/*** @author: 阮胜* @date: 2018/7/10 8:42*/
public class JwtLoginFilter extends AbstractAuthenticationProcessingFilter {private static final String POST = "POST";private AuthenticationSuccessHandler successHandler = new JwtLoginSucessHandler();private AuthenticationFailureHandler failureHandler = new JwtLoginFailureHandler();public JwtLoginFilter(AuthenticationManager authenticationManager) {super(new AntPathRequestMatcher("/user/login", "POST"));setAuthenticationManager(authenticationManager);}@Overridepublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)throws AuthenticationException, IOException, ServletException {if (!request.getMethod().equals(POST)) {throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());}String username = request.getParameter("username");String password = request.getParameter("password");if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password)) {PrintWriter writer = response.getWriter();writer.write("用户名或者密码为空");writer.close();return null;}username = username.trim();UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);authRequest.setDetails(authenticationDetailsSource.buildDetails(request));return this.getAuthenticationManager().authenticate(authRequest);}@Overrideprotected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {JwtTokenUtil jwtTokenUtil = new JwtTokenUtil();JwtToken jwtToken = new JwtToken(authResult.getName(), authResult.getAuthorities().iterator().next().toString(), jwtTokenUtil.generateExpirationDate());String jwtTokenStr = jwtTokenUtil.generateToken(jwtToken);response.addHeader("Authorization", jwtTokenStr);successHandler.onAuthenticationSuccess(request, response, authResult);}@Overrideprotected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {failureHandler.onAuthenticationFailure(request, response, failed);}public void setSuccessHandler(AuthenticationSuccessHandler successHandler) {this.successHandler = successHandler;}public void setFailureHandler(AuthenticationFailureHandler failureHandler) {this.failureHandler = failureHandler;}
}

/*** @author: 阮胜* @date: 2018/7/10 10:44*/
public class JwtAuthenticationFilter extends BasicAuthenticationFilter {public JwtAuthenticationFilter(AuthenticationManager authenticationManager) {super(authenticationManager);}@Autowiredprivate JwtTokenUtil jwtTokenUtil;@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {String jwtTokenStr = request.getHeader("Authorization");if (!StringUtils.isEmpty(jwtTokenStr)) {try {if (!jwtTokenUtil.validateToken(jwtTokenStr)) {throw new InvalidJwtTokenException();}JwtToken jwtToken = jwtTokenUtil.parseJwtToken(jwtTokenStr);UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(jwtToken.getUsername(), null, AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_".concat(jwtToken.getRole())));SecurityContextHolder.getContext().setAuthentication(authenticationToken);} catch (Exception e) {sendError(response, "无效的Token");return;}}chain.doFilter(request, response);}private void sendError(HttpServletResponse response, String msg) throws IOException {response.setStatus(HttpServletResponse.SC_BAD_REQUEST);response.setContentType("text/plain;charset=utf-8");PrintWriter writer = response.getWriter();writer.write(msg);writer.close();}
}

/*** @author: 阮胜* @date: 2018/7/10 8:33*/
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {private final AccessDeniedHandler accessDeniedHandler;private final AuthenticationEntryPoint authenticationEntryPoint;private final UserDetailServiceImpl userDetailsService;public SecurityConfig(AccessDeniedHandler accessDeniedHandler, AuthenticationEntryPoint authenticationEntryPoint, UserDetailServiceImpl userDetailsService) {this.accessDeniedHandler = accessDeniedHandler;this.authenticationEntryPoint = authenticationEntryPoint;this.userDetailsService = userDetailsService;}@Beanpublic PasswordEncoder passwordEncoder() {return new DefaultEncoder();}@Beanpublic JwtLoginFilter jwtLoginFilter() throws Exception {JwtLoginFilter jwtLoginFilter = new JwtLoginFilter(authenticationManager());jwtLoginFilter.setAuthenticationSuccessHandler((request, response, authentication) -> {System.out.println("success");});jwtLoginFilter.setAuthenticationFailureHandler((request, response, exception) -> {System.out.println("false");});return jwtLoginFilter;}@Beanpublic JwtAuthenticationFilter jwtAuthenticationFilter() throws Exception {return new JwtAuthenticationFilter(authenticationManager());}@Overrideprotected void configure(HttpSecurity http) throws Exception {http.authorizeRequests().antMatchers("/admin", "/admin/info").hasRole("ADMIN").anyRequest().permitAll().and().userDetailsService(userDetailsService)//如果已经登录,但没有访问资源的权限,则调用该Handler
                .exceptionHandling().accessDeniedHandler(accessDeniedHandler)//如果未登录,没有权限则调用该EntryPoint
                .authenticationEntryPoint(authenticationEntryPoint)// 无状态的Session机制（即Spring不使用HTTPSession），对于所有的请求都做权限校验
                .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)//关闭跨域保护
                .and().csrf().disable();//把自己写的2个filter加入到过滤器链中http.addFilterBefore(jwtLoginFilter(), UsernamePasswordAuthenticationFilter.class).addFilter(jwtAuthenticationFilter());}
}

package com.example.springsecurityjwtdemo.util;import com.example.springsecurityjwtdemo.exception.InvalidJwtTokenException;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;import java.io.Serializable;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;/*** @author 阮胜* @date 2018/7/5 21:21*/
@Component
public class JwtTokenUtil implements Serializable {private static final long serialVersionUID = -3301605591108950415L;public static final String USERNAME = "username";public static final String ROLE = "role";public static final String CREATED_DATE = "createdDate";private static final String SECRET = "jwt_secret";private static final int EXPIRED_TIME_SECONDS = 60 * 60 * 24 * 7;public JwtToken parseJwtToken(String token) throws InvalidJwtTokenException {Claims claims = obtainClaims(token);if (claims == null) {throw new InvalidJwtTokenException();}return new JwtToken(claims.get(USERNAME).toString(), claims.get(ROLE).toString(), claims.get(CREATED_DATE, Date.class));}public String obtainUsername(String token) {String username;try {final Claims claims = obtainClaims(token);username = claims.getSubject();} catch (Exception e) {username = null;}return username;}public Date obtainExpiredDate(String token) {Date expiration;try {final Claims claims = obtainClaims(token);expiration = claims.getExpiration();} catch (Exception e) {expiration = null;}return expiration;}private Claims obtainClaims(String token) {Claims claims;try {claims = Jwts.parser().setSigningKey(SECRET).parseClaimsJws(token).getBody();} catch (Exception e) {claims = null;}return claims;}public Date generateExpirationDate() {long expired = System.currentTimeMillis() + EXPIRED_TIME_SECONDS * 1000;return new Date(expired);}private boolean isTokenExpired(String token) {final Date expiration = obtainExpiredDate(token);return expiration.after(new Date());}public String generateToken(UserDetails userDetails) {return generateToken(new JwtToken(userDetails.getUsername(), userDetails.getAuthorities().iterator().next().toString(), new Date()));}private String generateToken(Map<String, Object> claims) {return Jwts.builder().setClaims(claims).setExpiration(generateExpirationDate()).signWith(SignatureAlgorithm.HS512, SECRET).compact();}public String generateToken(JwtToken jwtToken) {HashMap<String, Object> tokenMap = new HashMap<>(3);tokenMap.put(JwtTokenUtil.USERNAME, jwtToken.getUsername());tokenMap.put(JwtTokenUtil.CREATED_DATE, jwtToken.getExpiredDate());tokenMap.put(JwtTokenUtil.ROLE, jwtToken.getRole());return generateToken(tokenMap);}public boolean validateToken(String token) {Date expiredDate = obtainExpiredDate(token);return expiredDate != null && expiredDate.after(new Date());}
}

package com.example.springsecurityjwtdemo.util;import lombok.Data;import java.util.Date;/*** @author 阮胜* @date 2018/7/5 20:54*/
@Data
public class JwtToken {private String username;private String role;private Date expiredDate;public JwtToken() {}public JwtToken(String username, String role, Date expiredDate) {this.username = username;this.role = role;this.expiredDate = expiredDate;}
}