OpenAPI鉴权（二）jwt鉴权

一、思路

前端调用后端可以使用jwt鉴权；调用三方接口也可以使用jwt鉴权。对接多个三方则与每个third parth都约定一套token规则，因为如果使用同一套token，token串用可能造成权限越界问题，且payload交叉业务不够清晰。下面的demo包含了两套jwt，前端和一个三方（openApi）的：

1、token生成：

（1）签发给前端的token在本项目生成；

（2）签发给第三方的token，由第三方根据双方约定的算法、密钥和payload通信信息自己生成

      。不能调用本项目（被调用方）接口生成，否则这个生成token的接口需要加白名单，

      会造成接口攻击和token泄露的安全问题。

2、token校验：

   先判断是哪个业务的token，再用各自约定的算法和业务规则校验。这里是根据url来判断的，

   不能只根据audience来判断，如用前端的token访问open api接口，从token解析出audience

    是前端的，再用前端的规则校验，校验通过访问成功；

二、demo

1、pom与配置文件

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"><parent><artifactId>openapi-ta</artifactId><groupId>us.zoom.openapi</groupId><version>1.0-SNAPSHOT</version></parent><modelVersion>4.0.0</modelVersion><artifactId>openapi-ta-mas</artifactId><properties><maven.compiler.source>17</maven.compiler.source><maven.compiler.target>17</maven.compiler.target><ta.product.name>Mas</ta.product.name></properties><dependencies><dependency><groupId>us.zoom.openapi</groupId><artifactId>openapi-ta-commons</artifactId><version>1.0-SNAPSHOT</version></dependency><dependency><groupId>us.zoom.openapi.mas</groupId><artifactId>open-api-mas-common</artifactId><version>1.0.1</version></dependency><dependency><groupId>com.github.pagehelper</groupId><artifactId>pagehelper</artifactId><version>5.1.8</version></dependency><dependency><groupId>com.fasterxml.jackson.datatype</groupId><artifactId>jackson-datatype-jsr310</artifactId><version>2.13.0</version></dependency></dependencies><build><plugins><plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-compiler-plugin</artifactId><version>3.8.1</version><configuration><source>1.8</source><target>1.8</target><encoding>UTF-8</encoding><skip>true</skip><executable>false</executable></configuration></plugin><plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-surefire-plugin</artifactId><version>${surefire.version}</version><configuration><systemPropertyVariables><org.uncommons.reportng.escape-output>false</org.uncommons.reportng.escape-output><spring.profiles.active>${spring.profiles.active}</spring.profiles.active><ta.product.name>${ta.product.name}</ta.product.name></systemPropertyVariables><skip>false</skip><testFailureIgnore>false</testFailureIgnore><argLine>-javaagent:"${settings.localRepository}/org/aspectj/aspectjweaver/${aspectj.version}/aspectjweaver-${aspectj.version}.jar"--add-opens java.base/java.lang=ALL-UNNAMED</argLine><suiteXmlFiles><suiteXmlFile>${project.basedir}/src/main/resources/suites/${spring.profiles.active}/AlertRuleAPIBvtSuite.xml</suiteXmlFile></suiteXmlFiles><properties><usedefaultlisteners>false</usedefaultlisteners></properties></configuration></plugin></plugins><resources><resource><directory>src/main/resources</directory><filtering>true</filtering><includes><include>**/*.properties</include><include>**/*.xml</include><include>application.yml</include><include>application-${spring.profiles.active}.yml</include></includes></resource><resource><directory>src/main/java</directory><filtering>false</filtering></resource></resources></build><profiles><profile><id>dev</id><activation><!--default env--><activeByDefault>true</activeByDefault></activation><properties><spring.profiles.active>dev</spring.profiles.active></properties></profile><profile><id>go</id><properties><spring.profiles.active>go</spring.profiles.active></properties></profile><profile><id>aw1</id><properties><spring.profiles.active>aw1</spring.profiles.active></properties></profile><profile><id>us02</id><properties><spring.profiles.active>us02</spring.profiles.active></properties></profile><profile><id>us03</id><properties><spring.profiles.active>us03</spring.profiles.active></properties></profile><profile><id>us04</id><properties><spring.profiles.active>us04</spring.profiles.active></properties></profile><profile><id>us05</id><properties><spring.profiles.active>us05</spring.profiles.active></properties></profile><profile><id>us06</id><properties><spring.profiles.active>us06</spring.profiles.active></properties></profile><profile><id>us07</id><properties><spring.profiles.active>us07</spring.profiles.active></properties></profile><profile><id>us01</id><properties><spring.profiles.active>us01</spring.profiles.active></properties></profile></profiles></project>

server.port=6666
server.servlet.context-path=/jwtDemo

2、启动类 

package com.demo.security;import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.EnableMBeanExport;
import org.springframework.jmx.support.RegistrationPolicy;@SpringBootApplication
//解决报错MXBean already registered with name org.apache.commons.pool2:type=GenericObjectPool,name=pool
@EnableMBeanExport(registration = RegistrationPolicy.IGNORE_EXISTING)
public class JWTApplication {public static void main(String[] args) {SpringApplication.run(JWTApplication.class, args);}
}

 3、全局配置

（1）webMVC

package com.demo.security.config;import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;@Configuration
public class WebMvcConfig implements WebMvcConfigurer {//设置跨域@Beanpublic CorsFilter corsFilter() {UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();CorsConfiguration config = new CorsConfiguration();config.setAllowCredentials(true);config.addAllowedOrigin("http://localhost:9528");config.addAllowedHeader("*");config.addAllowedMethod("*");source.registerCorsConfiguration("/**", config);return new CorsFilter(source);}
}

（2）security

package com.demo.security.config;import org.springframework.security.crypto.password.PasswordEncoder;public class MyPasswordEncoder implements PasswordEncoder {@Overridepublic String encode(CharSequence charSequence) {return charSequence.toString();}@Overridepublic boolean matches(CharSequence charSequence, String s) {return s.equals(charSequence.toString());}/*public DefaultPasswordEncoder() {this(-1);}*//*** @param strength*            the log rounds to use, between 4 and 31*//*public DefaultPasswordEncoder(int strength) {}public String encode(CharSequence rawPassword) {return MD5.encrypt(rawPassword.toString());}public boolean matches(CharSequence rawPassword, String encodedPassword) {return encodedPassword.equals(MD5.encrypt(rawPassword.toString()));}*/
}

package com.demo.security.config;import com.demo.security.filter.LoginFilter;
import com.demo.security.filter.TokenAuthenticationFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityWebConfig {@Autowiredprivate UserDetailsService userDetailsService;@Beanpublic PasswordEncoder passwordEncoder() {return new MyPasswordEncoder();}@Beanpublic AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {return authConfig.getAuthenticationManager();}@Beanpublic SecurityFilterChain configure(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {http.csrf(AbstractHttpConfigurer::disable);http.headers(AbstractHttpConfigurer::disable);http.sessionManagement(sessionManagement -> {sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS);});http.authorizeRequests().anyRequest().authenticated().and()//1、登陆、退出url，均由前端拦截器控制，这里注释掉。//1.1、前端拦截器中判断缓存token为空，为空则post请求访问/login，目的是进入LoginFilter获取token//1.2、不为空则带token访问接口，如果AuthenticationFilter拦截token不合法则根据错误码跳转到登陆页面，重复1.1的操作//.logout().logoutUrl("/logout").and()//2、身份认证filter，访问系统（除了白名单接口）需要先登陆。post请求/login接口会进入这个拦截器// 校验用户名密码是否正确，正确返回token给前端，不正确则返回异常信息.addFilterBefore(new LoginFilter(authenticationManager), LoginFilter.class)//3、授权filer，authenticationManager为BasicAuthenticationFilter的必传参数。所有的接口都会走到这里// 根据用户id查询权限,连同身份一起塞入SecurityContextHolder全局变量，后面获取用户信息则直接从SecurityContextHolder中get.addFilterBefore(new TokenAuthenticationFilter(authenticationManager,userDetailsService),TokenAuthenticationFilter.class);return http.build();}@Beanpublic WebSecurityCustomizer webSecurityCustomizer() {return (web) -> web.ignoring().requestMatchers("/param/**", "/user-websocket-endpoint/**","/menu-websocket-endpoint/**");}
}

4、security数据源

（1）常量（模拟数据库）

package com.demo.security.constant;import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;/*** 模拟数据库查询数据，假设有：用户名/密码/角色/资源* admin/123/xtgly/user_manage、role_manage、menu_manage、school_manage* zs/123/userAdmin、roleAdmin/user_manage、role_manage、menu_manage* ls/123/schoolAdmin/school_manage*/
public class UserDBConstants {public static Map<String, String> getUsers() {Map<String,String> users = new HashMap<>();users.put("admin","123");users.put("zs","123");users.put("ls","123");return users;}public static Map<String,List<String>> getUserRoles() {Map<String,List<String>> userRoles = new HashMap<>();//adminList<String> adminRoles = new ArrayList<>();adminRoles.add("xtgly");userRoles.put("admin",adminRoles);//zsList<String> zsRoles = new ArrayList<>();zsRoles.add("userAdmin");zsRoles.add("roleAdmin");userRoles.put("zs",zsRoles);//lsList<String> lsRoles = new ArrayList<>();lsRoles.add("schoolAdmin");userRoles.put("ls",lsRoles);return userRoles;}public static Map<String,List<String>> getUserPermissions() {Map<String,List<String>> userPermissions = new HashMap<>();List<String> lsPermissions = new ArrayList<>();//lslsPermissions.add("school_manage");userPermissions.put("ls",lsPermissions);//zsList<String> zsPermissions = new ArrayList<>();zsPermissions.add("user_manage");zsPermissions.add("role_manage");zsPermissions.add("menu_manage");userPermissions.put("zs",zsPermissions);//adminList<String> adminPermissions = new ArrayList<>();adminPermissions.add("user_manage");adminPermissions.add("role_manage");adminPermissions.add("menu_manage");adminPermissions.add("school_manage");userPermissions.put("admin",adminPermissions);return userPermissions;}
}

（2）UserDetails

package com.demo.security.dto;import lombok.Data;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;import java.util.Collection;
import java.util.List;
@Data
public class UserDTO implements UserDetails {private Integer id;private String userName;private String userAccount;private List<String> roles;private List<String> menus;private String passWord;public UserDTO (Integer id,String userName,String userAccount,List<String> roles,List<String> menus,String passWord){this.id = id;this.userAccount = userAccount;this.userName = userName;this.roles = roles;this.menus = menus;this.passWord = passWord;}@Overridepublic Collection<? extends GrantedAuthority> getAuthorities() {return null;}public List<String> getMenus() {return menus;}public void setMenus(List<String> menus) {this.menus = menus;}@Overridepublic String getPassword() {return passWord;}@Overridepublic String getUsername() {return this.userAccount;}@Overridepublic boolean isAccountNonExpired() {return true;}@Overridepublic boolean isAccountNonLocked() {return true;}@Overridepublic boolean isCredentialsNonExpired() {return true;}@Overridepublic boolean isEnabled() {return true;}
}

（3）UserDetailService

package com.demo.security.service;import com.demo.security.constant.UserDBConstants;
import com.demo.security.dto.UserDTO;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;import java.util.List;
import java.util.Map;/*** 当什么也没有配置的时候，账号和密码是由 Spring Security 定义生成的。* 而在实际项目中账号和密码都是从数据库中查询出来的。所以我们要通过自定义逻辑控制认证逻辑，*/
@Service("userDetailsService")
public class MyUserDetailsService implements UserDetailsService {@Overridepublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {//模拟数据库查询Map<String, String> userMap = UserDBConstants.getUsers();String dbPwd = userMap.get(username);if(StringUtils.isEmpty(dbPwd)){throw new UsernameNotFoundException("用户不存在");}Map<String, List<String>> userRoles = UserDBConstants.getUserRoles();List<String> roles = userRoles.get(username);Map<String, List<String>> userMenus = UserDBConstants.getUserPermissions();List<String> menus = userMenus.get(username);UserDTO userDTO = new UserDTO(null,null,username,roles,menus,dbPwd);return userDTO;}
}

 5、filter

（1）前端登录

package com.demo.security.filter;import com.demo.security.constant.UserDBConstants;
import com.demo.security.dto.ResponseMsg;
import com.demo.security.dto.UserDTO;
import com.demo.security.util.JwtUtil;
import com.google.gson.Gson;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.apache.http.entity.ContentType;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.util.StringUtils;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Map;@Slf4j
public class LoginFilter extends UsernamePasswordAuthenticationFilter {private AuthenticationManager authenticationManager;public LoginFilter(AuthenticationManager authenticationManager) {//super(new AntPathRequestMatcher("/login", "POST"));this.authenticationManager = authenticationManager;}/*** /login POST接口验证* @param req* @param res* @return* @throws AuthenticationException*/@Overridepublic Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {try {logger.info("进入LoginFilter");String userName = req.getParameter("userName");String passWord = req.getParameter("passWord");if (StringUtils.isEmpty(userName)) {throw new UsernameNotFoundException("请输入账号");}if (StringUtils.isEmpty(passWord)) {throw new UsernameNotFoundException("请输入密码");}//验证用户名密码是否正确Map<String, String> userMap = UserDBConstants.getUsers();if(!userMap.keySet().contains(userName)){throw new UsernameNotFoundException("用户不存在");}if(!passWord.equals(userMap.get(userName))){throw new UsernameNotFoundException("密码错误");}//这里权限返回空，由后面的授权过滤器查询return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(userName, passWord, new ArrayList<>()));} catch (UsernameNotFoundException e) {//返回错误信息res.setCharacterEncoding("UTF-8");res.setContentType("application/text;charset=utf-8");try {res.getWriter().write(e.getMessage());} catch (IOException e1) {e1.printStackTrace();}return null;}catch (Exception e){throw new RuntimeException(e);}}@Overrideprotected void successfulAuthentication(HttpServletRequest request,HttpServletResponse res,jakarta.servlet.FilterChain chain,Authentication authResult)throws IOException{UserDTO userDTO = (UserDTO) authResult.getPrincipal();String jwtToken = JwtUtil.generateWebToken(userDTO);//返ResponseMsg resMsg = ResponseMsg.builder().code(200).data(jwtToken).build();res.setContentType(ContentType.TEXT_HTML.toString());Gson gson = new Gson();res.getWriter().write(gson.toJson(resMsg));}
}

（2）token验证

package com.demo.security.filter;import com.demo.security.util.JwtUtil;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.util.StringUtils;import java.io.IOException;@Slf4j
public class TokenAuthenticationFilter extends BasicAuthenticationFilter {private UserDetailsService userDetailsService;public TokenAuthenticationFilter(AuthenticationManager authenticationManager, UserDetailsService userDetailsService) {super(authenticationManager);this.userDetailsService = userDetailsService;}@Overrideprotected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {logger.info("登陆成功后访问,url={}"+req.getRequestURI());String token = req.getHeader("token");res.setCharacterEncoding("UTF-8");res.setContentType("application/text;charset=utf-8");//1、必填tokenif(StringUtils.isEmpty(token)){logger.info("登陆成功后访问,url={},token为空"+req.getRequestURI());res.getWriter().write("token为空");return;}//2、校验token是否合法，合法则解析出userName//token可能是前端的，也可能是open api的String userName = JwtUtil.getUserNameByToken(req,token);if(StringUtils.isEmpty(userName)){logger.info("登陆成功后访问,url={},token错误或失效"+req.getRequestURI());res.getWriter().write("token错误或者失效");return;}//3、根据userName获取user实体，存入全局UserDetails currentUser = userDetailsService.loadUserByUsername(userName);UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(currentUser,null,currentUser.getAuthorities());SecurityContextHolder.getContext().setAuthentication(authentication);chain.doFilter(req, res);}
}

 6、一些dto和常量

package com.demo.security.dto;import lombok.Builder;
import lombok.Data;@Data
@Builder
public class ResponseMsg {private Object data;private Integer code;
}

package com.demo.security.constant;import org.springframework.security.web.util.matcher.AntPathRequestMatcher;import java.util.List;public class UrlConstants {public static final String WEB_API_PRE = "/v1/**";public static final String OPEN_API_PRE = "/openApi/**";public static final List<AntPathRequestMatcher> WEB_MATCHERS =  List.of(new AntPathRequestMatcher(WEB_API_PRE));public static final List<AntPathRequestMatcher> OPEN_API_MATCHERS =List.of(new AntPathRequestMatcher(OPEN_API_PRE));
}

 7、JWTUtil

package com.demo.security.util;
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.Claim;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.demo.security.constant.UrlConstants;
import com.demo.security.dto.UserDTO;
import jakarta.servlet.http.HttpServletRequest;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.Optional;@Slf4j
public class JwtUtil {//签发方private static final String APPLICATION_ISSUER = "jwt_demo";//签发给private static final String TO_WEB = "to_web";private static final String TO_OPEN_API = "to_open_api";//密钥private static final String WEB_SECRET = "web-secret";private static final String OPEN_API_SECRET = "open-api-secret";//jwt过期事件public static final int EXPIRE_TIME = 30 * 60 * 1000;/*** 生成给前端的签名* @return 加密的token*/public static String generateWebToken(UserDTO userDTO) {Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);Algorithm algorithm = Algorithm.HMAC256(WEB_SECRET);// 附带username信息return JWT.create()//iss：签发方.withIssuer(APPLICATION_ISSUER)//aud：接收jwt的一方.withAudience(TO_WEB)//exp：jwt的过期时间，这个过期时间必须要大于签发时间//.withExpiresAt()//其他自定义通信信息.withClaim("userName", userDTO.getUsername())//.withClaim("age",userDTO.getAge());.withExpiresAt(date).sign(algorithm);}/*** open api的签名生成* 此处是给单元测试用的，调用方项目应该自己生成* @return 加密的token*/public static String generateOpenApiToken(String userName) {Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);Algorithm algorithm = Algorithm.HMAC256(OPEN_API_SECRET);// 附带username信息return JWT.create()//iss：签发方.withIssuer(APPLICATION_ISSUER)//aud：接收jwt的一方.withAudience(TO_OPEN_API)//exp：jwt的过期时间，这个过期时间必须要大于签发时间//.withExpiresAt()//其他自定义通信信息.withClaim("userName", userName)//.withClaim("age",age);.withExpiresAt(date).sign(algorithm);}public static String getUserNameByToken(HttpServletRequest req, String token) {DecodedJWT jwt = JWT.decode(token);//1、是否过期Date expireDate = jwt.getExpiresAt();if(expireDate.before(new Date())){log.error("token已过期");return null;}//2、签发方是否正确if(!APPLICATION_ISSUER.equals(jwt.getIssuer())){log.error("不是本项目签发的token");return null;}//3、是否合法String audience = jwt.getAudience().get(0);boolean check = preCheckToken(audience,token,req);if(!check){return null;}Map<String, Claim> claims = jwt.getClaims();String userName = claims.get("userName").asString();return userName;}/*** 根据url来判断是web还是open api更准确，* 如果只根据audience来判断，则web的token也可以访问open api；** @param audience* @param token* @param req* @return*/private static boolean preCheckToken(String audience, String token, HttpServletRequest req) {if(TO_WEB.equals(audience) && urlMatches(req, UrlConstants.WEB_MATCHERS)){log.info("这是前端token");return verifyToken(WEB_SECRET,token);}else if(TO_OPEN_API.equals(audience) && urlMatches(req,UrlConstants.OPEN_API_MATCHERS)){log.info("这是open api token");return verifyToken(OPEN_API_SECRET,token);}log.error("token来源不合法");return false;}public static boolean urlMatches(HttpServletRequest request, List<AntPathRequestMatcher> matchers) {Optional<AntPathRequestMatcher> first = matchers.stream().filter(m -> m.matches(request)).findFirst();return first.isPresent();}private static boolean verifyToken(String secret, String token) {Algorithm algorithm = Algorithm.HMAC256(secret);try{JWTVerifier verifier = JWT.require(algorithm).build();verifier.verify(token);return true;}catch (Exception e){log.error("token非法");return false;}}
}

8、checkUtil

package com.demo.security.check;import com.demo.security.dto.UserDTO;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;import java.awt.*;
import java.util.List;@Component("menuAuthorizationCheck")
public class MenuAuthorizationCheck {public boolean hasMenuAuthorization(String menuCode) {UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();List<String> menus = currentUser.getMenus();return menus.contains(menuCode);}/* *//*** open api是否有权限访问* @param menuCode* @return*//*public boolean hasOpenMenuAuthorization(String menuCode) {UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();List<String> menus = currentUser.getMenus();return menus.contains(menuCode);}*/
}

 9、controller

（1）前端业务接口

package com.demo.security.controller;import com.demo.security.dto.ResponseMsg;
import com.demo.security.dto.UserDTO;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/v1/user")
@RestController
public class UserController {@RequestMapping("/test")public String test(){return "这是user test";}@RequestMapping("/getCurrentUser")public ResponseMsg getCurrentUser() {UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();System.out.println("当前用户为:"+currentUser);return ResponseMsg.builder().code(200).data(currentUser).build();}
}

package com.demo.security.controller;import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/v1/menu")
@RestController
public class MenuManageController {@PreAuthorize("@menuAuthorizationCheck.hasMenuAuthorization('menu_manage')")@RequestMapping("/test")public String test(){return "这是菜单管理";}
}

package com.demo.security.controller;import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/v1/school")
@RestController
@Slf4j
public class SchoolManageController {@RequestMapping("/test")public String test(){log.info("这是学校管理controller");return "这是学校管理";}
}

package com.demo.security.controller;import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/v1/role")
@RestController
public class RoleManageController {@RequestMapping("/test")public String test(){return "这是角色管理";}
}

（2）open api业务接口

package com.demo.security.openapi;import com.demo.security.dto.ResponseMsg;
import com.demo.security.dto.UserDTO;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/openApi/user")
@RestController
public class OpenUserController {@RequestMapping("/test")public String test(){return "这是open api user test";}@RequestMapping("/getCurrentUser")public ResponseMsg getCurrentUser() {UserDTO currentUser = (UserDTO) SecurityContextHolder.getContext().getAuthentication().getPrincipal();System.out.println("当前用户为:"+currentUser);return ResponseMsg.builder().code(200).data(currentUser).build();}
}

package com.demo.security.openapi;import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/openApi/menu")
@RestController
public class OpenMenuController {@PreAuthorize("@menuAuthorizationCheck.hasMenuAuthorization('menu_manage')")@RequestMapping("/test")public String test(){return "这是open api菜单管理";}
}

package com.demo.security.openapi;import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;@RequestMapping("/openApi/school")
@RestController
@Slf4j
public class OpenSchoolController {@RequestMapping("/test")public String test(){log.info("这是学校管理controller");return "这是open api学校管理";}
}

测试验证

（1）模拟前端调用

① 登录，访问 localhost:6666/jwtDemo/login?userName=admin&passWord=123

     

使用返回的token调用业务接口：

② 访问 localhost:6666/jwtDemo/v1/user/test

③ 访问localhost:6666/jwtDemo/v1/user/getCurrentUser

④ 访问localhost:6666/jwtDemo/v1/menu/test

⑤ 访问 localhost:6666/jwtDemo/v1/school/test

（2）模拟openapi调用

① 使用单元测试生成一个token

package com.demo.jwt.openapi;import com.demo.security.JWTApplication;
import com.demo.security.util.JwtUtil;
import lombok.extern.slf4j.Slf4j;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.junit4.SpringRunner;@SpringBootTest(classes = {JWTApplication.class}, webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@RunWith(SpringRunner.class)
@Slf4j
public class MyTest {/*** 模拟open api调用方生成token。* open api应该自己生成token，双方约定好生成的算法、密钥和payload通信字段；* 不能调用本项目（被调用方）接口生成，否则对于生成token的接口需要加白名单，会造成接口攻击和token泄露的安全问题**/@Testpublic void  createOpenApiToken(){String userName = "zs";String token = JwtUtil.generateOpenApiToken(userName);log.info("生成token：{}",token);}}

使用这个token调用业务接口：

② 访问 localhost:6666/jwtDemo/openApi/user/getCurrentUser

③ 访问 localhost:6666/jwtDemo/openApi/school/test

④ 访问 localhost:6666/jwtDemo/openApi/menu/test

（3）前端使用openapi的token调用接口

都报错

（4）openapi使用前端的token调用接口

同样都报错