# kchtnp

**Repository Path**: kingdomjc/kchtnp

## Basic Information

- **Project Name**: kchtnp
- **Description**: No description available
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: dev
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2020-04-09
- **Last Updated**: 2021-06-16

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

<H1>Maven依赖项</H1>
<code>

    <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-security</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <optional>true</optional>
            </dependency>
</code>
<H1>application.yml加入令牌配置</H1>
<code>

    #jwt令牌的设置
    jwt:
      token-header: Authorization
      secret: w-eyJleHAiOjE1NDMyMDUyODUsInN1YiI6ImFkbWluIiwiY3JlYXRlZCI6MTU0MDYxMzI4N
      expiration: 7200000
      tokenHead: "Bearer "
</code>
<H1>配置解析JWT的过滤器</H1>
<code>

    package com.learning.resource.server.config;
    
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.context.SecurityContextHolder;
    import org.springframework.stereotype.Component;
    import org.springframework.web.filter.OncePerRequestFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import javax.servlet.http.HttpSession;
    import java.io.IOException;
    
    
    @Slf4j
    @Component
    public class JwtAuthenticationTokenFilter extends OncePerRequestFilter {
    
        @Autowired
        private JwtTokenConverter jwtTokenConverter;
    
        /**
         * 拿到token在本地解析并转给安全上下文用于判断
         * */
        @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
            // 获取 Request 中的请求头为 “ Authorization ” 的 token 值
            String completeToken=request.getParameter(this.jwtTokenConverter.getTokenHeader());
            HttpSession session = request.getSession();
            if(completeToken!=null){
                session.setAttribute("completeToken",completeToken);
                session.setMaxInactiveInterval((int)(this.jwtTokenConverter.getExpiration()/1000));
            }else {
                completeToken = (String) session.getAttribute("completeToken");
            }
            // 验证 值是否以"Bearer "开头
            if (completeToken != null && completeToken.startsWith(this.jwtTokenConverter.getTokenHead())) {
                // 截取token中"Bearer "后面的值，
                final String tokenValue = jwtTokenConverter.interceptCompleteToken(completeToken);
                // 根据 token值，获取认证的所有信息
                Authentication authentication = jwtTokenConverter.getAuthentication(tokenValue);
                SecurityContextHolder.getContext().setAuthentication(authentication);
            }
            chain.doFilter(request, response);
        }
    }

</code>

<H1>加入JWT转换器</H1>
<code>

    package com.learning.resource.server.config;
    
    import io.jsonwebtoken.Claims;
    import io.jsonwebtoken.Jwts;
    import io.jsonwebtoken.SignatureAlgorithm;
    import lombok.Getter;
    import lombok.Setter;
    import org.springframework.boot.context.properties.ConfigurationProperties;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.GrantedAuthority;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.stereotype.Component;
    
    import java.io.Serializable;
    import java.util.*;
    import java.util.stream.Collectors;
    
    /**
     * JWT和用户信息之间的转换
     * */
    @Getter
    @Setter
    @Component
    @SuppressWarnings("all")
    @ConfigurationProperties(prefix = "jwt")
    public class JwtTokenConverter implements Serializable {
        /**
          *  秘钥
          *
         */
        private String secret;
    
        private String tokenHeader;
    
        private String tokenHead;
        /**
         *过期时间
         */
        private Long expiration;
    
        /**
          *  从令牌中获取数据声明
          *
        */
        private Claims getClaimsFromToken(String token) {
            Claims claims=null;
            try {
                claims = Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
            } catch (Exception ignore) {
    
            }
            return claims;
        }
    
        public Authentication getAuthentication(String token){
            Authentication authentication=null;
            try{
                Claims claims = getClaimsFromToken(token);
                String username=(String)claims.get("sub");
                Collection<GrantedAuthority> authorities=((List<String>) claims.get("authorities"))
                        .stream()
                        .map(SimpleGrantedAuthority::new)
                        .collect(Collectors.toList());
                authentication = new UsernamePasswordAuthenticationToken(
                        username, null, authorities);
            }catch (Exception e) {
                e.printStackTrace();
            }
            return authentication;
        }
    
        /**
          *  截取令牌
          *
        */
        public String interceptCompleteToken(String completeToken) {
            String authToken = completeToken.substring(this.getTokenHead().length());
            return authToken;
        }
    }


</code>
<H1>配置允许任何域名跨域访问共享资源</H1>
<code>
    
    package com.learning.resource.server.config;
    
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.boot.autoconfigure.AutoConfigureBefore;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
    import org.springframework.web.servlet.config.annotation.CorsRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
    
    /**
      * <p>
      * spring mvc 配置
      * </p>
     */
    
    @Slf4j
    @Configuration
    @AutoConfigureBefore(WebSecurityConfiguration.class)
    public class SpringMvcConfiguration implements WebMvcConfigurer {
    
        @Override
        public void addCorsMappings(CorsRegistry registry) {
            log.info("跨域已设置");
            registry.addMapping("/**")
                    .allowedOrigins("*")
                    .allowedMethods("*")
                    .allowedHeaders("*")
                    .allowCredentials(true)
                    .maxAge(3600);
        }
    }
</code>

<H1>WebSecurity配置将Filter加入指定位置，以及开启web安全</H1>
<code>

    package com.learning.resource.server.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.config.http.SessionCreationPolicy;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    @Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Autowired
        private JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter;
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.cors().and().csrf().disable();
            http.addFilterBefore(jwtAuthenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
            http.headers().cacheControl();
        }
    }

</code>