从0开始搭建一个生产级SpringBoot2.0.X项目（十二）SpringBoot接口SpringSecurity JWT鉴权

前言

最近有个想法想整理一个内容比较完整springboot项目初始化Demo。

SpringBoot接口权限控制 SpringSecurity 接口使用 Bearer token类型  JWT 鉴权

一、pom文件新增依赖

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.12.6</version>
</dependency>

application.yaml 增加参数 用于模拟后续生成TOKEN和验证使用

#JTW 加密的密码
jwt:
  # secret 必须足够长 40bits之上
  # 否则 报错 The specified key byte array is 40 bits which is not secure enough            #for any JWT HMAC-SHA algorithm
  secret: 12345678123456781234567812345678
#认证系统编号 
  clientid: clientid

二、创建 UserInfo 类 模拟用户信息

import lombok.Data;

/**
 * 用户信息
 */
@Data
public class UserInfo {

    private String clientid;//用户授权id

    private String username;//用户名

    private String password;//用户名
}

三、创建 JwtTokenUtil 类，用于生成和验证JWT令牌。

package com.murg.bootdemo.util;


import com.murg.bootdemo.business.entity.UserInfo;
import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import io.jsonwebtoken.security.SecureDigestAlgorithm;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import javax.crypto.SecretKey;
import java.io.Serializable;
import java.time.Instant;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;

@Component
public class JwtTokenUtil implements Serializable {


        /**
         * 过期时间(单位:秒)
         */
        public static final Integer REFRESH_TOKEN_EXPIRE = 72000;

        /**
         * 加密算法
         */
        private final static SecureDigestAlgorithm<SecretKey, SecretKey> ALGORITHM = Jwts.SIG.HS256;

        /**
         * 私钥
         */

        private static String SECRET;
        /**
         * 秘钥实例
         */
        public static SecretKey KEY;

        /**
         * jwt签发者
         */
        private final static String JWT_ISS = "Sunreal";

        /**
         * jwt主体
         */
        private final static String SUBJECT = "dwd";

         @Value("${jwt.secret}")
         public void setSecret(String secret) {
             JwtTokenUtil.SECRET = secret;
             JwtTokenUtil.KEY=Keys.hmacShaKeyFor(SECRET.getBytes());
         }
    /**
     * 获取令牌用户数据
     * @param token
     * @return
     */
    public static UserInfo getUserInfoByToken(String token) {
        final Claims claims = parsePayload(token);
        UserInfo userInfo = null;
        if (null != claims) {
            userInfo = new UserInfo();
            userInfo.setClientid(claims.get("clientid").toString());
            userInfo.setUsername(claims.get("username").toString());

        }
        return userInfo;
    }
    /**
     * 获取令牌用户数据
     * @param token
     * @return
     */
    public static String getUsernameFromToken(String token) {
        final Claims claims = parsePayload(token);
        UserInfo userInfo = null;
        if (null != claims) {
            userInfo = new UserInfo();
            userInfo.setClientid(claims.get("clientid").toString());
            userInfo.setUsername(claims.get("username").toString());

        }
        return userInfo.getUsername();
    }
        /**
         * 令牌过期校验 true-过期 false-未过期
         * @param token
         * @return
         */
        public static Boolean isExpired(String token) {
            Boolean result = true;
            final Claims claims = parsePayload(token);
            if (null != claims) {
                String exp = claims.get("exp").toString();
                long diff = Long.parseLong(exp) - System.currentTimeMillis() / 1000;
                if(diff > 0) {
                    result = false;
                }
            }

            return result;
        }

    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = getUsernameFromToken(token);
        return (username.equals(userDetails.getUsername()) && !isExpired(token));
    }

        /**
         * 获取令牌的过期时间
         */
        public static Long getTokenExpireIn(String token) {
            Long expireIn = System.currentTimeMillis() / 1000;
            final Claims claims = parsePayload(token);
            if (null != claims) {
                String exp = claims.get("exp").toString();
                return Long.parseLong(exp);
            }
            return expireIn;
        }

        public String generateToken(UserDetails userDetails,String clie