53 lines
1.2 KiB
Markdown
53 lines
1.2 KiB
Markdown
# JWT 认证与授权
|
|
|
|
## 学习目标
|
|
- 理解 JWT 原理
|
|
- 掌握 Spring Security 配置
|
|
- 学会实现认证和授权
|
|
|
|
## JWT 简介
|
|
|
|
JWT (JSON Web Token) 是一种无状态的认证机制，由 Header、Payload、Signature 三部分组成。
|
|
|
|
## Spring Security 配置
|
|
|
|
```java
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
public class SecurityConfig {
|
|
|
|
@Bean
|
|
public SecurityFilterChain filterChain(HttpSecurity http) {
|
|
http.csrf().disable()
|
|
.authorizeHttpRequests(auth -> auth
|
|
.requestMatchers("/api/auth/**").permitAll()
|
|
.anyRequest().authenticated()
|
|
);
|
|
return http.build();
|
|
}
|
|
}
|
|
```
|
|
|
|
## JWT 工具类
|
|
|
|
```java
|
|
public class JwtUtils {
|
|
private static final String SECRET = "your-secret-key";
|
|
|
|
public static String generateToken(String username) {
|
|
return Jwts.builder()
|
|
.setSubject(username)
|
|
.setIssuedAt(new Date())
|
|
.setExpiration(new Date(System.currentTimeMillis() + 86400000))
|
|
.signWith(SignatureAlgorithm.HS256, SECRET)
|
|
.compact();
|
|
}
|
|
}
|
|
```
|
|
|
|
## 动手练习
|
|
|
|
1. 实现用户登录接口
|
|
2. 添加 JWT 过滤器
|
|
3. 实现基于角色的权限控制
|