深度解析Java视角下Cookie、Session、Token实战教程

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
@WebServlet("/cookieDemo")
public class CookieDemoServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        PrintWriter out = response.getWriter();
        // 1. 读取客户端携带的Cookie
        Cookie[] cookies = request.getCookies();
        if (cookies != null) {
            out.write("客户端携带的Cookie：
");
            for (Cookie cookie : cookies) {
                // 获取Cookie的名称和值
                String name = cookie.getName();
                String value = cookie.getValue();
                out.write("名称：" + name + "，值：" + value + "
");
            }
        } else {
            out.write("客户端首次访问，未携带Cookie
");
        }
        // 2. 创建Cookie并写入客户端
        Cookie userCookie = new Cookie("username", "zhangsan");
        // 设置Cookie的过期时间：单位为秒，正数表示持久化到磁盘，负数表示仅存于内存（会话结束后销毁），0表示立即删除
        userCookie.setMaxAge(3600);
        // 设置Cookie的有效路径：仅当请求路径匹配该路径时，才携带此Cookie
        userCookie.setPath("/");
        // 设置Cookie的有效域名：指定哪些域名可以访问该Cookie，防止跨域盗用
        userCookie.setDomain("localhost");
        // 设置Cookie为HttpOnly：禁止JavaScript读取，防止XSS攻击
        userCookie.setHttpOnly(true);
        // 设置Cookie为Secure：仅在HTTPS协议下才携带此Cookie
        // userCookie.setSecure(true);
        // 将Cookie写入响应
        response.addCookie(userCookie);
        // 3. 销毁Cookie（通过设置maxAge为0实现）
        Cookie deleteCookie = new Cookie("oldCookie", "");
        deleteCookie.setMaxAge(0);
        deleteCookie.setPath("/");
        response.addCookie(deleteCookie);
        out.close();
    }
}
    

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.Date;
@WebServlet("/sessionDemo")
public class SessionDemoServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        response.setContentType("text/html;charset=UTF-8");
        PrintWriter out = response.getWriter();
        // 1. 获取Session（若不存在则创建新Session）
        HttpSession session = request.getSession();
        // 获取Session ID
        String sessionId = session.getId();
        out.write("Session ID：" + sessionId + "
");
        // 获取Session创建时间
        Date createTime = new Date(session.getCreationTime());
        out.write("Session创建时间：" + createTime + "
");
        // 获取最后访问时间
        Date lastAccessTime = new Date(session.getLastAccessedTime());
        out.write("最后访问时间：" + lastAccessTime + "
");
        // 2. 向Session中存储数据（支持任意Java对象）
        session.setAttribute("user", new User("zhangsan", 20));
        session.setAttribute("isLogin", true);
        // 3. 从Session中读取数据
        User user = (User) session.getAttribute("user");
        boolean isLogin = (boolean) session.getAttribute("isLogin");
        out.write("当前登录用户：" + user.getName() + "，年龄：" + user.getAge() + "
");
        out.write("登录状态：" + (isLogin ? "已登录" : "未登录") + "
");
        // 4. 设置Session的过期时间（单位：秒）
        // 方式1：通过API设置（优先级高于web.xml配置）
        session.setMaxInactiveInterval(1800); // 30分钟无操作过期
        // 方式2：在web.xml中配置（全局生效）
        /*
        <session-config>
            <session-timeout>30</session-timeout>  <!-- 单位：分钟 -->
        </session-config>
        */
        // 5. 手动销毁Session（用于退出登录）
        // session.invalidate();
        // 6. URL重写（Cookie禁用时使用）
        String url1 = response.encodeURL("/test");
        String url2 = response.encodeRedirectURL("/test");
        out.write("重写后的URL：" + url1 + "
");
        out.close();
    }
    // 自定义User类（需实现Serializable接口，支持Session钝化/活化）
    static class User implements java.io.Serializable {
        private String name;
        private int age;
        public User(String name, int age) {
            this.name = name;
            this.age = age;
        }
        // getter/setter
        public String getName() { return name; }
        public int getAge() { return age; }
    }
}
    

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

/**
 * JWT工具类
 */
public class JwtUtil {
    //有效期为
    public static final Long JWT_TTL = 60 * 60 *1000L;// 60 * 60 *1000  一个小时
    //设置秘钥明文
    public static final String JWT_KEY = "qcby";
    /**
     * 创建token
     * @param id  //用户id
     * @param subject  // 用户名
     * @param ttlMillis // 有效期
     * @return
     */
    public static String createJWT(String id, String subject, Long ttlMillis) {
        SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
        long nowMillis = System.currentTimeMillis();
        Date now = new Date(nowMillis);
        if(ttlMillis==null){
            ttlMillis=JwtUtil.JWT_TTL;
        }
        //签名时间
        long expMillis = nowMillis + ttlMillis;
        Date expDate = new Date(expMillis);
        SecretKey secretKey = generalKey();
        JwtBuilder builder = Jwts.builder()
                .setId(id)              //唯一的ID
                .setSubject(subject)   // 主题  可以是JSON数据
                .setIssuer("wd")     // 签发者
                .setIssuedAt(now)      // 签发时间
                .signWith(signatureAlgorithm, secretKey) //使用HS256对称加密算法签名, 第二个参数为秘钥
                .setExpiration(expDate);// 设置过期时间
        return builder.compact();
    }
    /**
     * 生成加密后的秘钥 secretKey
     * @return
     */
    public static SecretKey generalKey() {
        byte[] encodedKey = Base64.getDecoder().decode(JwtUtil.JWT_KEY);
        SecretKey key = new SecretKeySpec(encodedKey, 0, encodedKey.length, "AES");
        return key;
    }
    /**
     * 解析
     *
     * @param jwt
     * @return
     * @throws Exception
     */
    public static Claims parseJWT(String jwt) throws Exception {
        SecretKey secretKey = generalKey();
        return Jwts.parser()
                .setSigningKey(secretKey)
                .parseClaimsJws(jwt)
                .getBody();
    }
    public static void main(String[] args) {
        String token = JwtUtil.createJWT(UUID.randomUUID().toString(),"qd",null );
        System.out.println(token);
    }
}