springboot解析token用filter

### 如何在 Spring Boot 中通过 Filter 解析 JWT Token #### 创建自定义过滤器类 为了实现JWT解析功能，在Spring Boot中创建一个名为`JwtRequestFilter`的Java类。此类继承于`OncePerRequestFilter`，这允许每次HTTP请求都经过此过滤器处理。 ```java import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter; @Component public class JwtRequestFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { final String authorizationHeader = request.getHeader("Authorization"); String jwt = null; String username = null; if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) { jwt = authorizationHeader.substring(7); try { Jwts.parser().setSigningKey("secret").parseClaimsJws(jwt).getBody(); username = claims.getSubject(); // 获取用户名 if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) { UserDetails userDetails = this.myUserDetailsService.loadUserByUsername(username); if (jwtUtil.validateToken(jwt, userDetails)) { // 验证token有效性 UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()); authentication.setDetails(new WebAuthenticationDetailsSource() .buildDetails(request)); SecurityContextHolder.getContext().setAuthentication(authentication); // 设置当前登录用户信息 } } } catch (Exception e){ logger.error("Error parsing the token",e); } } chain.doFilter(request,response); } } ``` 上述代码展示了如何从HTTP头获取授权信息并尝试从中提取有效的JWT令牌[^1]。一旦成功解码，则进一步确认该用户的认证状态，并利用`SecurityContextHolder`设置安全上下文中的身份验证对象。 #### 注册过滤器至Spring容器 为了让这个新的过滤器生效，还需要配置它成为全局过滤链的一部分。通常是在扩展了`WebSecurityConfigurerAdapter`的安全配置文件里完成这项工作： ```java @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { private final JwtRequestFilter jwtRequestFilter; public SecurityConfig(JwtRequestFilter jwtRequestFilter) { this.jwtRequestFilter = jwtRequestFilter; } @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable(). authorizeRequests().antMatchers("/authenticate").permitAll(). anyRequest().authenticated(). and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS). and().addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class); } ... } ``` 这段配置禁用了CSRF防护机制（因为RESTful API通常是无状态的），开放了特定路径供公共访问，其余所有请求都需要被认证才能继续执行；最后一步就是把之前编写的`JwtRequestFilter`注册进来作为前置过滤器[^2]。