springboot实现token登录

一、Controller层login接口进行账密验证，验证成功返回token

配置文件：

最主要是第一个依赖，后面不属于jsonwebtoken的依赖
controller：

@PostMapping("/login")     public Result<TokenStatus> login(@RequestBody LoginVO loginVO, HttpServletRequest request) {         Result<TokenStatus> result = new Result<>();         UserDO userDO = null;         try {             userDO = userService.getUser(loginVO, request);         } catch (NirException e) {             result.setCode(e.getCode());             result.setMsg(e.getMessage());             return result;         } catch (Exception e) {             result.setCode(NirExceptionEnum.GENERAL_EXCEPTION.getCode());             result.setMsg(e.getMessage());             return result;         }         TokenStatus tokenStatus = JwtUtil.createJwt(userDO.getId().toString(),userDO.getUsername());         result.setData(tokenStatus);         result.setCode(ResultEnum.SUCCESS.getCode());         result.setMsg(ResultEnum.SUCCESS.getMsg());         return result;     }

JwtUtil类

 public class JwtUtil {     public static final String KEY = "userlogin";     public static final Long FAILURE_TIME = 3600000L;      public static TokenStatus createJwt(String id, String username){         TokenStatus tokenStatus = new TokenStatus();         long now = System.currentTimeMillis();         long exp = now + FAILURE_TIME;         Date date = new Date(exp);         JwtBuilder jwtBuilder = Jwts.builder().setId(id).setSubject(username)                 .setIssuedAt(new Date()).signWith(SignatureAlgorithm.HS256,KEY);         jwtBuilder.setExpiration(date);         String token = jwtBuilder.compact();         tokenStatus.setToken(token);         tokenStatus.setExp(date);         return tokenStatus;     }      public static Claims parseJwt(String token){         Claims claims = Jwts.parser().setSigningKey(KEY).parseClaimsJws(token).getBody();         return claims;     }  }

二、前端login接口返回token，存进cookie

let param = {         username: values.username,         password: values.password,       };       API.login(param)         .then((res) => {           const { code, msg, data} = res;           if (code !== "200") {             Message.error("登录失败，用户名或密码错误！");           } else {             Message.success("登录成功！");             if(data.token&&data.exp){               document.cookie = "token="+ data.token+";expires="+new Date(data.exp).toGMTString();             }             this.props.history.push('/home');           }         })         .catch((err) => {           Message.error(err + "登录失败！请重试！");         });

退出登录清除cookie中的token，跳转到登录页面

logout = () => {     deleteCookie("token");     this.props.history.replace("/login");   }; export const deleteCookie = (name) => {   var exp = new Date();   exp.setTime(exp.getTime()-1);   var val = getCookie(name);   if(val!=null){     document.cookie= name + "="+val+";expires="+exp.toGMTString();   } }  export const getCookie = (name) => {   var arr,reg=new RegExp("(^| )"+name+"=([^;]*)(;|$)");   if(arr=document.cookie.match(reg))     return unescape(arr[2]);   else     return null; }

给每个请求添加请求头Authorization，加上token

headers: {         "Content-Type": "application/json",         'Authorization': getCookie("token") ,         "withCredentials": true,       },

三、前端对路由模块进行封装，对cookie里不存在token的页面不允许访问，跳转到登录页面

import  React from 'React'; import { Route, Redirect } from 'react-router-dom'; import { Message } from 'antd'; import { getCookie } from "../pages/home/Home";  const PrivateRoute = ({component: Component, ...props}) => {     // 解构赋值 将 props 里面的 component 赋值给 Component     return <Route {...props} render={(p) => {         const token = getCookie("token");         if (token){ // 如果登录了, 返回正确的路由             if(props.path==='/login'){                 return <Redirect to='/home'/>             }else{                 return <Component />             }         } else { // 没有登录就重定向至登录页面             Message.error("你还未登录，请先登录")             return <Redirect to='/login'/>         }     }}/> } export default PrivateRoute

使用方法：

<Route path="/login" component={Login}></Route> <Route path="/register" component={Register}></Route>  <PrivateRoute path="/admin" component={Admin}></PrivateRoute>  <PrivateRoute path="/home" component={Home}></PrivateRoute>

四、后端添加过滤器，对没带token的请求和token不符合要求的请求进行过滤处理，返回未登录提示

此处的过滤器采用javax.servlet.Filter的接口实现

@WebFilter(urlPatterns = {"/user/getUser","/record/*","/patient/*","/disease/*"}) public class TokenFilter implements Filter {     @Autowired     private UserDOMapper userMapper;      @Override     public void init(FilterConfig filterConfig) throws ServletException {      }      @Override     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {         HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;         HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;         String token = httpServletRequest.getHeader("Authorization");         try{             if(token==null || token.equals("null")){                 throw new NirException(NirExceptionEnum.USER_UNLOGIN);             }else{                 UserDOExample example = new UserDOExample();                 String username = JwtUtil.parseJwt(token).getSubject();                 example.createCriteria().andUsernameEqualTo(username);                 List<UserDO> users = userMapper.selectByExample(example);                 if (CollectionUtils.isEmpty(users)) {                     throw new NirException(NirExceptionEnum.USER_UNLOGIN);                 }else{                     filterChain.doFilter(servletRequest,servletResponse);                 }             }         }catch(NirException e){             Result<Void> result = new Result<>();             result.setCode(e.getCode());             result.setMsg(e.getMessage());             httpServletResponse.setHeader("content-type", "application/json;charset=utf-8");             httpServletResponse.setHeader("Access-Control-Allow-Origin","*");             httpServletResponse.setHeader("Access-Control-Allow-Methods","POST,OPTIONS");             httpServletResponse.setHeader("Access-Control-Allow-Credentials","true");             httpServletResponse.setHeader("Access-Control-Allow-Headers","Content-Type,WithCredentials,Authorization");             PrintWriter out = httpServletResponse.getWriter();             out.println(JSON.toJSONString(result));         }     }      @Override     public void destroy() {      } }

这样就实现了一个系统的的token登录功能。