{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022,
  "jti": "1pmysetgujcoden",
  "exp": 1516242622,
  "scope": [
    "read",
    "write"
  ]
}

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMiwianRpIjoiMXBteXNldGd1amNvZGVuIiwiZXhwIjoxNTE2MjQyNjIyLCJzY29wZSI6WyJyZWFkIiwid3JpdGUiXX0.eW91cmUtYXV0aG9yaXphdGlvbi1zaWduYXR1cmU=

Authorization: Bearer <JWT>

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.12.4</version>
</dependency>

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import io.jsonwebtoken.security.SecureDigestAlgorithm;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.User;
import org.springframework.stereotype.Component;

import javax.crypto.SecretKey;
import java.util.Date;

/**
 * @version 1.0
 * @description: <p></p >
 * @author: 碼農(nóng)Academy
 * @create: 2024/4/18 14:39
 */
@Component
public class JwtTokenUtil {

    @Value("${security.jwt.token.secret-key}")
    private String secretKey;

    /**過(guò)期時(shí)間*/
    private static final long VALIDITY_IN_MILLISECONDS = 3600000; // 1h

    /**
     * 生成JWT
     * @param authentication 當(dāng)前登陸用戶信息
     * @return JWT
     */
    public String generateToken(Authentication authentication) {
        User user = (User) authentication.getPrincipal();
        Date now = new Date();
        // 設(shè)置過(guò)期時(shí)間
        Date expiryDate = new Date(now.getTime() + VALIDITY_IN_MILLISECONDS);
        //指定加密算法
        SecureDigestAlgorithm<SecretKey, SecretKey> algorithm = Jwts.SIG.HS256;
        //密鑰實(shí)例
        SecretKey key = Keys.hmacShaKeyFor(secretKey.getBytes());
        return Jwts.builder()
                .subject(user.getUsername())
                .signWith(key, algorithm) //設(shè)置簽名使用的簽名算法和簽名使用的秘鑰
                .expiration(expiryDate) //設(shè)置過(guò)期時(shí)間
                .claim("username", user.getUsername()) //設(shè)置自定義負(fù)載信息
                .compact();
    }


    /**
     * 驗(yàn)證JWT
     * @param authToken
     * @return
     */
    public boolean validateToken(String authToken) {
        try {
            Jws<Claims> claimsJws = parseJWT(authToken);
            claimsJws.getPayload();
            return true;
        } catch (MalformedJwtException | ExpiredJwtException | UnsupportedJwtException | IllegalArgumentException e) {
            return false;
        }
    }

    /**
     * 解析jwt
     * @param authToken 登陸token
     * @return
     */
    public Jws<Claims> parseJWT(String authToken){
        //密鑰實(shí)例
        SecretKey key = Keys.hmacShaKeyFor(secretKey.getBytes());
        return Jwts.parser()
                .verifyWith(key)  //設(shè)置簽名的密鑰
                .build()
                .parseSignedClaims(authToken); //設(shè)置要解析的jwt
    }

    /**
     * 從JWT中獲取用戶名
     * @param token
     * @return
     */
    public String getUsernameFromToken(String token) {
        Jws<Claims> claimsJws = parseJWT(token);
        return (String) claimsJws.getPayload().get("username", String.class);
    }
}

import com.springboot.base.jwt.util.JwtTokenUtil;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.List;
import java.util.stream.Collectors;

/**
 * @version 1.0
 * @description: <p></p >
 * @author: 碼農(nóng)Academy
 * @create: 2024/4/18 16:15
 */
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final UserDetailsService userDetailsService;
    private final JwtTokenUtil jwtTokenUtil;

    private static final String BEARER_PREFIX = "Bearer ";

     public JwtAuthenticationFilter(UserDetailsService userDetailsService, JwtTokenUtil jwtTokenUtil) {
          this.userDetailsService = userDetailsService;
          this.jwtTokenUtil = jwtTokenUtil;
     }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String jwtToken = getTokenFromRequest(request);
        if (jwtToken != null && jwtTokenUtil.validateToken(jwtToken)) {
            String username = jwtTokenUtil.getUsernameFromToken(jwtToken);
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            // 用于權(quán)限校驗(yàn)
            List<GrantedAuthority> authorities = userDetails.getAuthorities().stream()
                    .map(authority -> new SimpleGrantedAuthority(authority.getAuthority()))
                    .collect(Collectors.toList());

            AbstractAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                    userDetails, null, authorities
            );
            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

            SecurityContextHolder.getContext().setAuthentication(authentication);
        }else {
            // 如果出現(xiàn)異常，可能是無(wú)效的Token，此處可記錄日志或做其他處理
            System.out.println("沒(méi)有登陸。。。。。。");
        }

        filterChain.doFilter(request, response);
    }

    private String getTokenFromRequest(HttpServletRequest request) {
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null && authHeader.startsWith(BEARER_PREFIX)) {
            return authHeader.replace(BEARER_PREFIX, "");
        }
        return null;
    }
}

import com.springboot.base.jwt.filter.JwtAuthenticationFilter;
import com.springboot.base.jwt.util.JwtTokenUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * @version 1.0
 * @description: <p></p >
 * @author: 碼農(nóng)Academy
 * @create: 2024/4/18 16:11
 */
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests((requests) -> requests
                        .antMatchers("/user/login").permitAll() // 登錄接口公開(kāi)
                        .anyRequest().authenticated() // 其他接口需要驗(yàn)證
                )
                .addFilterBefore(new JwtAuthenticationFilter(userDetailsService, jwtTokenUtil), UsernamePasswordAuthenticationFilter.class) // 添加JWT過(guò)濾器
                .sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)); // 關(guān)閉Session管理
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

import com.springboot.base.jwt.login.RoleEntity;
import com.springboot.base.jwt.login.UserEntity;
import com.springboot.base.jwt.repository.UserRepository;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.Collection;
import java.util.List;
import java.util.stream.Collectors;

/**
 * @version 1.0
 * @description: <p></p >
 * @author: 碼農(nóng)Academy
 * @create: 2024/4/18 16:22
 */
@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    private final UserRepository userRepository;

    public UserDetailsServiceImpl(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) {
        // 根據(jù)用戶名查詢用戶實(shí)體
        UserEntity userEntity = userRepository.findByUserName(username);

        // 如果用戶不存在，則拋出異常
        if (userEntity == null) {
            throw new UsernameNotFoundException("User not found with username: " + username);
        }

        // 將用戶實(shí)體轉(zhuǎn)換為Spring Security可識(shí)別的UserDetails對(duì)象
        User user = new User(userEntity.getUserName(),
                userEntity.getPassword(), // 注意：此處假設(shè)password字段是已經(jīng)經(jīng)過(guò)加密處理過(guò)的
                userEntity.getEnabled(),
                true, true, true,
                getAuthorities(userEntity.getRoleList()) // 獲取用戶的角色并轉(zhuǎn)換為GrantedAuthority列表
        );
        System.out.println(user.getPassword());
        return user;
    }

    private Collection<? extends GrantedAuthority> getAuthorities(List<RoleEntity> roles) {
        return roles.stream()
                .map(role -> new SimpleGrantedAuthority(role.getRoleCode()))
                .collect(Collectors.toList());
    }
}

import com.springboot.base.jwt.request.LoginRequest;
import com.springboot.base.jwt.response.JwtResponse;
import com.springboot.base.jwt.util.JwtTokenUtil;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.DisabledException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

/**
 * @version 1.0
 * @description: <p></p >
 * @author: 碼農(nóng)Academy
 * @create: 2024/4/18 17:31
 */
@RestController
@RequestMapping("/user")
public class LoginController {

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

    @Autowired
    private AuthenticationManager authenticationManager;

    @PostMapping("/login")
    public ResponseEntity<?> createAuthenticationToken(@RequestBody LoginRequest loginRequest) throws Exception {
        // 創(chuàng)建基于用戶名密碼的Authentication請(qǐng)求對(duì)象
        UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                loginRequest.getUserName(),
                loginRequest.getPassword()
        );

        try {
            // 使用AuthenticationManager進(jìn)行身份驗(yàn)證
            Authentication authentication = authenticationManager.authenticate(authToken);

            // 如果身份驗(yàn)證成功，SecurityContextHolder會(huì)存儲(chǔ)該Authentication對(duì)象
            SecurityContextHolder.getContext().setAuthentication(authentication);

            // 生成JWT Token或其他形式的授權(quán)憑證
            String token = jwtTokenUtil.generateToken(authentication);

            // 返回帶有Token的響應(yīng)
            return ResponseEntity.ok(new JwtResponse(token));

        } catch (BadCredentialsException ex) {
            // 處理用戶名/密碼不正確等錯(cuò)誤情況
            System.out.println("密碼不正確");
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid credentials");
        } catch (DisabledException ex) {
            // 處理賬戶被禁用等情況
            System.out.println("處理賬戶被禁用");
            return ResponseEntity.status(HttpStatus.FORBIDDEN).body("Account is disabled");
        } catch (AuthenticationException e) {
            System.out.println("Authentication failed");
            // 其他身份驗(yàn)證異常
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("Authentication failed");
        }
    }

}

import com.fasterxml.jackson.annotation.JsonCreator;
import lombok.Data;

/**
 * @version 1.0
 * @description: <p></p >
 * @author: 碼農(nóng)Academy
 * @create: 2024/4/18 18:59
 */
@Data
public class JwtResponse {

    private String token;
    private String type = "Bearer";

    public JwtResponse(String token) {
        this.token = token;
    }

    @JsonCreator
    public static JwtResponse of(String token) {
        return new JwtResponse(token);
    }
}