token 简单理解就是 加密 解密的一个过程

JavaWebToken（加密解密工具）

public class JavaWebToken {

    private static Logger log = LoggerFactory.getLogger(JavaWebToken.class);

    //该方法使用HS256算法和Secret:bankgl生成signKey    private static Key getKeyInstance() {        //We will sign our JavaWebToken with our ApiKey secret        SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;        byte[] apiKeySecretBytes = DatatypeConverter.parseBase64Binary("bankgl");        Key signingKey = new SecretKeySpec(apiKeySecretBytes, signatureAlgorithm.getJcaName());        return signingKey;    }

    //使用HS256签名算法和生成的signingKey最终的Token,claims中是有效载荷 public static String createJavaWebToken(Map<String, Object> claims) { return Jwts.builder().setClaims(claims).signWith(SignatureAlgorithm.HS256, getKeyInstance()).compact(); }

 //解析Token，同时也能验证Token，当验证失败返回null public static Map<String, Object> parserJavaWebToken(String jwt) { try { Map<String, Object> jwtClaims = Jwts.parser().setSigningKey(getKeyInstance()).parseClaimsJws(jwt).getBody(); return jwtClaims; } catch (Exception e) { log.error("json web token verify failed"); return null; } }}

JavaWebInterceptor（拦截器）

public class JavaWebInterceptor implements HandlerInterceptor {    @Override    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {        response.setContentType("multipart/form-data");        response.setCharacterEncoding("UTF-8");        response.setContentType("text/html");        PrintWriter printwriter = new PrintWriter(response.getOutputStream());        String token = request.getParameter("token");        response.setHeader("token", token);        printwriter.println("token:" + token);        if (null != JavaWebToken.parserJavaWebToken(token)) {            Map<String, Object> tokenMapVal = JavaWebToken.parserJavaWebToken(token);//解析token            for (String key : tokenMapVal.keySet()) {                String value = (String) tokenMapVal.get(key);                printwriter.println("解析的内容:(key:" + key + " value:" + value + ")");            }            String endTime=tokenMapVal.get("times").toString();            long currentTime=System.currentTimeMillis();            printwriter.println("当前时间"+currentTime);            printwriter.println("结束时间"+endTime);            if(Long.valueOf(endTime).longValue()<=currentTime){                printwriter.println("token失效,请重新获取token"); printwriter.flush(); printwriter.close(); return false; } if (tokenMapVal.get("passwd").equals("123456")){ printwriter.println("登陆验证成功"); }else{ printwriter.println("登陆验证失败"); } printwriter.flush(); printwriter.close(); return true; } else { printwriter.println("没有token信息"); printwriter.flush(); printwriter.close(); return false; }

 }

 @Override public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {

 }

 @Override public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {

 }}spring-mv.xml(配置拦截器)

<mvc:interceptor>   <mvc:mapping path="/hello/ai"/>   <bean class="com.sun.test.aircraft.token.JavaWebInterceptor"/></mvc:interceptor>

controller(请求数据)

@RequestMapping("/token")public String token(Model model, HttpServletRequest request, HttpServletResponse response){    Map<String,Object> map=new HashMap<String,Object>();    map.put("passwd","123456");//负载    map.put("times","1000");//负载    String token=JavaWebToken.createJavaWebToken(map);//创建token    model.addAttribute("token",token);    return "redirect:/hello/ai";}引入的jar 包：

<dependency>    <groupId>com.auth0</groupId>    <artifactId>java-jwt</artifactId>    <version>3.1.0</version></dependency><dependency>    <groupId>io.jsonwebtoken</groupId>    <artifactId>jjwt</artifactId>    <version>0.6.0</version></dependency>

效果:

做的完善功能远不止这一点比如：1、用户登陆成功后生成的token放到数据库中,每次登陆的时候拿token对比2、把token放到头信息里3、在负载中加入token的有效时间(也可利用redis的ttl设置有效时间，方式很多种)，token失效后重新获取，重新存入数据库(比如：redis,mongodb)中 等

如果看官有认为我理解的错误的地方，可以留下你的评论，我好改正,感谢！