Shiro + JWT + SpringBoot应用示例代码详解

  org.apache.shiroshiro-spring1.4.1 com.auth0java-jwt3.8.2

 public class JWTUtil { /** * 校验 token是否正确 * * @param token 密钥 * @param secret 用户的密码 * @return 是否正确 */ public static boolean verify(String token, String username, String secret) { try { Algorithm algorithm = Algorithm.HMAC256(secret); JWTVerifier verifier = JWT.require(algorithm) .withClaim("username", username) .build(); verifier.verify(token); return true; } catch (Exception e) { log.info("token is invalid{}", e.getMessage()); return false; } } public static String getUsername(HttpServletRequest request) { // 取token String token = request.getHeader("Authorization"); return getUsername(UofferUtil.decryptToken(token)); } /** * 从 token中获取用户名 * @return token中包含的用户名 */ public static String getUsername(String token) { try { DecodedJWT jwt = JWT.decode(token); return jwt.getClaim("username").asString(); } catch (JWTDecodeException e) { log.error("error：{}", e.getMessage()); return null; } } public static Integer getUserId(HttpServletRequest request) { // 取token String token = request.getHeader("Authorization"); return getUserId(UofferUtil.decryptToken(token)); } /** * 从 token中获取用户ID * @return token中包含的ID */ public static Integer getUserId(String token) { try { DecodedJWT jwt = JWT.decode(token); return Integer.valueOf(jwt.getSubject()); } catch (JWTDecodeException e) { log.error("error：{}", e.getMessage()); return null; } } /** * 生成 token * @param username 用户名 * @param secret 用户的密码 * @return token 加密的token */ public static String sign(String username, String secret, Integer userId) { try { Map map = new HashMap<>(); map.put("alg", "HS256"); map.put("typ", "JWT"); username = StringUtils.lowerCase(username); Algorithm algorithm = Algorithm.HMAC256(secret); return JWT.create() .withHeader(map) .withClaim("username", username) .withSubject(String.valueOf(userId)) .withIssuedAt(new Date()) //   .withExpiresAt(date) .sign(algorithm); } catch (Exception e) { log.error("error：{}", e); return null; } } }

 @Data public class JWTToken implements AuthenticationToken { private static final long serialVersionUID = 1282057025599826155L; private String token; private String exipreAt; public JWTToken(String token) { this.token = token; } public JWTToken(String token, String exipreAt) { this.token = token; this.exipreAt = exipreAt; } @Override public Object getPrincipal() { return token; } @Override public Object getCredentials() { return token; } }

 public class ShiroRealm extends AuthorizingRealm { @Resource private RedisUtil redisUtil; @Autowired private ISysUserService userService; @Autowired private ISysRoleService roleService; @Autowired private ISysMenuService menuService; // 必须重写此方法，不然Shiro会报错 @Override public boolean supports(AuthenticationToken token) { return token instanceof JWTToken; } /** * 只有当需要检测用户权限的时候才会调用此方法 * 授权模块，获取用户角色和权限。 * @param token token * @return AuthorizationInfo 权限信息 */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection token) { Integer userId = JWTUtil.getUserId(token.toString()); SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(); // 获取用户角色集 Set roleSet = roleService.selectRolePermissionByUserId(userId); simpleAuthorizationInfo.setRoles(roleSet); // 获取用户权限集 Set permissionSet = menuService.findUserPermissionsByUserId(userId); simpleAuthorizationInfo.setStringPermissions(permissionSet); return simpleAuthorizationInfo; } /** * 用户认证:编写shiro判断逻辑，进行用户认证 * @param authenticationToken 身份认证 token * @return AuthenticationInfo 身份认证信息 * @throws AuthenticationException 认证相关异常 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { // 这里的 token是从 JWTFilter 的 executeLogin 方法传递过来的，已经经过了解密 String token = (String) authenticationToken.getCredentials(); String encryptToken = UofferUtil.encryptToken(token); //加密token String username = JWTUtil.getUsername(token); //从token中获取username Integer userId = JWTUtil.getUserId(token); //从token中获取userId // 通过redis查看token是否过期 HttpServletRequest request = HttpContextUtil.getHttpServletRequest(); String ip = IPUtil.getIpAddr(request); String encryptTokenInRedis = redisUtil.get(Constant.RM_TOKEN_CACHE + encryptToken + StringPool.UNDERSCORE + ip); if (!token.equalsIgnoreCase(UofferUtil.decryptToken(encryptTokenInRedis))) { throw new AuthenticationException("token已经过期"); } // 如果找不到，说明已经失效 if (StringUtils.isBlank(encryptTokenInRedis)) { throw new AuthenticationException("token已经过期"); } if (StringUtils.isBlank(username)) { throw new AuthenticationException("token校验不通过"); } // 通过用户id查询用户信息 SysUser user = userService.getById(userId); if (user == null) { throw new AuthenticationException("用户名或密码错误"); } if (!JWTUtil.verify(token, username, user.getPassword())) { throw new AuthenticationException("token校验不通过"); } return new SimpleAuthenticationInfo(token, token, "febs_shiro_realm"); } }

 @Slf4j public class JWTFilter extends BasicHttpAuthenticationFilter { private static final String TOKEN = "Authorization"; private AntPathMatcher pathMatcher = new AntPathMatcher(); /** * 对跨域提供支持 */ @Override protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception { HttpServletRequest httpServletRequest = (HttpServletRequest) request; HttpServletResponse httpServletResponse = (HttpServletResponse) response; httpServletResponse.setHeader("Access-control-Allow-Origin", httpServletRequest.getHeader("Origin")); httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,PUT,DELETE"); httpServletResponse.setHeader("Access-Control-Allow-Headers", httpServletRequest.getHeader("Access-Control-Request-Headers")); // 跨域时会首先发送一个 option请求，这里我们给 option请求直接返回正常状态 if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) { httpServletResponse.setStatus(HttpStatus.OK.value()); return false; } return super.preHandle(request, response); } @Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws UnauthorizedException { HttpServletRequest httpServletRequest = (HttpServletRequest) request; UofferProperties UofferProperties = SpringContextUtil.getBean(UofferProperties.class); // 获取免认证接口 url // 在application.yml中配置/adminApi/auth/doLogin/**,/adminApi/auth/register/**, ... String[] anonUrl = StringUtils.splitByWholeSeparatorPreserveAllTokens(UofferProperties.getShiro().getAnonUrl(), ","); boolean match = false; for (String u : anonUrl) { if (pathMatcher.match(u, httpServletRequest.getRequestURI())) { match = true; } } if (match) { return true; } if (isLoginAttempt(request, response)) { return executeLogin(request, response); } return false; } /** * 判断用户是否想要登入。 * 检测header里面是否包含Authorization字段即可 */ @Override protected boolean isLoginAttempt(ServletRequest request, ServletResponse response) { HttpServletRequest req = (HttpServletRequest) request; String token = req.getHeader(TOKEN); return token != null; } @Override protected boolean executeLogin(ServletRequest request, ServletResponse response) { HttpServletRequest httpServletRequest = (HttpServletRequest) request; String token = httpServletRequest.getHeader(TOKEN); //得到token JWTToken jwtToken = new JWTToken(UofferUtil.decryptToken(token)); // 解密token try { // 提交给realm进行登入，如果错误他会抛出异常并被捕获 getSubject(request, response).login(jwtToken); // 如果没有抛出异常则代表登入成功，返回true return true; } catch (Exception e) { log.error(e.getMessage()); return false; } } @Override protected boolean sendChallenge(ServletRequest request, ServletResponse response) { log.debug("Authentication required: sending 401 Authentication challenge response."); HttpServletResponse httpResponse = WebUtils.toHttp(response); // httpResponse.setStatus(HttpStatus.UNAUTHORIZED.value()); httpResponse.setCharacterEncoding("utf-8"); httpResponse.setContentType("application/json; charset=utf-8"); final String message = "未认证，请在前端系统进行认证"; final Integer status = 401; try (PrintWriter out = httpResponse.getWriter()) { //  String responseJson = "{\"message\":\"" + message + "\"}"; JSONObject responseJson = new JSONObject(); responseJson.put("msg", message); responseJson.put("status", status); out.print(responseJson); } catch (IOException e) { log.error("sendChallenge error：", e); } return false; } }

 @Configuration public class ShiroConfig { @Bean public ShiroRealm shiroRealm() { // 配置 Realm return new ShiroRealm(); } // 创建DefaultWebSecurityManager @Bean("securityManager") public SecurityManager securityManager() { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); // 配置 SecurityManager，并注入 shiroRealm securityManager.setRealm(shiroRealm()); return securityManager; } // 创建ShiroFilterFactoryBean @Bean public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) { ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); // 设置 securityManager shiroFilterFactoryBean.setSecurityManager(securityManager); //添加Shiro过滤器 /** * Shiro内置过滤器，可以实现权限相关的拦截器 * 常用的过滤器： * anon: 无需认证（登录）可以访问 * authc: 必须认证才可以访问 * user: 如果使用rememberMe的功能可以直接访问 * perms： 该资源必须得到资源权限才可以访问 * role: 该资源必须得到角色权限才可以访问 */ // 在 Shiro过滤器链上加入 自定义过滤器JWTFilter 并取名为jwt LinkedHashMap filters = new LinkedHashMap<>(); filters.put("jwt", new JWTFilter()); shiroFilterFactoryBean.setFilters(filters); // 自定义url规则 LinkedHashMap filterChainDefinitionMap = new LinkedHashMap<>(); // 所有请求都要经过 jwt过滤器 filterChainDefinitionMap.put("/**", "jwt"); shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap); return shiroFilterFactoryBean; } /** * 下面的代码是添加注解支持 */ @Bean @DependsOn({"lifecycleBeanPostProcessor"}) public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() { // 设置代理类 DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator(); creator.setProxyTargetClass(true); return creator; } /** * 开启aop注解支持 * * @param securityManager * @return */ @Bean("authorizationAttributeSourceAdvisor") public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor(); authorizationAttributeSourceAdvisor.setSecurityManager(securityManager); return authorizationAttributeSourceAdvisor; } // Shiro生命周期处理器 @Bean public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } }

 /** * 登录方法 * * @param username 用户名 * @param password 密码 * @param code 验证码 * @param uuid 唯一标识 * @return 结果 */ @PostMapping("/doLogin") public ResultVo login(String username, String password, String code, String uuid, HttpServletRequest request) throws UofferException { String verifyKey = Constant.RM_CAPTCHA_CODE_KEY + uuid; String captcha = redisUtil.getCacheObject(verifyKey); redisUtil.del(verifyKey); if (captcha == null) { return ResultVo.failed(201, "验证码失效"); } if (!code.equalsIgnoreCase(captcha)) { return ResultVo.failed(201, "验证码错误"); } username = StringUtils.lowerCase(username); password = MD5Util.encrypt(username, password); final String errorMessage = "用户名或密码错误"; SysUser user = userManager.getUser(username); if (user == null) { return ResultVo.failed(201, errorMessage); } if (!StringUtils.equalsIgnoreCase(user.getPassword(), password)) { return ResultVo.failed(201, errorMessage); } if (Constant.STATUS_LOCK.equals(user.getStatus())) { return ResultVo.failed(201, "账号已被锁定,请联系管理员！"); } Integer userId = user.getUserId(); String ip = IPUtil.getIpAddr(request); String address = AddressUtil.getCityInfo(ip); // 更新用户登录时间 SysUser sysUser = new SysUser(); sysUser.setUserId(userId); sysUser.setLastLoginTime(new Date()); sysUser.setLastLoginIp(ip); userService.updateById(sysUser); // 拿到token之后加密 String sign = JWTUtil.sign(username, password, userId); String token = UofferUtil.encryptToken(sign); LocalDateTime expireTime = LocalDateTime.now().plusSeconds(properties.getShiro().getJwtTimeOut()); String expireTimeStr = DateUtil.formatFullTime(expireTime); JWTToken jwtToken = new JWTToken(token, expireTimeStr); // 将登录日志存入日志表中 SysLoginLog loginLog = new SysLoginLog(); loginLog.setIp(ip); loginLog.setAddress(address); loginLog.setLoginTime(new Date()); loginLog.setUsername(username); loginLog.setUserId(userId); loginLogService.save(loginLog); saveTokenToRedis(username, jwtToken, ip, address); JSONObject data = new JSONObject(); data.put("Authorization", token); // 将用户配置及权限存入redis中 userManager.loadOneUserRedisCache(userId); return ResultVo.oK(data); }

 @RequiresPermissions("bus:careerTalk:query") public void someMethod() { }