SpringBoot+SpringSecurity+JWT

Spring Boot是一个快速开发框架，可以帮助开发者快速构建基于Spring的应用程序。Spring Security是一个安全框架，可以帮助开发者实现身份验证和授权功能。JWT（JSON Web Token）是一种用于安全传输信息的开放标准，可以帮助开发者实现无状态的身份验证和授权功能。将这三个框架结合起来，可以实现一个安全可靠的Web应用程序。

### Spring Boot 结合 Spring Security、JWT 和 MyBatis 的集成方案 Spring Boot 提供了便捷的方式来构建现代化的应用程序，而通过集成 Spring Security 可以增强其安全性。JWT（JSON Web Token）作为一种轻量级的身份验证机制，在无状态的分布式环境中表现尤为出色[^2]。MyBatis 是一种持久层框架，能够简化数据库操作并提高灵活性。 以下是基于 Spring Boot 3 集成 Spring Security、JWT 和 MyBatis 的示例代码： #### 1. 添加依赖项 在 `pom.xml` 文件中引入必要的依赖库： ```xml <dependencies> <!-- Spring Boot Starter --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <!-- Spring Security --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <!-- JWT --> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt-api</artifactId> <version>0.11.5</version> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt-impl</artifactId> <version>0.11.5</version> <scope>runtime</scope> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt-jackson</artifactId> <version>0.11.5</version> <scope>runtime</scope> </dependency> <!-- MyBatis Plus --> <dependency> <groupId>com.baomidou</groupId> <artifactId>mybatis-plus-boot-starter</artifactId> <version>3.5.3</version> </dependency> <!-- MySQL Driver --> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <scope>runtime</scope> </dependency> </dependencies> ``` #### 2. 配置 JWT 工具类 创建用于生成和解析 JWT 的工具类： ```java import io.jsonwebtoken.Claims; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; public class JwtUtil { private static final String SECRET_KEY = "your-secret-key"; public String generateToken(String username) { return Jwts.builder() .setSubject(username) .signWith(SignatureAlgorithm.HS256, SECRET_KEY) .compact(); } public Claims extractAllClaims(String token) { return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody(); } } ``` #### 3. 自定义 UserDetailsService 实现 `UserDetailsService` 接口来加载用户信息： ```java @Service public class CustomUserDetailsService implements UserDetailsService { @Autowired private UserRepository userRepository; // 使用 MyBatis Mapper 或其他方式查询数据库 @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { com.example.domain.User userEntity = userRepository.findByUsername(username); if (userEntity == null) { throw new UsernameNotFoundException("User not found"); } return new org.springframework.security.core.userdetails.User( userEntity.getUsername(), userEntity.getPassword(), AuthorityUtils.createAuthorityList(userEntity.getRoles()) ); } } ``` #### 4. 安全配置类 配置 Spring Security 并启用 JWT 身份验证： ```java @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private CustomUserDetailsService userDetailsService; @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .authorizeRequests() .antMatchers("/auth/login").permitAll() .anyRequest().authenticated() .and() .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); http.addFilterBefore(new JwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class); } @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); } } ``` #### 5. 登录控制器 提供登录接口以返回 JWT： ```java @RestController @RequestMapping("/auth") public class AuthController { @Autowired private AuthenticationManager authenticationManager; @Autowired private JwtUtil jwtUtil; @PostMapping("/login") public ResponseEntity<?> login(@RequestBody LoginRequest request) { try { authenticationManager.authenticate( new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword()) ); String token = jwtUtil.generateToken(request.getUsername()); return ResponseEntity.ok(new AuthResponse(token)); } catch (BadCredentialsException e) { return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build(); } } } @Data class LoginRequest { private String username; private String password; } @Data class AuthResponse { private String token; public AuthResponse(String token) { this.token = token; } } ``` --- ###