生成token和验证token机制

1.生成token是一个spring控制器
基于项目和项目之间的调用秘钥生成之后放redis，两小时后失效

package com.csair.openapi.controller.basic;import java.security.MessageDigest;import java.security.NoSuchAlgorithmException;
import java.util.HashMap;
import java.util.Map;
import java.util.concurrent.TimeUnit;import javax.annotation.PostConstruct;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;import com.csair.openapi.basic.annotation.WEBApi;
import com.csair.openapi.qo.sub.TokenCredential;
import com.csair.openapi.vo.sub.TokenSuccess;@RestController
@RequestMapping("/credential")
public class TokenCredentialController {@Autowiredprivate RedisTemplate<String, String> redisTemplate;private Map<String, String> key = new HashMap<String, String>();@PostConstructpublic void init() {key.put("lps", "lrKvmMg3h9c8UQsvzDn0S4X");}@RequestMapping(value = "/getToken")@ResponseBody@WEBApipublic Object export(HttpServletRequest request,HttpServletResponse response,@RequestBody TokenCredential limitsAuthority) throws Exception {TokenSuccess tokenSuccess   =  new TokenSuccess();if (limitsAuthority!=null&&limitsAuthority.getAppid()!=null&&limitsAuthority.getSecret()!=null) {//校验用户是否有权限String appid= limitsAuthority.getAppid();String secretPass =(String) key.get(appid);String secret = limitsAuthority.getSecret();if (secret.equals(secretPass)) {String Timestamp= System.currentTimeMillis()+"";String token = md5Password(appid+secretPass+System.currentTimeMillis()+Timestamp);redisTemplate.opsForValue().set(token, Timestamp,7200, TimeUnit.SECONDS);//token和验证码对应的放到redis里面 ,2小时秒过期tokenSuccess.setAccess_token(token);tokenSuccess.setExpires_in("7200");return tokenSuccess;}else{throw new RuntimeException("invalid secret");           }}throw new RuntimeException("invalid appid");}/*** 生成32位md5码* @param password* @return*/public static String md5Password(String password) {try {// 得到一个信息摘要器MessageDigest digest = MessageDigest.getInstance("md5");byte[] result = digest.digest(password.getBytes());StringBuffer buffer = new StringBuffer();// 把每一个byte 做一个与运算 0xff;for (byte b : result) {// 与运算int number = b & 0xff;// 加盐String str = Integer.toHexString(number);if (str.length() == 1) {buffer.append("0");}buffer.append(str);}// 标准的md5加密后的结果return buffer.toString();} catch (NoSuchAlgorithmException e) {e.printStackTrace();return "";}}}

2.用java自定义注解引入aop来鉴权

package com.csair.openapi.basic.annotation;import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Inherited;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;@Inherited
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface AuthToken {}

package com.csair.openapi.basic.aspect;import javax.servlet.http.HttpServletRequest;import org.apache.commons.lang3.StringUtils;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.core.Ordered;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Component;import com.csair.cocc.basic.constant.EnvironmentEnum;
import com.csair.openapi.basic.annotation.AuthToken;@Component
@Aspect
public class AuthTokenDecorator implements Ordered {private final Logger logger = LoggerFactory.getLogger(this.getClass());@Autowiredprivate RedisTemplate<String, String> redisTemplate;@Value("${environment}")private String environment;@Around("within(com.csair.**.controller.**.*) && @annotation(authToken)")public Object decorate(ProceedingJoinPoint pjp, AuthToken authToken) throws Throwable {if (EnvironmentEnum.DEV.getValue().equals(environment)) {//如果是开发环境return pjp.proceed();//这个是可以继续传输对象到Controller的逻辑}Object[] obj = pjp.getArgs();HttpServletRequest request = (HttpServletRequest) obj[0];String accessToken = request.getParameter("accessToken");logger.info("accessToken值為："+accessToken);if (StringUtils.isEmpty(accessToken)) {throw new RuntimeException("token is null");     }else {String timestamp = redisTemplate.opsForValue().get(accessToken); if (StringUtils.isEmpty(timestamp)) {throw new RuntimeException("Invalid token");        }}return pjp.proceed();}public int getOrder() {return 9;}}

引用redis的配置！


<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"xmlns:context="http://www.springframework.org/schema/context"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.1.xsd"><context:property-placeholder location="classpath:redis.properties" /><bean id="jedisPoolConfig" class="redis.clients.jedis.JedisPoolConfig"><property name="maxTotal" value="5000" /><property name="maxIdle" value="2000" /><property name="maxWaitMillis" value="4000" /><property name="testOnBorrow" value="true" /><property name="testOnReturn" value="true" /><property name="testWhileIdle" value="true" /></bean><bean id="redisSentinelConfiguration"class="org.springframework.data.redis.connection.RedisSentinelConfiguration"><property name="master"><bean class="org.springframework.data.redis.connection.RedisNode"><property name="name" value="${redis.master.name}"></property></bean></property><property name="sentinels"><set><bean class="org.springframework.data.redis.connection.RedisNode"><constructor-arg name="host" value="${redis.sentinel1.host}"></constructor-arg><constructor-arg name="port" value="${redis.sentinel1.port}"></constructor-arg></bean><bean class="org.springframework.data.redis.connection.RedisNode"><constructor-arg name="host" value="${redis.sentinel2.host}"></constructor-arg><constructor-arg name="port" value="${redis.sentinel2.port}"></constructor-arg></bean><bean class="org.springframework.data.redis.connection.RedisNode"><constructor-arg name="host" value="${redis.sentinel3.host}"></constructor-arg><constructor-arg name="port" value="${redis.sentinel3.port}"></constructor-arg></bean></set></property></bean><bean id="jedisConnectionFactory"class="org.springframework.data.redis.connection.jedis.JedisConnectionFactory"><property name="password" value="${redis.password}" /><property name="poolConfig" ref="jedisPoolConfig" /><constructor-arg ref="redisSentinelConfiguration" /></bean><bean id="redisTemplate" class="org.springframework.data.redis.core.RedisTemplate"><property name="connectionFactory" ref="jedisConnectionFactory" /><property name="keySerializer"><beanclass="org.springframework.data.redis.serializer.StringRedisSerializer" /></property><property name="valueSerializer"><beanclass="org.springframework.data.redis.serializer.StringRedisSerializer" /></property><property name="hashKeySerializer"><beanclass="org.springframework.data.redis.serializer.StringRedisSerializer" /></property><property name="hashValueSerializer"><beanclass="org.springframework.data.redis.serializer.StringRedisSerializer" /></property></bean></beans>

最重要的是Controller的入参要加上HttpServletRequest request

@RequestMapping(value = "/saveCargoPlaneUploadLpsInfo", method = RequestMethod.POST)
   @ResponseBody
   @WEBApi
   @AuthToken
   public Object saveCargoPlaneUploadLpsInfo(HttpServletRequest request,@RequestBody CargoPlaneUploadLpsInfoDto param)

生成token和验证token机制相关推荐

【Flask项目2】生成token和验证token（11）
用户登录用户登录的功能我们使用 Json Web Token(JWT) 来为登录用户生成token令牌,并返回给客户端,客户端有了令牌之后,每次访问服务器,都携带Token,后台经过验证就能知道当前 ...
jwt生成token和验证token以及获取playload的数据，实现token拦截
jwt实现流程: 1.添加依赖: <dependency><groupId>com.auth0</groupId><artifactId>java-jw ...
利用GUID/UUID生成token及验证token的正确性
本来有JWT这种生成token验证的强大工具,但有时考虑到项目的实际需求,会利用GUID/UUID来生成token,当然GUID/UUID能生成很多具有唯一性的验证结果,所以这里主要记录下GUID/U ...
token登录验证机制
jwt: json web token 数据前端秘钥前端请求数据的时候. 需要通过秘钥生成命令令牌. Token token是oAuth Token,提供的是认证和授权,认证针对用户,授权是针 ...
java客户端发送token_基于token的会话保持机制
python数据可视化数据分析与决策 63.2元 (需用券) 去购买 > session简介做过Web开发的程序员应该对Session都比较熟悉,Session是一块保存在服务器端的内存空间, ...
FLASK RESTFUL TOKEN用户验证笔记
笔记1 REST要求无状态,可以理解为没有session,而且session的存储遇到分布式集群的情况就比较难搞,所以对于用户验证目前网上大多数做法是token方式,第一次登录的时候,先提交用户名密码 ...
springboot+vue3.0+token 安全验证
springboot+vue+token安全验证目录一.说明二.后台(springboot) 1.添加依赖包 2.添加token工具类 3.创建拦截器 4.入口拦截 5.配置跨域 6.登录接口 ...
Netty SocketIO如何在客户端发起链接时验证token是否合法？
直接上代码: socketIOServer.addConnectListener(new ConnectListener() {public void onConnect(SocketIOClient ...
java token生成和验证_Java Token登录验证生成解析Token
借鉴参考 Java Token登录验证使用jjwt生成和解析JWT java基于token验证之登陆验证等什么是Token? 我的理解来说 token就是你访问服务器的口令,只要token合法, ...

生成token和验证token机制

生成token和验证token机制相关推荐

最新文章

热门文章