vue+springboot+shiro+jwt实现登录功能-eolink官网

vue+springboot+shiro+jwt实现登录功能

目录1.导入依赖2.JWTToken 替换 Shiro 原生 Token3.JWT token 工具类，提供JWT生成、校验、获取token存储的信息4.JWTFilter请求拦截5.登录授权realm6.shiro配置7.登录web端8.异常处理9.缓存调用登录接口传过来的token10.请求头设置，带上token11.生产环境nginx配置

公司开发的系统原先的用户信息是基于shiro session 进行管理，但是session不适用于app端，并且服务器重启后需要重新登录。需要改造将shiro和jwt进行整合，实现通过token登录。

1.导入依赖

com.auth0

java-jwt

3.2.0

2.JWTToken 替换 Shiro 原生 Token

import org.apache.shiro.authc.AuthenticationToken;

public class JWTToken implements AuthenticationToken {

// 密钥

private String token;

public JWTToken(String token) {

this.token = token;

}

@Override

public Object getPrincipal() {

return token;

public Object getCredentials() {

}

3.JWT token 工具类，提供JWT生成、校验、获取token存储的信息

import com.auth0.jwt.JWT;

import com.auth0.jwt.JWTVerifier;

import com.auth0.jwt.algorithms.Algorithm;

import com.auth0.jwt.exceptions.JWTDecodeException;

import com.auth0.jwt.interfaces.DecodedJWT;

import com.hxkg.datafusion.controller.FlieController;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.boot.context.properties.ConfigurationProperties;

import org.springframework.stereotype.Component;

import java.io.UnsupportedEncodingException;

import java.util.Date;

/**

* JWT token 工具类

* @author yangfeng

* @Date 2019-09-17

@ConfigurationProperties(prefix = "jwt")

@Component

public class JWTUtil {

private static Logger LOG = LoggerFactory.getLogger(FlieController.class);

//过期时间

private static Long expire;

// 秘钥

private static String secret;

/**

* 校验token是否正确

* @param token 密钥

* @return 是否正确

public static boolean verify(String token, String userName) {

try {

//根据密码生成JWT效验器

Algorithm algorithm = Algorithm.HMAC256(secret);

JWTVerifier verifier = JWT.require(algorithm)

.withClaim("userName", userName)

.build();

//效验TOKEN

verifier.verify(token);

return true;

} catch (UnsupportedEncodingException e) {

return false;

}

* 获得token中的信息无需secret解密也能获得

* @return token中包含的用户名

public static String getUsername(String token) {

DecodedJWT jwt = JWT.decode(token);

return jwt.getClaim("userName").asString();

} catch (JWTDecodeException e) {

return null;

* 获取用户id

* @param token

* @return

public static String getUserId(String token) {

return jwt.getClaim("userId").asString();

* 生成签名

* @param userName 用户名

* @param userId

* @return 加密的token

public static String sign(String userName, String userId) {

Date date = new Date(System.currentTimeMillis() + expire * 1000);

// 附带username信息

return JWT.create()

.withClaim("userId", userId)

.withExpiresAt(date)

.sign(algorithm);

} catch (Exception e) {

public static Long getExpire() {

return expire;

public static void setExpire(Long expire) {

JWTUtil.expire = expire;

public static String getSecret() {

return secret;

public static void setSecret(String secret) {

JWTUtil.secret = secret;

}

application.properties中增加：

#jwt token

# token有效时长，7天，单位秒

jwt.expire=604800

jwt.secret=JWT_TOKEN_SHIRO

注意：jwt加解密的私钥使用配置的字符串而不使用用户登录密码的好处是防止用户密码被其他人修改后，用户操作系统此时再去校验token会发生token解析对不上的情况。

4.JWTFilter请求拦截

import org.apache.shiro.authz.UnauthorizedException;

import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.http.HttpStatus;

import org.springframework.web.bind.annotation.RequestMethod;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.net.URLEncoder;

/**

* jwt过滤器

* @Author yangfeng

* @Description preHandle->isAccessAllowed->isLoginAttempt->executeLogin

* @Date 2019-09-18

* @Time 12:36

public class JWTFilter extends BasicHttpAuthenticationFilter {

private Logger logger = LoggerFactory.getLogger(this.getClass());

/**

* 如果带有 token，则对 token 进行检查，否则直接通过

@Override

protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws UnauthorizedException {

//判断请求的请求头是否带上 "Token"

if (isLoginAttempt(request, response)) {

//如果存在，则进入 executeLogin 方法执行登入，检查 token 是否正确

try {

executeLogin(request, response);

return true;

} catch (Exception e) {

//token 错误

responseError(response, e.getMessage());

return false; //产生异常则阻止请求的继续执行

}

//如果请求头不存在 Token，则可能是执行登陆操作或者是游客状态访问，无需检查 token，直接返回 true

return true;

}

/**

* 判断用户是否想要登入。

* 检测 header 里面是否包含 Token

@Override

protected boolean isLoginAttempt(ServletRequest request, ServletResponse response) {

HttpServletRequest req = (HttpServletRequest) request;

String token = req.getHeader("Authorization");

return token != null;

}

/**

* 执行登陆操作

@Override

protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {

HttpServletRequest httpServletRequest = (HttpServletRequest) request;

String token = httpServletRequest.getHeader("Authorization");

JWTToken jwtToken = new JWTToken(token);

// 提交给realm进行登入，如果错误他会抛出异常并被捕获

getSubject(request, response).login(jwtToken);

// 如果没有抛出异常则代表登入成功，返回true

return true;

}

/**

* 对跨域提供支持

@Override

protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {

HttpServletRequest httpServletRequest = (HttpServletRequest) request;

HttpServletResponse httpServletResponse = (HttpServletResponse) response;

httpServletResponse.setHeader("Access-control-Allow-Origin", "*");

httpServletResponse.setHeader("Access-Control-Allow-Methods", "*");

httpServletResponse.setHeader("Access-Control-Allow-Headers", "*");

// 跨域时会首先发送一个option请求，这里我们给option请求直接返回正常状态

if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {

httpServletResponse.setStatus(HttpStatus.OK.value());

return false;

}

return super.preHandle(request, response);

}

/**

* 请求异常跳转

private void responseError(ServletResponse response, String message) {

try {

HttpServletResponse httpServletResponse = (HttpServletResponse) response;

//设置编码，否则中文字符在重定向时会变为空字符串

message = URLEncoder.encode(message, "UTF-8");

httpServletResponse.sendRedirect("/pc/login/noLogin?message=" + message);

} catch (IOException e) {

logger.error(e.getMessage());

}

executeLogin()方法中的getSubject(request, response).login(jwtToken)就是触发Shiro 登录操作。

5.登录授权realm

import com.auth0.jwt.exceptions.SignatureVerificationException;

import com.auth0.jwt.exceptions.TokenExpiredException;

import com.hxkg.datafusion.common.jwt.JWTToken;

import com.hxkg.datafusion.common.jwt.JWTUtil;

import com.hxkg.datafusion.entity.customized.RoleAO;

import com.hxkg.datafusion.entity.customized.UserAO;

import com.hxkg.datafusion.entity.customized.VUserPrivilegeAO;

import com.hxkg.datafusion.service.IRoleService;

import com.hxkg.datafusion.service.IUserService;

import com.hxkg.datafusion.service.IVUserPrivilegeService;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.springframework.stereotype.Service;

import org.springframework.util.CollectionUtils;

import org.springframework.util.StringUtils;

import javax.annotation.Resource;

import java.util.List;

/**

* 登录授权realm

* @author yangfeng

* @date 2019.6.21

@Service

public class ShiroRealm extends AuthorizingRealm {

@Resource

private IRoleService roleService;

@Resource

private IVUserPrivilegeService vUserPrivilegeService;

@Resource

private IUserService userService;

@Override

public boolean supports(AuthenticationToken token) {

return token instanceof JWTToken;

}

/**

* 为当前登录用户授予角色和权限

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

String username = JWTUtil.getUsername(principals.getPrimaryPrincipal().toString());

SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();

// 根据登录名获取登用户信息

if (!StringUtils.isEmpty(username)) {

//设置用户角色

ServiceResult> rolesResult = roleService.getRolesByUserName(username);

if (rolesResult != null && rolesResult.isSucceed() && !CollectionUtils.isEmpty(rolesResult.getData())) {

for (RoleAO role : rolesResult.getData()) {

authorizationInfo.addRole(role.getName());

}

//设置权限

List privileges = vUserPrivilegeService.queryPrivilegeByUserName(username);

if (!CollectionUtils.isEmpty(privileges)) {

for (VUserPrivilegeAO privilege : privileges) {

if (privilege == null || StringUtils.isEmpty(privilege.getPrivilegecode())) {

continue;

}

//权限操作代码

authorizationInfo.addStringPermission(privilege.getPrivilegecode());

}

return authorizationInfo;

}

return null;

}

/**

* 验证当前登录的用户

@Override

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {

String token = (String) auth.getCredentials();

// 解密获得username，用于和数据库进行对比

String username = JWTUtil.getUsername(token);

if (StringUtils.isEmpty(username)) {

throw new AuthenticationException("token错误!");

}

UserAO user = userService.getUserByName(username);

if (user == null) {

throw new AuthenticationException("用户不存在!");

}

if (Constant.DISABLE.equals(user.getEnabled())) {

throw new AuthenticationException("账号已被禁用!");

}

try {

if (JWTUtil.verify(token, username)) {

return new SimpleAuthenticationInfo(token, token, getName());

} else {

throw new AuthenticationException("token认证失败!");

}

} catch (TokenExpiredException e) {

throw new AuthenticationException("token已过期!");

} catch (SignatureVerificationException e) {

throw new AuthenticationException("密码不正确!");

}

/**

* 清除登陆用户授权信息缓存.

public void clearCached() {

this.clearCachedAuthorizationInfo(SecurityUtils.getSubject().getPrincipals());

}

/**

* 超级管理员不做权限的判断，自动拥有所有权限

* @param principals

* @param permission

* @return

@Override

public boolean isPermitted(PrincipalCollection principals, String permission) {

String username = JWTUtil.getUsername(principals.getPrimaryPrincipal().toString());

//Constant常量文件配置:

//public static String SYSTEM_SUPER_ADMIN = "admin";系统超级管理员

return Constant.SYSTEM_SUPER_ADMIN.equals(username) || super.isPermitted(principals, permission);

}

@Override

public boolean hasRole(PrincipalCollection principals, String roleIdentifier) {

String username = JWTUtil.getUsername(principals.getPrimaryPrincipal().toString());

return Constant.SYSTEM_SUPER_ADMIN.equals(username) || super.hasRole(principals, roleIdentifier);

}

6.shiro配置

import com.hxkg.datafusion.common.jwt.JWTFilter;

import com.hxkg.datafusion.util.ShiroRealm;

import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;

import org.apache.shiro.mgt.DefaultSubjectDAO;

import org.apache.shiro.spring.LifecycleBeanPostProcessor;

import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.DependsOn;

import javax.servlet.Filter;

import java.util.HashMap;

import java.util.Map;

/**

* shiro配置

* @author yangfeng

* @date 2019.7.14

@Configuration

public class ShiroConfig {

@Bean("securityManager")

public DefaultWebSecurityManager securityManager(ShiroRealm shiroRealm) {

DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

// 使用自己的realm

securityManager.setRealm(shiroRealm);

* 关闭shiro自带的session，详情见文档

* http://shiro.apache.org/session-management.html#SessionManagement-StatelessApplications%28Sessionless%29

DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();

DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();

defaultSessionStorageEvaluator.setSessionStorageEnabled(false);

subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);

securityManager.setSubjectDAO(subjectDAO);

return securityManager;

}

@Bean("shiroFilter")

public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {

ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();

// 添加自己的过滤器并且取名为jwt

Map filterMap = new HashMap<>();

filterMap.put("jwt", new JWTFilter());

factoryBean.setFilters(filterMap);

factoryBean.setSecurityManager(securityManager);

factoryBean.setUnauthorizedUrl("/401");

* 自定义url规则

* http://shiro.apache.org/web.html#urls-

Map filterRuleMap = new HashMap<>();

filterRuleMap.put("/pc/login/doLogin", "anon");

filterRuleMap.put("/pc/login/logout", "anon");

filterRuleMap.put("/pc/login/noLogin", "anon");

filterRuleMap.put("/**", "authc");

// 所有请求通过我们自己的JWT Filter

filterRuleMap.put("/**", "jwt");

factoryBean.setLoginUrl("/pc/login/noLogin");//没有登录的用户请求需要登录的资源时自动跳转到该路径

factoryBean.setUnauthorizedUrl("/pc/login/unauthorized");//没有权限默认跳转

factoryBean.setFilterChainDefinitionMap(filterRuleMap);

return factoryBean;

}

/**

* 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证

* @param securityManager

* @return

/**

* 下面的代码是添加注解支持

@Bean

@DependsOn("lifecycleBeanPostProcessor")

public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {

DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();

defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);

return defaultAdvisorAutoProxyCreator;

}

@Bean

public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {

return new LifecycleBeanPostProcessor();

}

@Bean

public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {

AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();

advisor.setSecurityManager(securityManager);

return advisor;

}

除了登录doLogin、退出logout、没有登录跳转登录noLogin方法外，其他所有请求通过我们自己的JWT Filter。

7.登录web端

import com.hxkg.datafusion.common.jwt.JWTUtil;

import com.hxkg.datafusion.entity.customized.UserAO;

import com.hxkg.datafusion.entity.customized.VUserPrivilegeAO;

import com.hxkg.datafusion.service.IUserService;

import com.hxkg.datafusion.service.IVUserPrivilegeService;

import com.hxkg.datafusion.util.*;

import org.apache.commons.lang3.StringUtils;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.subject.Subject;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.web.bind.annotation.*;

import javax.annotation.Resource;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.util.Date;

import java.util.List;

/**

* 登录

* @author yangfeng

* @date 2019-07-11 16:02

@RestController

@RequestMapping(value = "pc/login")

public class LoginController {

private static Logger LOG = LoggerFactory.getLogger(LoginController.class);

@Resource

private IUserService userService;

@Resource

private IVUserPrivilegeService vUserPrivilegeService;

/**

* 未登陆认证

* @param message

* @return

@RequestMapping(value = "noLogin", method = {RequestMethod.GET, RequestMethod.POST})

@ResponseBody

public Object noLogin(String message) {

ServiceResult genResult = ServiceResultHelper.genResult(false, Constant.NO_AUTHENTICATION,

StringUtils.isNotEmpty(message) ? message : "用户登录信息已失效，请重新登录后再试。", null);

return genResult;

}

/**

* 未授权

* @return

@RequestMapping(value = "unauthorized", method = {RequestMethod.GET, RequestMethod.POST})

public Object unauthorized() {

return ServiceResultHelper.genResult(false, Constant.ErrorCode.PERMISSION_DENIED_CODE,

Constant.ErrorCode.PERMISSION_DENIED_MSG, null);

}

/**

* 登录操作

* @param username

* @param password

* @param request

* @param response

* @return

@RequestMapping(value = "doLogin", method = {RequestMethod.GET, RequestMethod.POST})

public Object doLogin(String username, Strinhttp://g password, Boolean rememberMe, HttpServletRequest request, HttpServletResponse response) {

ServiceResult genResult;

// 获取盐值

String salt;

UserAO loginUser = userService.getUserByName(username);

if (loginUser == null) {

genResult = ServiceResultHelper.genResult(false, Constant.ErrorCode.USER_NOT_EXIST_ERROR, Constant.ErrorCode.USER_NOT_EXIST_ERROR_MSG, null);

return genResult;

}

if (Constant.DISABLE.equals(loginUser.getEnabled())) {

genResult = ServiceResultHelper.genResult(false, Constant.ErrorCode.USER_DISABLE_ERROR, Constant.ErrorCode.USER_DISABLE_ERROR_MSG, null);

return genResult;

}

salt = loginUser.getSalt();

password = MD5Util.MD5Encode(password + salt);

UserAO user = userService.getUserByNameAndPwd(username, password);

if (user != null) {

genResult = ServiceResultHelper.genResult(true, Constant.SUCCESS, "登录成功", user);

//获取权限

List userPrivileges = vUserPrivilegeService.queryPrivilegeByUserName(username);

user.setPrivileges(userPrivileges);

//更新登录信息

user.setLastLoginTime(DateTimeUtil.format(new Date(), DateTimeUtil.YEAR_MONTH_DAY_HOUR_MINUTE_SECOND));

user.setLastLoginIp(IPUtil.getClientIp(request));

userService.saveOrUpdate(user);

genResult.setAdditionalProperties("token", JWTUtil.sign(username, user.getId()));

} else {

genResult = ServiceResultHelper.genResult(false, Constant.ErrorCode.PASSWORD_ERROR, Constant.ErrorCode.PASSWORD_ERROR_MSG, null);

}

return genResult;

}

/**

* 退出登录

* @param request

* @param response

* @return

@RequestMapping(value = "logout", method = {RequestMethod.GET, RequestMethod.POST})

public Object logout(HttpServletRequest request, HttpServletResponse response) {

Subject currentUser = SecurityUtils.getSubject();

currentUser.logout();

CookieUtil cookieUtil = new CookieUtil(request, response, 0);

cookieUtil.deleteCookie(Constant.SESSION_CURRENT_USER);

cookieUtil.deleteCookie("jsESSIONID");

ServiceResult

ret.setMsg("退出登录成功");

ret.setCode(Constant.SUCCESS);

ret.setData(null);

ret.setSucceed(true);

return ret;

}

登录完成一系列的检查，成功后创建jwt token。

8.异常处理

import com.hxkg.datafusion.util.Constant;

import com.hxkg.datafusion.util.ServiceResultHelper;

import org.apache.shiro.authz.UnauthenticatedException;

import org.apache.shiro.authz.UnauthorizedException;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.web.bind.annotation.ControllerAdvice;

import org.springframework.web.bind.annotation.ExceptionHandler;

import org.springframework.web.bind.annotation.ResponseBody;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

/**

* 异常处理

* @author yangfeng

* @date 2019-09-11

@ControllerAdvice

public class WebExceptionHandler {

private static Logger LOG = LoggerFactory.getLogger(WebExceptionHandler.class);

@ExceptionHandler(UnauthorizedException.class)

@ResponseBody

public Object handleUnauthorizedException(Exception ex, HttpServletRequest request, HttpServletResponse response) {

LOG.error("{}", ex.getMessage());

return ServiceResultHelper.genResult(false, Constant.ErrorCode.PERMISSION_DENIED_CODE,

Constant.ErrorCode.PERMISSION_DENIED_MSG, null);

}

@ExceptionHandler(UnauthenticatedException.class)

@ResponseBody

public Object handleUnauthenticatedException(Exception ex, HttpServletRequest request, HttpServletResponse response) {

LOG.error("{}", ex.getMessage());

return ServiceResultHelper.genResult(false, Constant.ErrorCode.INVALID_LOGIN_CODE,

Constant.ErrorCode.INVALID_LOGIN_MSG, null);

}

@ExceptionHandler(Exception.class)

@ResponseBody

public Object handleException(Exception ex, HttpServletRequest request, HttpServletResponse response) {

LOG.error("{}", ex.getMessage());

return ServiceResultHelper.genResult(false,

Constant.ErrorCode.SERVER_ERROR_CODE, Constant.ErrorCode.SERVER_ERROR_MSG, null);

}

处理未登录、未授权等异常，返回相应的代码，方便前端捕获跳转登录页面，或者作出提示，而不会直接抛出服务器异常导致提示不够明确。

到此后端已经全部写完。接下来是vue部分。

9.缓存调用登录接口传过来的token

localStorage.setItem('token', token);

10.请求头设置，带上token

//封装请求

function xAxios(options) http://{

let opts = {...options};

let token = locaZwYscTTGCXlStorage.getItem('token')

if (token) {

opts.headers['Authorization'] = token

}

11.生产环境nginx配置

因为后端jetFilter登录异常会进行重定向，所以nginx需要加上前端的代理配置。

springcloud如何使用Feign后台内部传递MultipartFile

315 2022-08-14

vue+springboot+shiro+jwt实现登录功能

基于feign传参MultipartFile问题解决

Feign远程调用Multipartfile参数处理

springcloud如何使用Feign后台内部传递MultipartFile

推荐文章

接口调用是什么意思？几种常用接口调用方式

接口设计原则

8款在线 API 接口文档管理工具

api管理系统是什么？

什么是接口调试？接口调试的步骤有哪些？

api 接口管理系统有哪些？

接口测试有几种测试方法

API文档生成工具有哪些？

微服务和api网关区别

交换机配置步骤

最近发表

热评文章

在线接口文档管理工具推荐，支持在线测试，HTTP接口

开源的在线接口文档wiki工具Mindoc的介绍与使

如何优雅的进行接口设计？接口设计的六大原则是什么？

什么是API测试,api检测公司

软件接口设计怎么做？前后端分离软件接口设计思路

接口管理平台推荐，几大接口管理平台总有一款适合你！