[Spring Boot integrates JWT]

Spring Boot integrates JWT

• Introduction
• 1. Configure JWT related information
• 2. Write the JWTUtils class
• 3. Token interception

Introduction

Using the OAuth2 protocol to implement unified authentication will be very cumbersome and will affect performance.
Directly use a Token data to realize the storage of distributed authentication information, which is simple and low-difficulty. The amount of token data is small and the network transmission is faster.

1. Configure JWT related information

1. Introduce dependencies

 <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>0.9.1</version>
        </dependency>

2. Configure jwt related attributes

server:
  port: 8083
spring:
  application:
    name: carbon #Application name
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://127.0.0.1:3306/carbon1?characterEncoding=UTF-8 & serverTimezone=UTC & useSSL=false
    username: root
    password: 123456
mybatis:
  type-aliases-package: com.dz.carbon.pojo
  mapper-locations: classpath:mapper/*Mapper.xml
carbon: #Custom configuration
  config: #Custom configuration items
    jwt:
      sign: carbon #JWT certificate related signature
      issuer: ranzong # Certificate issuer
      secret: ranzongCarBon #Key
      expire: 100 #valid time

3. Create a JWT attribute configuration class to receive the attribute content in the application

@ConfigurationProperties(prefix = "carbon.config.jwt")
@Component
@Data
public class JWTConfigProperies {<!-- -->
    private String sign; // Certificate signature information
    private String issuer; // Signature information
    private String secret; // encryption key
    private long expire; // Expiration time (unit: s)
}

2. Write JWTUtils class

1. Inject the jwt attribute configuration class, define the application name, and use the HS256 algorithm

2. Set the encryption key information (for security, additionally encrypt through base64)

 public static SecretKey generalKey(){<!-- -->
        byte[] encodedKey = Base64.decodeBase64(Base64.encodeBase64(jwtConfigProperies.getSecret().getBytes()));
        return new SecretKeySpec(encodedKey,0,encodedKey.length,"AES");
    }

3. Create a method to generate tokens

 public static String createToken(Map<String, Object> map){<!-- -->
        //Create jwt
        try {<!-- -->
            Calendar calendar = Calendar.getInstance();
            calendar.add(Calendar.SECOND, jwtConfigProperies.getExpire());

            Map<String,Object> headers = new HashMap<String,Object>();
            headers.put("author","Agent");
            headers.put("module",applicationName);

            return Jwts.builder()
                    .setSubject(new ObjectMapper().writeValueAsString(map)) // User information
                    .setIssuedAt(new Date()) //Issuance time
                    .setExpiration(calendar.getTime()) //Expiration time
                    .setHeader(headers) //Header information
                    .setId("carbon" + UUID.randomUUID()) //Unique identification
                    .signWith(signatureAlgorithm,generalKey())
                    .compact(); // Create token
        } catch (JsonProcessingException e) {<!-- -->
            throw new RuntimeException(e);
        }
    }

4. Create a method to verify the legitimacy of the token

public static boolean verify(String token){<!-- -->
        try{<!-- -->
            Jwts.parser().setSigningKey(generalKey()).parseClaimsJws(token).getBody();
            return true;
        }
        catch (Exception e){<!-- -->
            e.printStackTrace();
        }
        return false;
    }

5. Create a method to obtain token information

public static Jws<Claims> getTokenInfo(String token){<!-- -->
        if (StringUtils.isNullOrEmpty(token)) return null;
        return Jwts.parser().setSigningKey(generalKey()).parseClaimsJws(token);
    }

6. Method to create refresh token

 public String refresh(String token){<!-- -->
        //Verify token
        if (!verify(token)) return null;

        ObjectMapper mapper = new ObjectMapper();
        try {<!-- -->
            Map<String,Object> map = mapper.readValue(Jwts.parser().setSigningKey(generalKey()).parseClaimsJws(token).getBody().getSubject(), HashMap.class);
            return createToken(map);
        } catch (JsonProcessingException e) {<!-- -->
            throw new RuntimeException(e);
        }
    }

7. Create verification token and return the result

 // Verify token acquisition status
    public static Result checkToken(String token){<!-- -->
        try{<!-- -->
            Jwts.parser().setSigningKey(generalKey()).parseClaimsJws(token).getBody();
        }
        catch (ExpiredJwtException e){<!-- -->
            return new Result(false,StatusCode.ERROR.getCode(), "token expired!");
        }
        catch (Exception e){<!-- -->
            return new Result(false,StatusCode.ERROR.getCode(), "Token is invalid!");
        }
        return new Result(true,StatusCode.SUCCESS.getCode(), "token is valid");
    }

8. Write test classes to test Jwt business methods

@ExtendWith(SpringExtension.class)
@WebAppConfiguration
@SpringBootTest(classes = CarbonApplication.class)

public class TestToken {<!-- -->
    @Autowired
    private UserService userService;

    @Test
    public void testCreateToken (){<!-- -->
        Map<String,Object> map = new HashMap<String,Object>();
        map.put("user",userService.queryById(1));
        System.out.println(JWTUtils.createToken(map));
    }

    @Test
    public void testgetToken () throws JsonProcessingException {<!-- -->
        Jws<Claims> tokenInfo = JWTUtils.getTokenInfo("eyJhdXRob3IiOiLku6PmgLsiLCJtb2R1bGUiOiJjYXJib24iLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ7XCJ1c2VyXCI6e1widWlkXCI6MSxcInVzZXJuY W1lXCI6XCJhZG1pblwiLFwiZW1haWxcIjpcIjEyMzQ1NkBxcS5jb21cIixcInBhc3N3b3JkXCI6XCIxMjM0NTZcIixcImF2YXRhclwiOlwiXCJ9fSIsImlhdCI6MTY5ODIxOTM1MSwiZXhwIjoxNjk 4MjE5NDUxLCJqdGkiOiJjYXJib25jZmUxZTM2ZC04YThlLTQ4YjYtYWJiMS0xYzhjZTE3OTYzZWUifQ.T_tK9nMdBoZbvgnZKdk6VVyoQOpYS3ST28cmhooG91g");
        System.out.println(tokenInfo.getHeader());
        System.out.println(tokenInfo.getSignature());
        System.out.println(tokenInfo.getBody());
        ObjectMapper mapper = new ObjectMapper();
        Map map = mapper.readValue(tokenInfo.getBody().getSubject(), HashMap.class);
        System.out.println(map.get("user"));
    }

    @Test
    public void testVerify(){<!-- -->
        System.out.println(JWTUtils.verify("eyJhd JhZG1pblwiLFwiZW1haWxcIjpcIjEyMzQ1NkBxcS5jb21cIixcInBhc3N3b3JkXCI6XCIxMjM0NTZcIixcImF2YXRhclwiOlwiXCJ9fSIsImlhdCI6MTY5ODIxODY0NywiZXhwIjoxNjk4MjE4Nz Q3LCJqdGkiOiJjYXJib24yYjQ3NTE2Mi0xYjAzLTQ3NGYtYTZlYS1lMGM3MTUzMTkxNDkifQ.XSCrlcB6fRqfnhd7-rUbKG5-F_PZplX76R5D5YTpoMo"));
    }

    @Test
    public void testRefresh(){<!-- -->
        System.out.println(JWTUtils.refresh("eyJhd JhZG1pblwiLFwiZW1haWxcIjpcIjEyMzQ1NkBxcS5jb21cIixcInBhc3N3b3JkXCI6XCIxMjM0NTZcIixcImF2YXRhclwiOlwiXCJ9fSIsImlhdCI6MTY5ODIxOTA0NSwiZXhwIjoxNjk4MjE5MTQ1 LCJqdGkiOiJjYXJib24yYTU4NjAwYS0wYjM0LTQyOTYtODg4OS02MWM4ZjU5ZDkyNjAifQ.isOUg0sQl3mq5VQae0Pk7eEjs9GrCRiruNr1HIoVsf0"));
    }

3. Token interception

1. Create an interceptor class

public class JWTInterceptor implements HandlerInterceptor {<!-- -->
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {<!-- -->
        Result result = JWTUtils.checkToken(request.getHeader("X-Token"));
        if (!result.getFlag()) return true;
        response.setContentType("application/json;charset=utf-8");
        response.getWriter().write(new ObjectMapper().writeValueAsString(result));
        return false;
    }
}

2. Add interceptor configuration class

@Configuration
public class InterceptorConfig implements WebMvcConfigurer {<!-- -->
    @Override
    public void addInterceptors(InterceptorRegistry registry) {<!-- -->
        registry.addInterceptor(new JWTInterceptor())
                .addPathPatterns("/**")
                .excludePathPatterns("/login");
    }
}