JWT使用（基础无数据库版）

1、引入依赖

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>
<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>2.3.0</version>
</dependency>
<dependency>
    <groupId>com.sun.xml.bind</groupId>
    <artifactId>jaxb-impl</artifactId>
    <version>2.3.0</version>
</dependency>
<dependency>
    <groupId>com.sun.xml.bind</groupId>
    <artifactId>jaxb-core</artifactId>
    <version>2.3.0</version>
</dependency>
<dependency>
    <groupId>javax.activation</groupId>
    <artifactId>activation</artifactId>
    <version>1.1.1</version>
</dependency>
<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
    <version>1.18.36</version>
    <scope>provided</scope>
</dependency>
<dependency>
    <groupId>junit</groupId>
    <artifactId>junit</artifactId>
    <version>4.12</version>
</dependency>

2、实体类User

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;

@AllArgsConstructor
@NoArgsConstructor
@Data
public class User {

    String username;
    String role;
}

3、工具类JwtUtil

import com.example.demo.entity.User;
import io.jsonwebtoken.*;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.io.UnsupportedEncodingException;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.UUID;

public class JwtUtil {
    // 日志
    private static final Logger logger = LoggerFactory.getLogger(JwtUtil.class);
    // 密钥
    private static final String SECRET = "secret";
    // 有效期
    private static final long EXPIRATION = 1800L;

    public static String createToken(User user) {
        try {
            return Jwts.builder()
                    .setHeaderParam("typ", "JWT")
                    .setHeaderParam("alg", "HS256")
                    .claim("username", user.getUsername())
                    .claim("role", user.getRole())
                    .setSubject("user-claims")
                    .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION * 1000))
                    .setId(UUID.randomUUID().toString())
                    .signWith(SignatureAlgorithm.HS256, SECRET.getBytes(StandardCharsets.UTF_8))
                    .compact();
        } catch (Exception e) {
            logger.error("create token error", e);
            return null;
        }
    }

    public static Claims parseToken(String token) throws UnsupportedEncodingException {
        try {
            return Jwts.parser()
                    .setSigningKey(SECRET.getBytes(StandardCharsets.UTF_8))
                    .parseClaimsJws(token)
                    .getBody();
        } catch (Exception e) {
            logger.error("parse token error", e);
            return null;
        }
    }
}

3、登录和解析控制器

import com.example.demo.entity.User;
import com.example.demo.util.JwtUtil;
import jakarta.servlet.http.HttpServletRequest;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

import java.io.IOException;

@Slf4j
@RestController
public class JwtController {

    @PostMapping("/login")
    public String login(User user) {
        return JwtUtil.createToken(user);
    }

    @PostMapping("/jwt/parse")
    public Object parse(HttpServletRequest request) throws IOException {
        return request.getAttribute("username") + " " + request.getAttribute("role");
    }
}

4、过滤器

import com.example.demo.util.JwtUtil;
import io.jsonwebtoken.Claims;
import jakarta.servlet.*;
import jakarta.servlet.annotation.WebFilter;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;

import java.io.IOException;

@Slf4j
@WebFilter(filterName = "JwtFilter", urlPatterns = "/jwt/*")
public class JwtFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        final HttpServletRequest request = (HttpServletRequest) req;
        final HttpServletResponse response = (HttpServletResponse) res;
        response.setCharacterEncoding("UTF-8");
        final String token = request.getHeader("Authorization");
        if ("OPTIONS".equals(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
        } else {
            if (token == null ) {
                response.getWriter().write("no token");
                return;
            }
            String subToken = "";
            if (token.startsWith("Bearer ")) {
                subToken = token.substring(7);
            }
            Claims claims = JwtUtil.parseToken(subToken);
            if (claims == null) {
                response.getWriter().write("illegal token");
                return;
            }
            Object username = claims.get("username");
            Object role = claims.get("role");
            request.setAttribute("username", String.valueOf(username));
            request.setAttribute("role", String.valueOf(role));
            chain.doFilter(req, res);
        }
    }
}

5、登录获取token

6、得到User信息

请求头带上Authorization，参数值填写Bearer token