JWT（JSON Web Token）

Header（头部）
Payload（负载）
Signature（签名）

{
  "alg": "HS256",
  "typ": "JWT"
}

iss (issuer)：签发人
exp (expiration time)：过期时间
sub (subject)：主题
aud (audience)：受众
nbf (Not Before)：生效时间
iat (Issued At)：签发时间
jti (JWT ID)：编号

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
}

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload),secret)

Authorization: Bearer <jwt token>

 <dependencies>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>0.11.2</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>0.11.2</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId> <!-- or jjwt-gson if Gson is preferred -->
            <version>0.11.2</version>
            <scope>runtime</scope>
        </dependency>
        <!-- Uncomment this next dependency if you are using JDK 10 or earlier and you also want to use
             RSASSA-PSS (PS256, PS384, PS512) algorithms.  JDK 11 or later does not require it for those algorithms:
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
            <version>1.60</version>
            <scope>runtime</scope>
        </dependency>
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>2.1.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>fastjson</artifactId>
            <version>1.2.58</version>
        </dependency>
    </dependencies>

package com.chengzw.filter;

import com.chengzw.util.JwtService;
import io.jsonwebtoken.Claims;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;


/**
 * 过滤器，判断请求是否包含token
 * @author 程治玮
 * @since 2021/5/3 10:48 上午
 */
public class MyFilter implements Filter {

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

        HttpServletRequest request =(HttpServletRequest)servletRequest;
        HttpServletResponse response = (HttpServletResponse)servletResponse;

        response.setCharacterEncoding("utf-8");
        String token = request.getHeader("authorization"); //获取请求传来的token
        if( token == null){
            response.getWriter().write("请携带token");
            return;
        }
        Claims claims = JwtService.parsePersonJWT(token); //验证token
        if (claims == null) {
            response.getWriter().write("请携带token");
        }else {
            filterChain.doFilter(request,response);
        }
    }
}

package com.chengzw.conf;

import com.chengzw.filter.MyFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * 过滤器进行注册，并添加需要过滤的路径 /user/hello
 * @author 程治玮
 * @since 2021/5/3 10:37 上午
 */
@Configuration
public class BeanRegisterConfig {

    @Bean
    public FilterRegistrationBean createFilterBean() {
        //过滤器注册类
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new MyFilter());
        registration.addUrlPatterns("/user/hello"); //需要过滤的接口
        return registration;
    }
}

String jws = Jwts.builder() // 创建 JwtBulder 实例
    .setSubject("Bob")      // 添加 Header 参数和声明
    .signWith(key)          // 指定希望对 JWT 签名的密钥（可以是对称密钥，也可以是非对称密钥的私钥）
    .compact();             // 压缩和签名 

package com.chengzw.util;

import io.jsonwebtoken.*;
import java.security.Key;
import java.util.Date;
import java.util.Map;

/**
 * JWT基础工具类
 * @author 程治玮
 * @since 2021/5/3 10:43 上午
 */
public class JwtUtils {


    /**
     * jwt解密，需要密钥和token，如果解密失败，说明token无效
     * @param jsonWebToken
     * @param signingKey
     * @return
     */
    public static Claims parseJWT(String jsonWebToken, Key signingKey) {
        try {
            Claims claims = Jwts.parser()
                    .setSigningKey(signingKey)
                    .parseClaimsJws(jsonWebToken)
                    .getBody();
            return claims;
        } catch (JwtException ex) {
            return null;
        }
    }

    /**
     * jwt = 头部（至少指定算法） + 身体（JWT编码的所有声明） + 签名（将标题和正文的组合通过标题中指定的算法计算得出）
     * jws:JWT可以加密签名成为jws
     * 创建token
     * @param map 主题，也差不多是个人的一些信息，为了好的移植，采用了map放个人信息，而没有采用JSON
     * @param audience 发送谁
     * @param issuer 个人签名
     * @param jwtId 相当于jwt的主键,不能重复
     * @param TTLMillis Token过期时间
     * @param signingKey 生成签名密钥
     * @return
     */
    public static String createJWT(Map map, String audience, String issuer, String jwtId, long TTLMillis, Key signingKey,SignatureAlgorithm signatureAlgorithm) {

        long nowMillis = System.currentTimeMillis();
        Date now = new Date(nowMillis);

        //添加构成JWT的参数
        JwtBuilder builder = Jwts.builder().setHeaderParam("typ", "JWT")
                .setIssuedAt(now)
                .setSubject(map.toString())
                .setIssuer(issuer)
                .setId(jwtId)
                .setAudience(audience)
                .signWith(signingKey, signatureAlgorithm);  //设置签名使用的签名算法和签名使用的秘钥
        //添加Token过期时间
        if (TTLMillis >= 0) {
            // 过期时间
            long expMillis = nowMillis + TTLMillis;
            // 现在是什么时间
            Date exp = new Date(expMillis);
            // 系统时间之前的token都是不可以被承认的
            builder.setExpiration(exp).setNotBefore(now);
        }
        //生成JWS（加密后的JWT）
        return builder.compact();
    }
}

package com.chengzw.util;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;
import java.security.Key;
import java.util.Map;
import java.util.UUID;

/**
 * JWT服务类，对JwtUtils进行二次封装，提供加密和解密的方法
 * @author 程治玮
 * @since 2021/5/3 10:43 上午
 */
public class JwtService {

    /**
     * token 过期时间, 单位: 秒. 这个值表示 30 天
     */
    private static final long TOKEN_EXPIRED_TIME = 30 * 24 * 60 * 60;

    /**
     * jwt 加密解密密钥
     */

    //签名密钥算法
    private static SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
    //生成签名密钥
    //方式一：自己定义加密解密密钥
    //private static String JWT_SECRET = "MDk4ZjZiY2Q0NjIxZDM3M2NhZGU0ZTgzMjYyN2I0ZjY=";
    //private static byte[] apiKeySecretBytes = DatatypeConverter.parseBase64Binary(JWT_SECRET);
    //private static Key signingKey = new SecretKeySpec(apiKeySecretBytes, signatureAlgorithm.getJcaName());

    //方式二：传入签名算法，自动生成密钥
    private static Key signingKey = Keys.secretKeyFor(SignatureAlgorithm.HS256);


    /**
     * 个人签名
     */
    private static final String JWT_ISSUER = "CZW";

    /**
     * 描述:创建令牌
     *
     * @param map      主题，也差不多是个人的一些信息，为了好的移植，采用了map放个人信息，而没有采用JSON
     * @param audience 发送谁
     * @return java.lang.String
     */
    public static String createPersonToken(Map map, String audience) {
        String personToken = JwtUtils.createJWT(map, audience, UUID.randomUUID().toString(), JWT_ISSUER, TOKEN_EXPIRED_TIME, signingKey, signatureAlgorithm);
        return personToken;
    }


    /**
     * 描述:解密JWT
     *
     * @param personToken JWT字符串,也就是token字符串
     * @return io.jsonwebtoken.Claims
     */
    public static Claims parsePersonJWT(String personToken) {
        Claims claims = JwtUtils.parseJWT(personToken, signingKey);
        return claims;
    }
}

package com.chengzw.controller;

import com.chengzw.util.JwtService;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 * @author 程治玮
 * @since 2021/5/3 10:45 上午
 */
@RestController
public class LoginController {

    //需要token验证才能访问
    @RequestMapping("user/hello")
    public String user(){
        return "hello";
    }


    //获取token
    @RequestMapping("user/token")
    public String token(){
        Map<String, Object> map = new HashMap<>();
        map.put("name", "chengzw");
        map.put("age", 21);
        return JwtService.createPersonToken(map, "chengzw");
    }
}

❯ curl http://localhost:8080/user/hello
请携带token

❯ curl http://localhost:8080/user/token

#返回token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2MjAwMTIwMTEsInN1YiI6IntuYW1lPWNoZW5nencsIGFnZT0yMX0iLCJpc3MiOiIwOGIxMDFjNC1hMmFjLTQ1OWQtYjU2ZS0wM2FkZTk2OWIwODYiLCJqdGkiOiJDWlciLCJhdWQiOiJjaGVuZ3p3IiwiZXhwIjoxNjIwMDE0NjAzLCJuYmYiOjE2MjAwMTIwMTF9.ZKX5Z3Acajg57MUQJZqFPWVpPbAGBIDiGigm4FgwmqM

❯ curl http://localhost:8080/user/hello  -H "Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE2MjAwMTIwMTEsInN1YiI6IntuYW1lPWNoZW5nencsIGFnZT0yMX0iLCJpc3MiOiIwOGIxMDFjNC1hMmFjLTQ1OWQtYjU2ZS0wM2FkZTk2OWIwODYiLCJqdGkiOiJDWlciLCJhdWQiOiJjaGVuZ3p3IiwiZXhwIjoxNjIwMDE0NjAzLCJuYmYiOjE2MjAwMTIwMTF9.ZKX5Z3Acajg57MUQJZqFPWVpPbAGBIDiGigm4FgwmqM"
#返回结果
hello