一文掌握JavaWeb登录认证

{
   "username": "jinyong",
   "password": "123456"
}

{
  "code": 1,
  "msg": "success",
  "data": "eyjhbgcioijiuzi1nij9.eyjuyw1lijoi6yer5bq4iiwiawqiojesinvzzxjuyw1lijoiamluew9uzyisimv4cci6mty2mjiwnza0oh0.kkuc_cxjzj8dd063eimx4h9ojfrr6xmj-yvzawcvzco"
}

@restcontroller
public class logincontroller {
    @autowired
    private empservice empservice;
    @postmapping("/login")
    public result login(@requestbody emp emp){
        emp e = empservice.login(emp);
        return  e != null ? result.success():result.error("用户名或密码错误");
    }
}

public interface empservice {
    /**
     * 用户登录
     * @param emp
     * @return
     */
    public emp login(emp emp);
    //省略其他代码...
}

@slf4j
@service
public class empserviceimpl implements empservice {
    @autowired
    private empmapper empmapper;
    @override
    public emp login(emp emp) {
        //调用dao层功能：登录
        emp loginemp = empmapper.getbyusernameandpassword(emp);
        //返回查询结果给controller
        return loginemp;
    }   
    //省略其他代码...
}

@mapper
public interface empmapper {
    @select("select id, username, password, name, gender, image, job, entrydate, dept_id, create_time, update_time " +
            "from emp " +
            "where username=#{username} and password =#{password}")
    public emp getbyusernameandpassword(emp emp);
    //省略其他代码...
}

@slf4j
@restcontroller
public class sessioncontroller {
    //设置cookie
    @getmapping("/c1")
    public result cookie1(httpservletresponse response){
        response.addcookie(new cookie("login_username","xc")); //设置cookie/响应cookie
        return result.success();
    }
    //获取cookie
    @getmapping("/c2")
    public result cookie2(httpservletrequest request){
        cookie[] cookies = request.getcookies();
        for (cookie cookie : cookies) {
            if(cookie.getname().equals("login_username")){
                system.out.println("login_username: "+cookie.getvalue()); //输出name为login_username的cookie
            }
        }
        return result.success();
    }
}    

@slf4j
@restcontroller
public class sessioncontroller {
    @getmapping("/s1")
    public result session1(httpsession session){
        log.info("httpsession-s1: {}", session.hashcode());
        session.setattribute("loginuser", "tom"); //往session中存储数据
        return result.success();
    }
    @getmapping("/s2")
    public result session2(httpservletrequest request){
        httpsession session = request.getsession();
        log.info("httpsession-s2: {}", session.hashcode());
        object loginuser = session.getattribute("loginuser"); //从session中获取数据
        log.info("loginuser: {}", loginuser);
        return result.success(loginuser);
    }
}

<!-- jwt依赖-->
<dependency>
    <groupid>io.jsonwebtoken</groupid>
    <artifactid>jjwt</artifactid>
    <version>0.9.1</version>
</dependency>

@test
public void genjwt(){
    map<string,object> claims = new hashmap<>();
    claims.put("id",1);
    claims.put("username","tom");
    string jwt = jwts.builder()
        .setclaims(claims) //自定义内容(载荷)          
        .signwith(signaturealgorithm.hs256, "xc") //签名算法        
        .setexpiration(new date(system.currenttimemillis() + 24*3600*1000)) //有效期   
        .compact();
    system.out.println(jwt);
}

@test
public void parsejwt(){
    claims claims = jwts.parser()
        .setsigningkey("xc")//指定签名密钥（必须保证和生成令牌时使用相同的签名密钥）  
        .parseclaimsjws("eyjhbgcioijiuzi1nij9.eyjpzci6mswizxhwijoxnjcynzi5nzmwfq.fhi0ub8npbyt71uqlxddlyipptlgxbug_msugjtxtbk")
        .getbody();
    system.out.println(claims);
}

@test
public void genjwt(){
    map<string,object> claims = new hashmap<>();
    claims.put(“id”,1);
    claims.put(“username”,“tom”);
    string jwt = jwts.builder()
        .setclaims(claims) //自定义内容(载荷)          
        .signwith(signaturealgorithm.hs256, “xc”) //签名算法        
        .setexpiration(new date(system.currenttimemillis() + 60*1000)) //有效期60秒   
        .compact();
    system.out.println(jwt);
    //输出结果：eyjhbgcioijiuzi1nij9.eyjpzci6mswizxhwijoxnjczmda5nzu0fq.rcvir65akgiax-id6fjw60elfh3tptkdok7ute4a1ro
}
@test
public void parsejwt(){
    claims claims = jwts.parser()
        .setsigningkey("xc")//指定签名密钥
.parseclaimsjws("eyjhbgcioijiuzi1nij9.eyjpzci6mswizxhwijoxnjczmda5nzu0fq.rcvir65akgiax-id6fjw60elfh3tptkdok7ute4a1ro")
        .getbody();
    system.out.println(claims);
}

{
  "code": 1,
  "msg": "success",
  "data": "eyjhbgcioijiuzi1nij9.eyjuyw1lijoi6yer5bq4iiwiawqiojesinvzzxjuyw1lijoiamluew9uzyisimv4cci6mty2mjiwnza0oh0.kkuc_cxjzj8dd063eimx4h9ojfrr6xmj-yvzawcvzco"
}

{
    "code": 0,
    "msg": "not_login",
    "data": null
}

public class jwtutils {
    private static string signkey = "xc";//签名密钥
    private static long expire = 43200000l; //有效时间
    /**
     * 生成jwt令牌
     * @param claims jwt第二部分负载 payload 中存储的内容
     * @return
     */
    public static string generatejwt(map<string, object> claims){
        string jwt = jwts.builder()
                .addclaims(claims)//自定义信息（有效载荷）
                .signwith(signaturealgorithm.hs256, signkey)//签名算法（头部）
                .setexpiration(new date(system.currenttimemillis() + expire))//过期时间
                .compact();
        return jwt;
    }
    /**
     * 解析jwt令牌
     * @param jwt jwt令牌
     * @return jwt第二部分负载 payload 中存储的内容
     */
    public static claims parsejwt(string jwt){
        claims claims = jwts.parser()
                .setsigningkey(signkey)//指定签名密钥
                .parseclaimsjws(jwt)//指定令牌token
                .getbody();
        return claims;
    }
}

@restcontroller
@slf4j
public class logincontroller {
    //依赖业务层对象
    @autowired
    private empservice empservice;
    @postmapping("/login")
    public result login(@requestbody emp emp) {
        //调用业务层：登录功能
        emp loginemp = empservice.login(emp);
        //判断：登录用户是否存在
        if(loginemp !=null ){
            //自定义信息
            map<string , object> claims = new hashmap<>();
            claims.put("id", loginemp.getid());
            claims.put("username",loginemp.getusername());
            claims.put("name",loginemp.getname());
            //使用jwt工具类，生成身份令牌
            string token = jwtutils.generatejwt(claims);
            return result.success(token);
        }
        return result.error("用户名或密码错误");
    }
}

//定义一个类，实现一个标准的filter过滤器的接口
public class demofilter implements filter {
    @override //初始化方法, 只调用一次
    public void init(filterconfig filterconfig) throws servletexception {
        system.out.println("init 初始化方法执行了");
    }
    @override //拦截到请求之后调用, 调用多次
    public void dofilter(servletrequest request, servletresponse response, filterchain chain) throws ioexception, servletexception {
        system.out.println("demo 拦截到了请求...放行前逻辑");
        //放行
        chain.dofilter(request,response);
    }
    @override //销毁方法, 只调用一次
    public void destroy() {
        system.out.println("destroy 销毁方法执行了");
    }
}

@webfilter(urlpatterns = "/*") //配置过滤器要拦截的请求路径（ /* 表示拦截浏览器的所有请求 ）
public class demofilter implements filter {
    @override //初始化方法, 只调用一次
    public void init(filterconfig filterconfig) throws servletexception {
        system.out.println("init 初始化方法执行了");
    }
    @override //拦截到请求之后调用, 调用多次
    public void dofilter(servletrequest request, servletresponse response, filterchain chain) throws ioexception, servletexception {
        system.out.println("demo 拦截到了请求...放行前逻辑");
        //放行
        chain.dofilter(request,response);
    }
    @override //销毁方法, 只调用一次
    public void destroy() {
        system.out.println("destroy 销毁方法执行了");
    }
}

@servletcomponentscan
@springbootapplication
public class webmanagementapplication {
    public static void main(string[] args) {
        springapplication.run(webmanagementapplication.class, args);
    }
}

@webfilter(urlpatterns = "/*") 
public class demofilter implements filter {
    @override //初始化方法, 只调用一次
    public void init(filterconfig filterconfig) throws servletexception {
        system.out.println("init 初始化方法执行了");
    }
    @override
    public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain filterchain) throws ioexception, servletexception {
        system.out.println("demofilter   放行前逻辑.....");
        //放行请求
        filterchain.dofilter(servletrequest,servletresponse);
        system.out.println("demofilter   放行后逻辑.....");
    }
    @override //销毁方法, 只调用一次
    public void destroy() {
        system.out.println("destroy 销毁方法执行了");
    }
}

@webfilter(urlpatterns = "/login")  //拦截/login具体路径
public class demofilter implements filter {
    @override
    public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain filterchain) throws ioexception, servletexception {
        system.out.println("demofilter   放行前逻辑.....");
        //放行请求
        filterchain.dofilter(servletrequest,servletresponse);
        system.out.println("demofilter   放行后逻辑.....");
    }
    @override
    public void init(filterconfig filterconfig) throws servletexception {
        filter.super.init(filterconfig);
    }
    @override
    public void destroy() {
        filter.super.destroy();
    }
}

@webfilter(urlpatterns = "/depts/*") //拦截所有以/depts开头，后面是什么无所谓
public class demofilter implements filter {
    @override
    public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain filterchain) throws ioexception, servletexception {
        system.out.println("demofilter   放行前逻辑.....");
        //放行请求
        filterchain.dofilter(servletrequest,servletresponse);
        system.out.println("demofilter   放行后逻辑.....");
    }
    @override
    public void init(filterconfig filterconfig) throws servletexception {
        filter.super.init(filterconfig);
    }
    @override
    public void destroy() {
        filter.super.destroy();
    }
}

@webfilter(urlpatterns = "/*")
public class abcfilter implements filter {
    @override
    public void dofilter(servletrequest request, servletresponse response, filterchain chain) throws ioexception, servletexception {
        system.out.println("abc 拦截到了请求... 放行前逻辑");
        //放行
        chain.dofilter(request,response);
        system.out.println("abc 拦截到了请求... 放行后逻辑");
    }
}

@webfilter(urlpatterns = "/*") 
public class demofilter implements filter {
    @override
    public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain filterchain) throws ioexception, servletexception {
        system.out.println("demofilter   放行前逻辑.....");
        //放行请求
        filterchain.dofilter(servletrequest,servletresponse);
        system.out.println("demofilter   放行后逻辑.....");
    }
}

@webfilter(urlpatterns = "/*")
public class xbcfilter implements filter {
    @override
    public void dofilter(servletrequest request, servletresponse response, filterchain chain) throws ioexception, servletexception {
        system.out.println("xbc 拦截到了请求...放行前逻辑");
        //放行
        chain.dofilter(request,response);
        system.out.println("xbc 拦截到了请求...放行后逻辑");
    }
}

请求路径：/login
请求方式：post
接口描述：该接口用于员工登录tlias智能学习辅助系统，登录完毕后，系统下发jwt令牌。 

{
    "username": "jinyong",
    "password": "123456"
}

{
  "code": 1,
  "msg": "success",
  "data": "eyjhbgcioijiuzi1nij9.eyjuyw1lijoi6yer5bq4iiwiawqiojesinvzzxjuyw1lijoiamluew9uzyisimv4cci6mty2mjiwnza0oh0.kkuc_cxjzj8dd063eimx4h9ojfrr6xmj-yvzawcvzco"
}

{
    "code": 0,
    "msg": "not_login",
    "data": null
}

@slf4j
@webfilter(urlpatterns = "/*") //拦截所有请求
public class logincheckfilter implements filter {
    @override
    public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain chain) throws ioexception, servletexception {
        //前置：强制转换为http协议的请求对象、响应对象 （转换原因：要使用子类中特有方法）
        httpservletrequest request = (httpservletrequest) servletrequest;
        httpservletresponse response = (httpservletresponse) servletresponse;
        //1.获取请求url
        string url = request.getrequesturl().tostring();
        log.info("请求路径：{}", url); //请求路径：http://localhost:8080/login
        //2.判断请求url中是否包含login，如果包含，说明是登录操作，放行
        if(url.contains("/login")){
            chain.dofilter(request, response);//放行请求
            return;//结束当前方法的执行
        }
        //3.获取请求头中的令牌（token）
        string token = request.getheader("token");
        log.info("从请求头中获取的令牌：{}",token);
        //4.判断令牌是否存在，如果不存在，返回错误结果（未登录）
        if(!stringutils.haslength(token)){
            log.info("token不存在");
            result responseresult = result.error("not_login");
            //把result对象转换为json格式字符串 (fastjson是阿里巴巴提供的用于实现对象和json的转换工具类)
            string json = jsonobject.tojsonstring(responseresult);
            response.setcontenttype("application/json;charset=utf-8");
            //响应
            response.getwriter().write(json);
            return;
        }
        //5.解析token，如果解析失败，返回错误结果（未登录）
        try {
            jwtutils.parsejwt(token);
        }catch (exception e){
            log.info("令牌解析失败!");
            result responseresult = result.error("not_login");
            //把result对象转换为json格式字符串 (fastjson是阿里巴巴提供的用于实现对象和json的转换工具类)
            string json = jsonobject.tojsonstring(responseresult);
            response.setcontenttype("application/json;charset=utf-8");
            //响应
            response.getwriter().write(json);
            return;
        }
        //6.放行
        chain.dofilter(request, response);
    }
}

<dependency>
    <groupid>com.alibaba</groupid>
    <artifactid>fastjson</artifactid>
    <version>1.2.76</version>
</dependency>

//自定义拦截器
@component
public class logincheckinterceptor implements handlerinterceptor {
    //目标资源方法执行前执行。 返回true：放行    返回false：不放行
    @override
    public boolean prehandle(httpservletrequest request, httpservletresponse response, object handler) throws exception {
        system.out.println("prehandle .... ");
        return true; //true表示放行
    }
    //目标资源方法执行后执行
    @override
    public void posthandle(httpservletrequest request, httpservletresponse response, object handler, modelandview modelandview) throws exception {
        system.out.println("posthandle ... ");
    }
    //视图渲染完毕后执行，最后执行
    @override
    public void aftercompletion(httpservletrequest request, httpservletresponse response, object handler, exception ex) throws exception {
        system.out.println("aftercompletion .... ");
    }
}

@configuration  
public class webconfig implements webmvcconfigurer {
    //自定义的拦截器对象
    @autowired
    private logincheckinterceptor logincheckinterceptor;
    @override
    public void addinterceptors(interceptorregistry registry) {
       //注册自定义拦截器对象
        registry.addinterceptor(logincheckinterceptor).addpathpatterns("/**");//设置拦截器拦截的请求路径（ /** 表示拦截所有请求）
    }
}

@configuration  
public class webconfig implements webmvcconfigurer {
    //拦截器对象
    @autowired
    private logincheckinterceptor logincheckinterceptor;
    @override
    public void addinterceptors(interceptorregistry registry) {
        //注册自定义拦截器对象
        registry.addinterceptor(logincheckinterceptor)
                .addpathpatterns("/**")//设置拦截器拦截的请求路径（ /** 表示拦截所有请求）
                .excludepathpatterns("/login");//设置不拦截的请求路径
    }
}

@configuration 
public class webconfig implements webmvcconfigurer {
    //拦截器对象
    @autowired
    private logincheckinterceptor logincheckinterceptor;
    @override
    public void addinterceptors(interceptorregistry registry) {
       //注册自定义拦截器对象
        registry.addinterceptor(logincheckinterceptor)
                .addpathpatterns("/*")
                .excludepathpatterns("/login");//设置不拦截的请求路径
    }
}

@component
public class logincheckinterceptor implements handlerinterceptor {
    @override
    public boolean prehandle(httpservletrequest request, httpservletresponse response, object handler) throws exception {
        system.out.println("prehandle .... ");
        return true; //true表示放行
    }
    @override
    public void posthandle(httpservletrequest request, httpservletresponse response, object handler, modelandview modelandview) throws exception {
        system.out.println("posthandle ... ");
    }
    @override
    public void aftercompletion(httpservletrequest request, httpservletresponse response, object handler, exception ex) throws exception {
        system.out.println("aftercompletion .... ");
    }
}

@configuration  
public class webconfig implements webmvcconfigurer {
    //拦截器对象
    @autowired
    private logincheckinterceptor logincheckinterceptor;
    @override
    public void addinterceptors(interceptorregistry registry) {
        //注册自定义拦截器对象
        registry.addinterceptor(logincheckinterceptor)
                .addpathpatterns("/**")//拦截所有请求
                .excludepathpatterns("/login");//不拦截登录请求
    }
}

@webfilter(urlpatterns = "/*") 
public class demofilter implements filter {
    @override
    public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain filterchain) throws ioexception, servletexception {
        system.out.println("demofilter   放行前逻辑.....");
        //放行请求
        filterchain.dofilter(servletrequest,servletresponse);
        system.out.println("demofilter   放行后逻辑.....");
    }
}

//自定义拦截器
@component //当前拦截器对象由spring创建和管理
@slf4j
public class logincheckinterceptor implements handlerinterceptor {
    //前置方式
    @override
    public boolean prehandle(httpservletrequest request, httpservletresponse response, object handler) throws exception {
        system.out.println("prehandle .... ");
        //1.获取请求url
        //2.判断请求url中是否包含login，如果包含，说明是登录操作，放行
        //3.获取请求头中的令牌（token）
        string token = request.getheader("token");
        log.info("从请求头中获取的令牌：{}",token);
        //4.判断令牌是否存在，如果不存在，返回错误结果（未登录）
        if(!stringutils.haslength(token)){
            log.info("token不存在");
            //创建响应结果对象
            result responseresult = result.error("not_login");
            //把result对象转换为json格式字符串 (fastjson是阿里巴巴提供的用于实现对象和json的转换工具类)
            string json = jsonobject.tojsonstring(responseresult);
            //设置响应头（告知浏览器：响应的数据类型为json、响应的数据编码表为utf-8）
            response.setcontenttype("application/json;charset=utf-8");
            //响应
            response.getwriter().write(json);
            return false;//不放行
        }
        //5.解析token，如果解析失败，返回错误结果（未登录）
        try {
            jwtutils.parsejwt(token);
        }catch (exception e){
            log.info("令牌解析失败!");
            //创建响应结果对象
            result responseresult = result.error("not_login");
            //把result对象转换为json格式字符串 (fastjson是阿里巴巴提供的用于实现对象和json的转换工具类)
            string json = jsonobject.tojsonstring(responseresult);
            //设置响应头
            response.setcontenttype("application/json;charset=utf-8");
            //响应
            response.getwriter().write(json);
            return false;
        }
        //6.放行
        return true;
    }

@configuration  
public class webconfig implements webmvcconfigurer {
    //拦截器对象
    @autowired
    private logincheckinterceptor logincheckinterceptor;
    @override
    public void addinterceptors(interceptorregistry registry) {
       //注册自定义拦截器对象
        registry.addinterceptor(logincheckinterceptor)
                .addpathpatterns("/**")
                .excludepathpatterns("/login");
    }
}