vue+springboot+shiro+jwt实现登录功能-编程学习网

1.导入依赖
2.JWTToken 替换 Shiro 原生 Token
3.JWT token 工具类，提供JWT生成、校验、获取token存储的信息
4.JWTFilter请求拦截
5.登录授权realm
6.shiro配置
7.登录web端
8.异常处理
9.缓存调用登录接口传过来的token
10.请求头设置，带上token
11.生产环境nginx配置

公司开发的系统原先的用户信息是基于shiro session 进行管理，但是session不适用于app端，并且服务器重启后需要重新登录。需要改造将shiro和jwt进行整合，实现通过token登录。

1.导入依赖

<dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>3.2.0</version>
        </dependency>

2.JWTToken 替换 Shiro 原生 Token

import org.apache.shiro.authc.AuthenticationToken;
public class JWTToken implements AuthenticationToken {
    // 密钥
    private String token;
    public JWTToken(String token) {
        this.token = token;
    }
    @Override
    public Object getPrincipal() {
        return token;
    public Object getCredentials() {
}

3.JWT token 工具类，提供JWT生成、校验、获取token存储的信息

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.hxkg.datafusion.controller.FlieController;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;
import java.io.UnsupportedEncodingException;
import java.util.Date;

@ConfigurationProperties(prefix = "jwt")
@Component
public class JWTUtil {
    private static Logger LOG = LoggerFactory.getLogger(FlieController.class);
    //过期时间
    private static Long expire;
    // 秘钥
    private static String secret;
    
    public static boolean verify(String token, String userName) {
        try {
            //根据密码生成JWT效验器
            Algorithm algorithm = Algorithm.HMAC256(secret);
            JWTVerifier verifier = JWT.require(algorithm)
                    .withClaim("userName", userName)
                    .build();
            //效验TOKEN
            verifier.verify(token);
            return true;
        } catch (UnsupportedEncodingException e) {
            return false;
        }
    }
     * 获得token中的信息无需secret解密也能获得
     * @return token中包含的用户名
    public static String getUsername(String token) {
            DecodedJWT jwt = JWT.decode(token);
            return jwt.getClaim("userName").asString();
        } catch (JWTDecodeException e) {
            return null;
     * 获取用户id
     * @param token
     * @return
    public static String getUserId(String token) {
            return jwt.getClaim("userId").asString();
     * 生成签名
     * @param userName 用户名
     * @param userId
     * @return 加密的token
    public static String sign(String userName, String userId) {
            Date date = new Date(System.currentTimeMillis() + expire * 1000);
            // 附带username信息
            return JWT.create()
                    .withClaim("userId", userId)
                    .withExpiresAt(date)
                    .sign(algorithm);
        } catch (Exception e) {
    public static Long getExpire() {
        return expire;
    public static void setExpire(Long expire) {
        JWTUtil.expire = expire;
    public static String getSecret() {
        return secret;
    public static void setSecret(String secret) {
        JWTUtil.secret = secret;
}

application.properties中增加：

#jwt token
# token有效时长，7天，单位秒
jwt.expire=604800
jwt.secret=JWT_TOKEN_SHIRO

注意：jwt加解密的私钥使用配置的字符串而不使用用户登录密码的好处是防止用户密码被其他人修改后，用户操作系统此时再去校验token会发生token解析对不上的情况。

4.JWTFilter请求拦截

import org.apache.shiro.authz.UnauthorizedException;
import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.RequestMethod;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.net.URLEncoder;


public class JWTFilter extends BasicHttpAuthenticationFilter {
    private Logger logger = LoggerFactory.getLogger(this.getClass());

    
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws UnauthorizedException {
        //判断请求的请求头是否带上 "Token"
        if (isLoginAttempt(request, response)) {
            //如果存在，则进入 executeLogin 方法执行登入，检查 token 是否正确
            try {
                executeLogin(request, response);
                return true;
            } catch (Exception e) {
                //token 错误
                responseError(response, e.getMessage());
                return false; //产生异常则阻止请求的继续执行
            }
        }
        //如果请求头不存在 Token，则可能是执行登陆操作或者是游客状态访问，无需检查 token，直接返回 true
        return true;
    }

    
    @Override
    protected boolean isLoginAttempt(ServletRequest request, ServletResponse response) {
        HttpServletRequest req = (HttpServletRequest) request;
        String token = req.getHeader("Authorization");
        return token != null;
    }

    
    @Override
    protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        String token = httpServletRequest.getHeader("Authorization");
        JWTToken jwtToken = new JWTToken(token);
        // 提交给realm进行登入，如果错误他会抛出异常并被捕获
        getSubject(request, response).login(jwtToken);
        // 如果没有抛出异常则代表登入成功，返回true
        return true;
    }

    
    @Override
    protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
        httpServletResponse.setHeader("Access-control-Allow-Origin", "*");
        httpServletResponse.setHeader("Access-Control-Allow-Methods", "*");
        httpServletResponse.setHeader("Access-Control-Allow-Headers", "*");
        // 跨域时会首先发送一个option请求，这里我们给option请求直接返回正常状态
        if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
            httpServletResponse.setStatus(HttpStatus.OK.value());
            return false;
        }
        return super.preHandle(request, response);
    }

    
    private void responseError(ServletResponse response, String message) {
        try {
            HttpServletResponse httpServletResponse = (HttpServletResponse) response;
            //设置编码，否则中文字符在重定向时会变为空字符串
            message = URLEncoder.encode(message, "UTF-8");
            httpServletResponse.sendRedirect("/pc/login/noLogin?message=" + message);
        } catch (IOException e) {
            logger.error(e.getMessage());
        }
    }
}

executeLogin()方法中的getSubject(request, response).login(jwtToken)就是触发Shiro 登录操作。

5.登录授权realm

import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.hxkg.datafusion.common.jwt.JWTToken;
import com.hxkg.datafusion.common.jwt.JWTUtil;
import com.hxkg.datafusion.entity.customized.RoleAO;
import com.hxkg.datafusion.entity.customized.UserAO;
import com.hxkg.datafusion.entity.customized.VUserPrivilegeAO;
import com.hxkg.datafusion.service.IRoleService;
import com.hxkg.datafusion.service.IUserService;
import com.hxkg.datafusion.service.IVUserPrivilegeService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.stereotype.Service;
import org.springframework.util.CollectionUtils;
import org.springframework.util.StringUtils;

import javax.annotation.Resource;
import java.util.List;


@Service
public class ShiroRealm extends AuthorizingRealm {

    @Resource
    private IRoleService roleService;

    @Resource
    private IVUserPrivilegeService vUserPrivilegeService;

    @Resource
    private IUserService userService;

    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof JWTToken;
    }

    
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String username = JWTUtil.getUsername(principals.getPrimaryPrincipal().toString());
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        // 根据登录名获取登用户信息
        if (!StringUtils.isEmpty(username)) {
            //设置用户角色
            ServiceResult<List<RoleAO>> rolesResult = roleService.getRolesByUserName(username);
            if (rolesResult != null && rolesResult.isSucceed() && !CollectionUtils.isEmpty(rolesResult.getData())) {
                for (RoleAO role : rolesResult.getData()) {
                    authorizationInfo.addRole(role.getName());
                }
            }
            //设置权限
            List<VUserPrivilegeAO> privileges = vUserPrivilegeService.queryPrivilegeByUserName(username);
            if (!CollectionUtils.isEmpty(privileges)) {
                for (VUserPrivilegeAO privilege : privileges) {
                    if (privilege == null || StringUtils.isEmpty(privilege.getPrivilegecode())) {
                        continue;
                    }
                    //权限操作代码
                    authorizationInfo.addStringPermission(privilege.getPrivilegecode());
                }
            }
            return authorizationInfo;
        }
        return null;
    }

    
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {
        String token = (String) auth.getCredentials();
        // 解密获得username，用于和数据库进行对比
        String username = JWTUtil.getUsername(token);
        if (StringUtils.isEmpty(username)) {
            throw new AuthenticationException("token错误!");
        }

        UserAO user = userService.getUserByName(username);
        if (user == null) {
            throw new AuthenticationException("用户不存在!");
        }

        if (Constant.DISABLE.equals(user.getEnabled())) {
            throw new AuthenticationException("账号已被禁用!");
        }

        try {
            if (JWTUtil.verify(token, username)) {
                return new SimpleAuthenticationInfo(token, token, getName());
            } else {
                throw new AuthenticationException("token认证失败!");
            }
        } catch (TokenExpiredException e) {
            throw new AuthenticationException("token已过期!");
        } catch (SignatureVerificationException e) {
            throw new AuthenticationException("密码不正确!");
        }
    }

    
    public void clearCached() {
        this.clearCachedAuthorizationInfo(SecurityUtils.getSubject().getPrincipals());
    }


    
    @Override
    public boolean isPermitted(PrincipalCollection principals, String permission) {
        String username = JWTUtil.getUsername(principals.getPrimaryPrincipal().toString());
       //Constant常量文件配置:
       //public static String SYSTEM_SUPER_ADMIN = "admin";系统超级管理员
        return Constant.SYSTEM_SUPER_ADMIN.equals(username) || super.isPermitted(principals, permission);
    }

    @Override
    public boolean hasRole(PrincipalCollection principals, String roleIdentifier) {
        String username = JWTUtil.getUsername(principals.getPrimaryPrincipal().toString());
        return Constant.SYSTEM_SUPER_ADMIN.equals(username) || super.hasRole(principals, roleIdentifier);
    }
}

6.shiro配置

import com.hxkg.datafusion.common.jwt.JWTFilter;
import com.hxkg.datafusion.util.ShiroRealm;
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
import org.apache.shiro.mgt.DefaultSubjectDAO;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;

import javax.servlet.Filter;
import java.util.HashMap;
import java.util.Map;


@Configuration
public class ShiroConfig {

    @Bean("securityManager")
    public DefaultWebSecurityManager securityManager(ShiroRealm shiroRealm) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 使用自己的realm
        securityManager.setRealm(shiroRealm);
        
        DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
        DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();
        defaultSessionStorageEvaluator.setSessionStorageEnabled(false);
        subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);
        securityManager.setSubjectDAO(subjectDAO);

        return securityManager;
    }


    @Bean("shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();

        // 添加自己的过滤器并且取名为jwt
        Map<String, Filter> filterMap = new HashMap<>();
        filterMap.put("jwt", new JWTFilter());
        factoryBean.setFilters(filterMap);

        factoryBean.setSecurityManager(securityManager);
        factoryBean.setUnauthorizedUrl("/401");

        
        Map<String, String> filterRuleMap = new HashMap<>();
        filterRuleMap.put("/pc/login/doLogin", "anon");
        filterRuleMap.put("/pc/login/logout", "anon");
        filterRuleMap.put("/pc/login/noLogin", "anon");
        filterRuleMap.put("

    
    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
        return defaultAdvisorAutoProxyCreator;
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }
}
除了登录doLogin、退出logout、没有登录跳转登录noLogin方法外，其他所有请求通过我们自己的JWT Filter。

7.登录web端

import com.hxkg.datafusion.common.jwt.JWTUtil;
import com.hxkg.datafusion.entity.customized.UserAO;
import com.hxkg.datafusion.entity.customized.VUserPrivilegeAO;
import com.hxkg.datafusion.service.IUserService;
import com.hxkg.datafusion.service.IVUserPrivilegeService;
import com.hxkg.datafusion.util.*;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.*;

import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Date;
import java.util.List;



@RestController
@RequestMapping(value = "pc/login")
public class LoginController {

    private static Logger LOG = LoggerFactory.getLogger(LoginController.class);

    @Resource
    private IUserService userService;

    @Resource
    private IVUserPrivilegeService vUserPrivilegeService;


    
    @RequestMapping(value = "noLogin", method = {RequestMethod.GET, RequestMethod.POST})
    @ResponseBody
    public Object noLogin(String message) {
        ServiceResult<String> genResult = ServiceResultHelper.genResult(false, Constant.NO_AUTHENTICATION,
                StringUtils.isNotEmpty(message) ? message : "用户登录信息已失效，请重新登录后再试。", null);
        return genResult;
    }

    
    @RequestMapping(value = "unauthorized", method = {RequestMethod.GET, RequestMethod.POST})
    public Object unauthorized() {
        return ServiceResultHelper.genResult(false, Constant.ErrorCode.PERMISSION_DENIED_CODE,
                Constant.ErrorCode.PERMISSION_DENIED_MSG, null);
    }

    
    @RequestMapping(value = "doLogin", method = {RequestMethod.GET, RequestMethod.POST})
    public Object doLogin(String username, String password, Boolean rememberMe, HttpServletRequest request, HttpServletResponse response) {
        ServiceResult<UserAO> genResult;
        // 获取盐值
        String salt;
        UserAO loginUser = userService.getUserByName(username);
        if (loginUser == null) {
            genResult = ServiceResultHelper.genResult(false, Constant.ErrorCode.USER_NOT_EXIST_ERROR, Constant.ErrorCode.USER_NOT_EXIST_ERROR_MSG, null);
            return genResult;
        }
        if (Constant.DISABLE.equals(loginUser.getEnabled())) {
            genResult = ServiceResultHelper.genResult(false, Constant.ErrorCode.USER_DISABLE_ERROR, Constant.ErrorCode.USER_DISABLE_ERROR_MSG, null);
            return genResult;
        }
        salt = loginUser.getSalt();
        password = MD5Util.MD5Encode(password + salt);
        UserAO user = userService.getUserByNameAndPwd(username, password);
        if (user != null) {
            genResult = ServiceResultHelper.genResult(true, Constant.SUCCESS, "登录成功", user);
            //获取权限
            List<VUserPrivilegeAO> userPrivileges = vUserPrivilegeService.queryPrivilegeByUserName(username);
            user.setPrivileges(userPrivileges);
            //更新登录信息
            user.setLastLoginTime(DateTimeUtil.format(new Date(), DateTimeUtil.YEAR_MONTH_DAY_HOUR_MINUTE_SECOND));
            user.setLastLoginIp(IPUtil.getClientIp(request));
            userService.saveOrUpdate(user);
            genResult.setAdditionalProperties("token", JWTUtil.sign(username, user.getId()));
        } else {
            genResult = ServiceResultHelper.genResult(false, Constant.ErrorCode.PASSWORD_ERROR, Constant.ErrorCode.PASSWORD_ERROR_MSG, null);
        }
        return genResult;
    }

    
    @RequestMapping(value = "logout", method = {RequestMethod.GET, RequestMethod.POST})
    public Object logout(HttpServletRequest request, HttpServletResponse response) {
        Subject currentUser = SecurityUtils.getSubject();
        currentUser.logout();
        CookieUtil cookieUtil = new CookieUtil(request, response, 0);
        cookieUtil.deleteCookie(Constant.SESSION_CURRENT_USER);
        cookieUtil.deleteCookie("JSESSIONID");
        ServiceResult<Object> ret = new ServiceResult<Object>();
        ret.setMsg("退出登录成功");
        ret.setCode(Constant.SUCCESS);
        ret.setData(null);
        ret.setSucceed(true);
        return ret;
    }

}

登录完成一系列的检查，成功后创建jwt token。

8.异常处理

import com.hxkg.datafusion.util.Constant;
import com.hxkg.datafusion.util.ServiceResultHelper;
import org.apache.shiro.authz.UnauthenticatedException;
import org.apache.shiro.authz.UnauthorizedException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


@ControllerAdvice
public class WebExceptionHandler {

    private static Logger LOG = LoggerFactory.getLogger(WebExceptionHandler.class);


    @ExceptionHandler(UnauthorizedException.class)
    @ResponseBody
    public Object handleUnauthorizedException(Exception ex, HttpServletRequest request, HttpServletResponse response) {
        LOG.error("{}", ex.getMessage());
        return ServiceResultHelper.genResult(false, Constant.ErrorCode.PERMISSION_DENIED_CODE,
                Constant.ErrorCode.PERMISSION_DENIED_MSG, null);
    }

    @ExceptionHandler(UnauthenticatedException.class)
    @ResponseBody
    public Object handleUnauthenticatedException(Exception ex, HttpServletRequest request, HttpServletResponse response) {
        LOG.error("{}", ex.getMessage());
        return ServiceResultHelper.genResult(false, Constant.ErrorCode.INVALID_LOGIN_CODE,
                Constant.ErrorCode.INVALID_LOGIN_MSG, null);
    }

    @ExceptionHandler(Exception.class)
    @ResponseBody
    public Object handleException(Exception ex, HttpServletRequest request, HttpServletResponse response) {
        LOG.error("{}", ex.getMessage());
        return ServiceResultHelper.genResult(false,
                Constant.ErrorCode.SERVER_ERROR_CODE, Constant.ErrorCode.SERVER_ERROR_MSG, null);
    }

}

处理未登录、未授权等异常，返回相应的代码，方便前端捕获跳转登录页面，或者作出提示，而不会直接抛出服务器异常导致提示不够明确。

到此后端已经全部写完。接下来是vue部分。

9.缓存调用登录接口传过来的token

localStorage.setItem('token', token);

10.请求头设置，带上token

//封装请求
function xAxios(options) {
  let opts = {...options};
  let token = localStorage.getItem('token')
  if (token) {
      opts.headers['Authorization'] = token
  }

11.生产环境nginx配置

因为后端jetFilter登录异常会进行重定向，所以nginx需要加上前端的代理配置。

到此这篇关于vue+springboot+shiro+jwt实现登录的文章就介绍到这了,更多相关springboot jwt实现登录内容请搜索编程网以前的文章或继续浏览下面的相关文章希望大家以后多多支持编程网！

文章详情

vue+springboot+shiro+jwt实现登录功能

目录

1.导入依赖

2.JWTToken 替换 Shiro 原生 Token

3.JWT token 工具类，提供JWT生成、校验、获取token存储的信息

4.JWTFilter请求拦截

5.登录授权realm

6.shiro配置

7.登录web端

8.异常处理

9.缓存调用登录接口传过来的token

10.请求头设置，带上token

11.生产环境nginx配置

软考中级精品资料免费领

相关文章

猜你喜欢

vue+springboot+shiro+jwt实现登录功能

SpringBoot JWT实现token登录刷新功能

vue+springboot实现登录功能

springboot+vue实现登录功能

springboot+vue如何实现登录功能

springboot怎么整合shiro实现多验证登录功能

springboot中怎么利用shiro实现多验证登录功能

Vue登录功能实现

怎么在SpringBoot中利用Shiro实现一个密码登录功能

SpringBoot+Vue实现简单的登录注册功能

Vue+Vux实现登录功能

SpringBoot集成JWT实现Token登录验证

springboot+vue实现登录功能的最新方法整理

springboot整合shiro实现记住我功能

springboot整合shiro多验证登录功能的实现（账号密码登录和使用手机验证码登录）

vue+tp5实现简单登录功能

springboot+VUE实现登录注册

SpringBoot结合JWT登录权限控制的实现

Springboot+Thymeleaf+Jpa实现登录功能(附源码)

如何在SpringBoot中使用Shiro怎么实现一个邮件验证码登录功能