1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
| /**
* jwt工具类
* @author daiyp
* @date 2018-9-26
*/
@EnableConfigurationProperties(JwtConfig.class)
@Configuration
@Slf4j
public class JwtUtil {
@Autowired
private RedisTemplate redisTemplate;
@Autowired
private JwtConfig jwtConfig;
/**
* 创建JWT
*
* @param authentication 用户认证信息
* @param rememberMe 记住我
* @return JWT
*/
public String createJWT(Authentication authentication, Boolean rememberMe, Boolean isRefresh) {
SecurityUser user = (SecurityUser) authentication.getPrincipal();
return createJWT(isRefresh, rememberMe, user.getId(), user.getUsername(), user.getRoles(), user.getMenus(), user.getAuthorities());
}
/**
* 创建JWT
*
* @param id 用户id
* @param subject 用户名
* @param roles 用户角色
* @param authorities 用户权限
* @return JWT
*/
public String createJWT(Boolean isRefresh,
Boolean rememberMe,
Long id,
String subject,
List<Role> roles,
List<MenuRight> menus,
Collection<? extends GrantedAuthority> authorities) {
Date now = new Date();
JwtBuilder builder = Jwts.builder()
.setId(id.toString())
.setSubject(subject)
.setIssuedAt(now)
.signWith(SignatureAlgorithm.HS256, jwtConfig.getSecret())
.claim("roles", roles)
// .claim("perms", menus)
.claim("authorities", authorities);
// 设置过期时间
Long ttl = rememberMe ? jwtConfig.getRemember() : jwtConfig.getTtl();
String redisKey;
if (isRefresh){
ttl *= 3;
redisKey = Constant.REDIS_JWT_REFRESH_TOKEN_KEY_PREFIX + subject;
}else{
redisKey = Constant.REDIS_JWT_TOKEN_KEY_PREFIX + subject;
}
if (ttl > 0) {
builder.setExpiration(DateUtil.offsetMillisecond(now, ttl.intValue()));
}
String jwt = builder.compact();
// 将生成的JWT保存至Redis
redisTemplate.opsForValue().set(redisKey, jwt, ttl, TimeUnit.MILLISECONDS);
return jwt;
}
/**
* 解析JWT
*
* @param jwt JWT
* @return {@link Claims}
*/
public Claims parseJWT(String jwt, Boolean isRefresh) {
try {
Claims claims = Jwts.parser()
.setSigningKey(jwtConfig.getSecret())
.parseClaimsJws(jwt)
.getBody();
String username = claims.getSubject();
String redisKey = (isRefresh ? Constant.REDIS_JWT_REFRESH_TOKEN_KEY_PREFIX : Constant.REDIS_JWT_TOKEN_KEY_PREFIX)
+ username;
// 校验redis中的JWT是否存在
Long expire = redisTemplate.getExpire(redisKey, TimeUnit.MILLISECONDS);
if (Objects.isNull(expire) || expire <= 0) {
throw new CustomException(ResultCode.TOKEN_EXPIRED);
}
// 校验redis中的JWT是否与当前的一致，不一致则代表用户已注销/用户在不同设备登录，均代表JWT已过期
String redisToken = (String) redisTemplate.opsForValue().get(redisKey);
if (!StrUtil.equals(jwt, redisToken)) {
throw new CustomException(ResultCode.TOKEN_OUT_OF_CTRL);
}
return claims;
} catch (ExpiredJwtException e) {
log.error("Token 已过期");
throw new CustomException(ResultCode.TOKEN_EXPIRED);
} catch (UnsupportedJwtException e) {
log.error("不支持的 Token");
throw new CustomException(ResultCode.TOKEN_PARSE_ERROR);
} catch (MalformedJwtException e) {
log.error("Token 无效");
throw new CustomException(ResultCode.TOKEN_PARSE_ERROR);
} catch (IllegalArgumentException e) {
log.error("Token 参数不存在");
throw new CustomException(ResultCode.TOKEN_PARSE_ERROR);
}
}
/**
* 设置JWT过期
*
* @param request 请求
*/
public void invalidateJWT(HttpServletRequest request) {
String jwt = getJwtFromRequest(request);
String username = getUsernameFromJWT(jwt, false);
// 从redis中清除JWT
redisTemplate.delete(Constant.REDIS_JWT_REFRESH_TOKEN_KEY_PREFIX + username);
redisTemplate.delete(Constant.REDIS_JWT_TOKEN_KEY_PREFIX + username);
}
/**
* 从 request 的 header 中获取 JWT
*
* @param request 请求
* @return JWT
*/
public String getJwtFromRequest(HttpServletRequest request) {
String bearerToken = request.getHeader("Authorization");
if (StrUtil.isNotBlank(bearerToken) && bearerToken.startsWith("Bearer ")) {
return bearerToken.substring(7);
}
return null;
}
/**
* 根据 jwt 获取用户名
*
* @param jwt JWT
* @return 用户名
*/
public String getUsernameFromJWT(String jwt, Boolean isRefresh) {
Claims claims = parseJWT(jwt, isRefresh);
return claims.getSubject();
}
public Map<String, String> refreshJWT(String token) {
Claims claims = parseJWT(token, true);
// 获取签发时间
Date lastTime = claims.getExpiration();
// 1. 判断refreshToken是否过期
if (!new Date().before(lastTime)){
throw new CustomException(ResultCode.TOKEN_EXPIRED);
}
// 2. 在redis中删除之前的token和refreshToken
String username = claims.getSubject();
// redisTemplate.delete(Constant.REDIS_JWT_REFRESH_TOKEN_KEY_PREFIX + username);
// redisTemplate.delete(Constant.REDIS_JWT_TOKEN_KEY_PREFIX + username);
// 3. 创建新的token和refreshToken并存入redis
String jwtToken = createJWT(false, false, Long.parseLong(claims.getId()), username,
(List<Role>) claims.get("roles"), null, (Collection<? extends GrantedAuthority>) claims.get("authorities"));
String refreshJwtToken = createJWT(true, false, Long.parseLong(claims.getId()), username,
(List<Role>) claims.get("roles"), null, (Collection<? extends GrantedAuthority>) claims.get("authorities"));
Map<String, String> map = new HashMap<>();
map.put("token", jwtToken);
map.put("refreshToken", refreshJwtToken);
return map;
}
/**
*
* 功能：生成 jwt token<br/>
* @param name实例名
* @param param需要保存的参数
* @param secret秘钥
* @param expirationtime过期时间(5分钟 5*60*1000)
* @return
*
*/
public static String sign(String name, Map<String,Object> param, String secret, Long expirationtime){
String JWT = Jwts.builder()
.setClaims(param)
.setSubject(name)
.setExpiration(new Date(System.currentTimeMillis() + expirationtime))
.signWith(SignatureAlgorithm.HS256,secret)
.compact();
return JWT;
}
/**
*
* 功能：解密 jwt<br/>
* @param JWTtoken字符串
* @param secret秘钥
* @return
* @exception
*
*/
public static Claims verify(String JWT, String secret){
Claims claims = Jwts.parser()
.setSigningKey(secret)
.parseClaimsJws(JWT)
.getBody();
return claims;
}
public static Object getValueFromToken(String jwt,String key, String secret){
return verify(jwt, secret).get(key);
}
}
|
