自定义jwt实现spring cloud nosession
JWT实现在网关模块，网关的路由是默认配置。 jwt 生成、验证依赖 io.jsonwebtokenjjwt0.7.0 最核心的配置是在spring security中加入我们token校验机制的fiter：JwtAuthenticationTokenFilter protectedvoiddoFilterInternal( HttpServletRequestrequest, HttpServletResponseresponse, FilterChainchain)throwsServletException,IOException{ StringauthHeader=request.getHeader(this.tokenHeader); if(authHeader!=null&&authHeader.startsWith(tokenHead)){ StringauthToken=authHeader.substring(tokenHead.length());//Thepartafter"Bearer" Stringusername=jwtTokenUtil.getUsernameFromToken(authToken); logger.info("checkingauthentication"+username); if(username!=null&&SecurityContextHolder.getContext().getAuthentication()==null){ UserDetailsuserDetails=this.userDetailsService.loadUserByUsername(username); if(jwtTokenUtil.validateToken(authToken,userDetails)){ UsernamePasswordAuthenticationTokenauthentication=newUsernamePasswordAuthenticationToken( userDetails,null,userDetails.getAuthorities()); authentication.setDetails(newWebAuthenticationDetailsSource().buildDetails( request)); logger.info("authenticateduser"+username+",settingsecuritycontext"); SecurityContextHolder.getContext().setAuthentication(authentication); } } } chain.doFilter(request,response); } 在看我们的spring security 配置 protectedvoidconfigure(HttpSecurityhttpSecurity)throwsException{ httpSecurity //由于使用的是JWT，我们这里不需要csrf .csrf().disable() .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() //基于token，所以不需要session .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() .authorizeRequests() //.antMatchers(HttpMethod.OPTIONS,"/**").permitAll() //允许对于网站静态资源的无授权访问 .antMatchers( HttpMethod.GET, "/", "/*.html", "/favicon.ico", "/**/*.html", "/**/*.css", "/**/*.js" ).permitAll() .antMatchers("/auth/**").permitAll() .anyRequest().authenticated(); //添加JWTfilter httpSecurity .addFilterBefore(authenticationTokenFilterBean(),UsernamePasswordAuthenticationFilter.class); //禁用缓存 httpSecurity.headers().cacheControl(); } 获取token POST http://localhost:8080/auth Content-Type:application/json {"username":"1234","password":"1234"} --- 结果 { "token":"eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxMjM0IiwiY3JlYXRlZCI6MTUwMzQxMzMwODkxOCwiZXhwIjoxNTA0MDE4MTA4fQ.jQc5MRdgKfi5ds1N0ZSsxkunQQVkFuGJ7Giv1_JrjTiKsu3h7UwE8vjU5wVPaipM_zkbHaMpRqXvF__ci5p7aw" } 访问资源 GET http://localhost:8080/user-service/bizUser/getUserScore Content-Type:application/json Authorization:BearereyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxMjM0IiwiY3JlYXRlZCI6MTUwMzQxMzMwODkxOCwiZXhwIjoxNTA0MDE4MTA4fQ.jQc5MRdgKfi5ds1N0ZSsxkunQQVkFuGJ7Giv1_JrjTiKsu3h7UwE8vjU5wVPaipM_zkbHaMpRqXvF__ci5p7aw --- 结果 [ { "id":11, "username":"123", "password":"456", "scoreList":[ { "id":1, "score":100 } ] } ] 不加认证token { "timestamp":1503413947608, "status":401, "error":"Unauthorized", "message":"手动滑稽( ´-ω･)▄︻┻┳══━一", "path":"/user-service/bizUser/getUserScore" } 参考https://github.com/wpcfan/spring-boot-tut 详细整合源码：springcloud-zuul-jwt 和 springboot-mybatis-plus
