使用Spring Boot和JWT实现用户认证

最新推荐文章于 2025-06-16 16:13:20 发布

微赚淘客系统@聚娃科技

最新推荐文章于 2025-06-16 16:13:20 发布

阅读量683

点赞数 7

CC 4.0 BY-SA版权

本文链接：https://blog.csdn.net/qq836869520/article/details/140228124

使用Spring Boot和JWT实现用户认证

大家好，我是免费搭建查券返利机器人省钱赚佣金就用微赚淘客系统3.0的小编，也是冬天不穿秋裤，天冷也要风度的程序猿！今天我们将探讨如何利用Spring Boot和JWT（JSON Web Token）来实现强大而安全的用户认证功能。

一、什么是JWT？

JWT是一种开放标准（RFC 7519），定义了一种紧凑且自包含的方式，用于在各方之间安全地传输信息。JWT通常由三部分组成：头部（Header）、载荷（Payload）和签名（Signature）。它可以在用户和服务器之间安全地传输信息，并且由于其自包含性，可以减少服务器查询数据库的次数，提高系统性能。

二、Spring Boot集成JWT的步骤

1. 添加依赖

首先，需要在pom.xml文件中添加相关依赖：

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>

2. 创建JWT工具类

创建一个JWT工具类来处理JWT的生成、解析和验证：

package cn.juwatech.security;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import java.util.Date;

@Component
public class JwtUtils {

    @Value("${jwt.secret}")
    private String secret;

    @Value("${jwt.expiration}")
    private int expiration;

    public String generateToken(String username) {
        return Jwts.builder()
                .setSubject(username)
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + expiration * 1000))
                .signWith(SignatureAlgorithm.HS512, secret)
                .compact();
    }

    public Claims parseToken(String token) {
        return Jwts.parser()
                .setSigningKey(secret)
                .parseClaimsJws(token)
                .getBody();
    }

    public boolean validateToken(String token, String username) {
        Claims claims = parseToken(token);
        return claims.getSubject().equals(username) && !isTokenExpired(token);
    }

    private boolean isTokenExpired(String token) {
        Date expirationDate = parseToken(token).getExpiration();
        return expirationDate.before(new Date());
    }
}

在上面的例子中，我们使用了io.jsonwebtoken.Jwts类来构建JWT，使用HS512算法进行签名。JwtUtils类还包括了解析和验证JWT的方法。

3. 配置JWT属性

在application.properties或application.yml文件中配置JWT的密钥和过期时间：

jwt.secret=mySecretKey
jwt.expiration=3600

4. 实现认证逻辑

在Spring Boot中实现用户认证的逻辑，例如使用Spring Security来保护API并验证JWT：

package cn.juwatech.security;

import cn.juwatech.model.User;
import cn.juwatech.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private JwtUtils jwtUtils;

    @Autowired
    private UserService userService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @PostMapping("/login")
    public ApiResponse login(@RequestBody LoginRequest loginRequest) {
        Authentication authentication = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword()));

        SecurityContextHolder.getContext().setAuthentication(authentication);

        String jwt = jwtUtils.generateToken(loginRequest.getUsername());
        return new ApiResponse(HttpStatus.OK.value(), "Login successful", jwt);
    }

    @PostMapping("/register")
    public ApiResponse register(@RequestBody User user) {
        if (userService.existsByUsername(user.getUsername())) {
            return new ApiResponse(HttpStatus.BAD_REQUEST.value(), "Username is already taken", null);
        }

        user.setPassword(passwordEncoder.encode(user.getPassword()));
        userService.save(user);

        return new ApiResponse(HttpStatus.CREATED.value(), "User registered successfully", null);
    }
}

在上述代码中，我们使用了Spring Security的AuthenticationManager来进行用户认证，验证用户名和密码后生成JWT并返回给客户端。AuthController还包括了用户注册的功能。

5. 使用JWT保护API

可以通过添加Spring Security配置来保护API，并验证JWT：

package cn.juwatech.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtRequestFilter jwtRequestFilter;

    @Autowired
    private CustomUserDetailsService customUserDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/api/auth/**").permitAll()
                .antMatchers(HttpMethod.GET, "/api/public/**").permitAll()
                .anyRequest().authenticated();

        http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}