SpringBoot使用Jwt处理跨域认证问题的教程详解

<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt</artifactId>
  <version>0.9.1</version>
</dependency>

public class JwtUtils {

  //发行者
  public static final String SUBJECT="raychen";
  //过期时间 一天
  public static final long EXPIRE=1000*60*60*24;
  //密钥
  public static final String APPSECRET="raychen11";

  /**
   * 生成jwt
   * @param user
   * @return
   */
  public static String geneJsonWebToken(User user){
    if(user==null || user.getId()==null || user.getName()==null || user.getPassword()==null){
      return null;
    }
    String token=Jwts.builder().setSubject(SUBJECT)
        .claim("id",user.getId())
        .claim("name",user.getName())
        .claim("password",user.getPassword())
        .setIssuedAt(new Date())
        .setExpiration(new Date(System.currentTimeMillis()+EXPIRE))
        .signWith(SignatureAlgorithm.HS256,APPSECRET).compact();

    return token;
  }

  /**
   * 校验token
   * @param token
   * @return
   */
  public static Claims checkJWT(String token){
    //仿造的token或者已过期就会报错
    try {
      final Claims claims=Jwts.parser().setSigningKey(APPSECRET).parseClaimsJws(token).getBody();
      return claims;
    }catch (Exception e){
      System.out.println("catch...");
    }
    return null;
  }
}

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface CheckToken {
  boolean required() default true;
}

@Configuration
public class InterceptorConfig implements WebMvcConfigurer {


  @Override
  public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(authenticationInterceptor())
        .addPathPatterns("/**");  // 拦截所有请求，通过判断是否有 @LoginRequired 注解 决定是否需要登录
  }

  @Bean
  public AuthenticationInterceptor authenticationInterceptor() {
    return new AuthenticationInterceptor();
  }
}

public class AuthenticationInterceptor implements HandlerInterceptor {

  public static final Gson gson=new Gson();
  /**
   * 进入controller之前进行拦截
   * @param request
   * @param response
   * @param object
   * @return
   */
  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object object) throws Exception {
    // 如果不是映射到方法直接通过
    if (!(object instanceof HandlerMethod)) {
      return true;
    }

    HandlerMethod handlerMethod = (HandlerMethod) object;
    Method method = handlerMethod.getMethod();
    //检查是否有LoginToken注释，有则跳过认证
    if (method.isAnnotationPresent(LoginToken.class)) {
      LoginToken loginToken = method.getAnnotation(LoginToken.class);
      if (loginToken.required()) {
        return true;
      }
    }

    //前面是不需要token验证的 从 http 请求头中取出 token
    String token = request.getHeader("token");
    //检查有没有需要用户权限的注解
    if (method.isAnnotationPresent(CheckToken.class)) {
      CheckToken checkToken = method.getAnnotation(CheckToken.class);
      if (checkToken.required()) {
        if(token!=null){
          Claims claims= JwtUtils.checkJWT(token);
          if(null==claims){
            sendJsonMessage(response, JsonData.buildError("token有误"));
            return false;
          }
          Integer userId= (Integer) claims.get("id");
          String name = (String) claims.get("name");

          request.setAttribute("userId",userId);
          request.setAttribute("name",name);
          return true;
        }
        //token为null的话 返回一段json给前端
        sendJsonMessage(response, JsonData.buildError("请登录"));
        return false;
      }
    }
    //没有使用注解的方法 直接返回true
    return true;
  }

    /**
     * 响应数据给前端
     * @param response
     * @param obj
     * @throws IOException
     */
    public static void sendJsonMessage (HttpServletResponse response, Object obj) throws IOException {
      response.setContentType("application/json; charset=utf-8");
      PrintWriter writer = response.getWriter();
      writer.print(gson.toJson(obj));
      writer.close();
      response.flushBuffer();
    }
}