<dependency><groupId>com.auth0</groupId><artifactId>java-jwt</artifactId><version>3.5.0</version>
</dependency>

`@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface TokenRequired {boolean required() default true;
}

`@Data
@AllArgsConstructor
@NoArgsConstructor
public class User {String Id;String username;String password;
}

`public class JwtUtil {//过期时间15分钟private static final long EXPIRE_TIME = 15*60*1000;//生成签名,15分钟后过期public static String sign(String username,String userId,String password){//过期时间Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);//使用用户密码作为私钥进行加密Algorithm algorithm = Algorithm.HMAC256(password);//设置头信息HashMap<String, Object> header = new HashMap<>(2);header.put("typ", "JWT");header.put("alg", "HS256");//附带username和userID生成签名return JWT.create().withHeader(header).withClaim("userId",userId).withClaim("username",username).withExpiresAt(date).sign(algorithm);}//校验tokenpublic static boolean verity(String token,String password){try {Algorithm algorithm = Algorithm.HMAC256(password);JWTVerifier verifier = JWT.require(algorithm).build();verifier.verify(token);return true;} catch (IllegalArgumentException e) {return false;} catch (JWTVerificationException e) {return false;}}
}

`@Service("UserService")
public class UserService {@AutowiredUserMapper userMapper;public String login(String name, String password) {String token = null;try {//校验用户是否存在User user = userMapper.findByUsername(name);if(user == null){ResultDTO.failure(new ResultError(UserError.EMP_IS_NULL_EXIT));}else{//检验用户密码是否正确if(!user.getPassword().equals(password)){ResultDTO.failure(new ResultError(UserError.PASSWORD_OR_NAME_IS_ERROR));}else {// 生成token，将 user id 、userName保存到 token 里面token = JwtUtil.sign(user.getUsername(),user.getId(),user.getPassword());}}} catch (Exception e) {e.printStackTrace();}return token;}
}

 `public class AuthenticationInterceptor implements HandlerInterceptor {@AutowiredUserService userService;@Overridepublic boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object object) throws Exception {// 从 http 请求头中取出 tokenString token = httpServletRequest.getHeader("token");// 如果不是映射到方法直接通过if(!(object instanceof HandlerMethod)){return true;}HandlerMethod handlerMethod=(HandlerMethod)object;Method method=handlerMethod.getMethod();//检查有没有需要用户权限的注解if (method.isAnnotationPresent(TokenRequired.class)) {TokenRequired userLoginToken = method.getAnnotation(TokenRequired.class);if (userLoginToken.required()) {// 执行认证if (token == null) {throw new RuntimeException("无token，请重新登录");}// 获取 token 中的 user idString userId;try {userId = JWT.decode(token).getClaim("userId").asString();} catch (JWTDecodeException j) {throw new RuntimeException("401");}User user = userService.findUserById(userId);if (user == null) {throw new RuntimeException("用户不存在，请重新登录");}// 验证 tokentry {if(!JwtUtil.verity(token,user.getPassword())){throw new RuntimeException("无效的令牌");}} catch (JWTVerificationException e) {throw new RuntimeException("401");}return true;}}return true;}@Overridepublic void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {}@Overridepublic void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {}
}

`@Configuration
public class InterceptorConfig implements WebMvcConfigurer {@Beanpublic AuthenticationInterceptor authenticationInterceptor() {return new AuthenticationInterceptor();}@Overridepublic void addInterceptors(InterceptorRegistry registry) {// 将我们上步定义的实现了HandlerInterceptor接口的拦截器实例authenticationInterceptor添加InterceptorRegistration中，并设置过滤规则，所有请求都要经过authenticationInterceptor拦截。registry.addInterceptor(authenticationInterceptor()).addPathPatterns("/**");}
}

`@RestController
@RequestMapping("user")
public class UserController {@AutowiredUserService userService;/*** 用户登录* @param user* @return*/@PostMapping("/login")public ResultDTO login( User user){String token = userService.login(user.getUsername(), user.getPassword());if (token == null) {return ResultDTO.failure(new ResultError(UserError.PASSWORD_OR_NAME_IS_ERROR));}Map<String, String> tokenMap = new HashMap<>();tokenMap.put("token", token);return ResultDTO.success(tokenMap);}@TokenRequired@GetMapping("/hello")public String getMessage(){return "你好哇，我是小码仔";}
}
不加注解的话默认不验证，登录接口一般是不验证的。所以我在getMessage()中加上了登录注解，说明该接口必须登录获取token后，在请求头中加上token并通过验证才可以访问。

此时token已失效，返回：无效的令牌。