SpringBoot+Spring Security+JWT实现RESTful Api权限控制的方法

<dependency>

    <groupid>org.springframework.boot</groupid>

    <artifactid>spring-boot-starter</artifactid>

   </dependency>

   <dependency>

    <groupid>org.springframework.boot</groupid>

    <artifactid>spring-boot-starter-test</artifactid>

    <scope>test</scope>

   </dependency>

   <dependency>

    <groupid>org.springframework.boot</groupid>

    <artifactid>spring-boot-starter-web</artifactid>

   </dependency>

   <!-- spring-data-jpa -->

   <dependency>

    <groupid>org.springframework.boot</groupid>

    <artifactid>spring-boot-starter-data-jpa</artifactid>

   </dependency>

   <!-- mysql -->

   <dependency>

    <groupid>mysql</groupid>

    <artifactid>mysql-connector-java</artifactid>

    <version> 5.1 . 30 </version>

   </dependency>

   <!-- spring-security 和 jwt -->

   <dependency>

    <groupid>org.springframework.boot</groupid>

    <artifactid>spring-boot-starter-security</artifactid>

   </dependency>

   <dependency>

    <groupid>io.jsonwebtoken</groupid>

    <artifactid>jjwt</artifactid>

    <version> 0.7 . 0 </version>

   </dependency>

@requestmapping ( "/hello" )

  @responsebody

  public string hello(){

   return "hello" ;

  }

package boss.portal.entity;

import javax.persistence.*;

/**

  * @author zhaoxinguo on 2017/9/13.

  */

@entity

@table (name = "tb_user" )

public class user {

  @id

  @generatedvalue

  private long id;

  private string username;

  private string password;

  public long getid() {

   return id;

  }

  public string getusername() {

   return username;

  }

  public void setusername(string username) {

   this .username = username;

  }

  public string getpassword() {

   return password;

  }

  public void setpassword(string password) {

   this .password = password;

  }

}

package boss.portal.repository;

import boss.portal.entity.user;

import org.springframework.data.jpa.repository.jparepository;

/**

  * @author zhaoxinguo on 2017/9/13.

  */

public interface userrepository extends jparepository<user, long > {

  user findbyusername(string username);

}

/**

   * 该方法是注册用户的方法，默认放开访问控制

   * @param user

   */

  @postmapping ( "/signup" )

  public void signup( @requestbody user user) {

   user.setpassword(bcryptpasswordencoder.encode(user.getpassword()));

   applicationuserrepository.save(user);

  }

package boss.portal;

import org.springframework.boot.springapplication;

import org.springframework.boot.autoconfigure.springbootapplication;

import org.springframework.context.annotation.bean;

import org.springframework.security.crypto.bcrypt.bcryptpasswordencoder;

@springbootapplication

public class jwtauthapplication {

     @bean

     public bcryptpasswordencoder bcryptpasswordencoder() {

         return new bcryptpasswordencoder();

     }

     public static void main(string[] args) {

         springapplication.run(jwtauthapplication. class , args);

     }

}

package boss.portal.web.filter;

import boss.portal.entity.user;

import com.fasterxml.jackson.databind.objectmapper;

import io.jsonwebtoken.jwts;

import io.jsonwebtoken.signaturealgorithm;

import org.springframework.security.authentication.authenticationmanager;

import org.springframework.security.authentication.usernamepasswordauthenticationtoken;

import org.springframework.security.core.authentication;

import org.springframework.security.core.authenticationexception;

import org.springframework.security.web.authentication.usernamepasswordauthenticationfilter;

import javax.servlet.filterchain;

import javax.servlet.servletexception;

import javax.servlet.http.httpservletrequest;

import javax.servlet.http.httpservletresponse;

import java.io.ioexception;

import java.util.arraylist;

import java.util.date;

/**

  * 验证用户名密码正确后，生成一个token，并将token返回给客户端

  * 该类继承自usernamepasswordauthenticationfilter，重写了其中的2个方法

  * attemptauthentication ：接收并解析用户凭证。

  * successfulauthentication ：用户成功登录后，这个方法会被调用，我们在这个方法里生成token。

  * @author zhaoxinguo on 2017/9/12.

  */

public class jwtloginfilter extends usernamepasswordauthenticationfilter {

  private authenticationmanager authenticationmanager;

  public jwtloginfilter(authenticationmanager authenticationmanager) {

   this .authenticationmanager = authenticationmanager;

  }

  // 接收并解析用户凭证

  @override

  public authentication attemptauthentication(httpservletrequest req,

             httpservletresponse res) throws authenticationexception {

   try {

    user user = new objectmapper()

      .readvalue(req.getinputstream(), user. class );

    return authenticationmanager.authenticate(

      new usernamepasswordauthenticationtoken(

        user.getusername(),

        user.getpassword(),

        new arraylist<>())

    );

   } catch (ioexception e) {

    throw new runtimeexception(e);

   }

  }

  // 用户成功登录后，这个方法会被调用，我们在这个方法里生成token

  @override

  protected void successfulauthentication(httpservletrequest req,

            httpservletresponse res,

            filterchain chain,

            authentication auth) throws ioexception, servletexception {

   string token = jwts.builder()

     .setsubject(((org.springframework.security.core.userdetails.user) auth.getprincipal()).getusername())

     .setexpiration( new date(system.currenttimemillis() + 60 * 60 * 24 * 1000 ))

     .signwith(signaturealgorithm.hs512, "myjwtsecret" )

     测试数据pact();

   res.addheader( "authorization" , "bearer " + token);

  }

}

package boss.portal.web.filter;

import io.jsonwebtoken.jwts;

import org.springframework.security.authentication.authenticationmanager;

import org.springframework.security.authentication.usernamepasswordauthenticationtoken;

import org.springframework.security.core.context.securitycontextholder;

import org.springframework.security.web.authentication.HdhCmsTestbasicauthenticationfilter;

import javax.servlet.filterchain;

import javax.servlet.servletexception;

import javax.servlet.http.httpservletrequest;

import javax.servlet.http.httpservletresponse;

import java.io.ioexception;

import java.util.arraylist;

/**

  * token的校验

  * 该类继承自basicauthenticationfilter，在dofilterinternal方法中，

  * 从http头的authorization 项读取token数据，然后用jwts包提供的方法校验token的合法性。

  * 如果校验通过，就认为这是一个取得授权的合法请求

  * @author zhaoxinguo on 2017/9/13.

  */

public class jwtauthenticationfilter extends basicauthenticationfilter {

  public jwtauthenticationfilter(authenticationmanager authenticationmanager) {

   super (authenticationmanager);

  }

  @override

  protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain chain) throws ioexception, servletexception {

   string header = request.getheader( "authorization" );

   if (header == null || !header.startswith( "bearer " )) {

    chain.dofilter(request, response);

    return ;

   }

   usernamepasswordauthenticationtoken authentication = getauthentication(request);

   securitycontextholder.getcontext().setauthentication(authentication);

   chain.dofilter(request, response);

  }

  private usernamepasswordauthenticationtoken getauthentication(httpservletrequest request) {

   string token = request.getheader( "authorization" );

   if (token != null ) {

    // parse the token.

    string user = jwts.parser()

      .setsigningkey( "myjwtsecret" )

      .parseclaimsjws(token.replace( "bearer " , "" ))

      .getbody()

      .getsubject();

    if (user != null ) {

     return new usernamepasswordauthenticationtoken(user, null , new arraylist<>());

    }

    return null ;

   }

   return null ;

  }

}

package boss.portal.security;

import boss.portal.web.filter.jwtloginfilter;

import boss.portal.web.filter.jwtauthenticationfilter;

import org.springframework.boot.autoconfigure.security.securityproperties;

import org.springframework.context.annotation.configuration;

import org.springframework.core.annotation.order;

import org.springframework.http.httpmethod;

import org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder;

import org.springframework.security.config.annotation.web.builders.httpsecurity;

import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter;

import org.springframework.security.core.userdetails.userdetailsservice;

import org.springframework.security.crypto.bcrypt.bcryptpasswordencoder;

/**

  * springsecurity的配置

  * 通过springsecurity的配置，将jwtloginfilter，jwtauthenticationfilter组合在一起

  * @author zhaoxinguo on 2017/9/13.

  */

@configuration

@order (securityproperties.access_override_order)

public class websecurityconfig extends websecurityconfigureradapter {

  private userdetailsservice userdetailsservice;

  private bcryptpasswordencoder bcryptpasswordencoder;

  public websecurityconfig(userdetailsservice userdetailsservice, bcryptpasswordencoder bcryptpasswordencoder) {

   this .userdetailsservice = userdetailsservice;

   this .bcryptpasswordencoder = bcryptpasswordencoder;

  }

  @override

  protected void configure(httpsecurity http) throws exception {

   http.cors().and().csrf().disable().authorizerequests()

     .antmatchers(httpmethod.post, "/users/signup" ).permitall()

     .anyrequest().authenticated()

     .and()

     .addfilter( new jwtloginfilter(authenticationmanager()))

     .addfilter( new jwtauthenticationfilter(authenticationmanager()));

  }

  @override

  public void configure(authenticationmanagerbuilder auth) throws exception {

   auth.userdetailsservice(userdetailsservice).passwordencoder(bcryptpasswordencoder);

  }

}

.addfilter( new jwtloginfilter(authenticationmanager()))

.addfilter( new jwtauthenticationfilter(authenticationmanager()))