jwtRequestFilter = jwtRequestFilter;
  29.     }    @Autowired
  30.     public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  31.         // configure AuthenticationManager so that it knows from where to load
  32.         // user for matching credentials
  33.         // Use BCryptPasswordEncoder
  34.         auth.userDetailsService(jwtUserDetailsService).passwordEncoder(passwordEncoder());
  35.     }    @Bean
  36.     public PasswordEncoder passwordEncoder() {
  37.         return new BCryptPasswordEncoder();
  38.     }    @Bean
  39.     @Override
  40.     public AuthenticationManager authenticationManagerBean() throws Exception {
  41.         return super.authenticationManagerBean();
  42.     }    @Override
  43.     protected void configure(HttpSecurity httpSecurity) throws Exception {
  44.         // We don't need CSRF for this example
  45.         httpSecurity.csrf().disable()
  46.                 // dont authenticate this particular request
  47.                 .authorizeRequests().antMatchers("/authenticate").permitAll().
  48.                 // all other requests need to be authenticated
  49.                         anyRequest().authenticated().and().
  50.                 // make sure we use stateless session; session won't be used to
  51.                 // store user's state.
  52.                         exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement()
  53.                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS);        // Add a filter to validate the tokens with every request
  54.         httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
  55.     }
  56. }

代码演示

  • 启动Spring Boot应用程序
  • 生成JSON Web Token(JWT)
  • 使用Url localhost:8080/authenticate创建POST请求。正文应具有有效的用户名和密码。在我们的情况下，用户名是: iot.technology, 密码是: password。轻松上手SpringBoot Security JWT Hello World示例 - 图9
  • 验证JSON Web Token(JWT)
  • 尝试使用上述生成的令牌访问Url localhost:8080/hello,如下所示轻松上手SpringBoot Security JWT Hello World示例 - 图10

项目源代码:

https://github.com/IoT-Technology/IOT-Technical-Guide/tree/master/IOT-Guide-JWT-Without-JPA