如何使用JWT的SpringSecurity实现前后端分离

{
  "alg": "HS256",
  "typ": "JWT"
}

iss (issuer):签发人
exp (expiration time):过期时间
sub (subject):主题 
aud (audience):受众 
nbf (Not Before):生效时间
iat (lssued At):签发时间
jti (JWT ID):编号

{
"sub": "1234567890",
"name" : "John Doe",
“userid”:2
 "admin": true
}

HMACSHA256(
base64UrlEncode(header) + ".”"+base64UrlEncode(payload),
secret)

 <!--引入jwt的依赖-->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>4.4.0</version>
        </dependency>

    private static  String key="layZhang";
    //创建token
    public static String createToken(Map<String,Object> map){
        //设置头部信息
        Map<String,Object> head=new HashMap<>();
        head.put("alg","HS256");
        head.put("typ","JWT");
        //设置发布日期
        Date date=new Date();
        //设置过期时间
        Calendar instance = Calendar.getInstance();//获取当前时间
        instance.set(Calendar.SECOND,7200);//在当前时间的基础上添加两个小时
        Date time = instance.getTime();//得到Date类型的时间
        //创建token
        String token = JWT.create()
                .withHeader(head)//设置头部信息
                .withIssuedAt(date)//设置发布时间
                .withExpiresAt(time)//设置过期时间
                .withClaim("userInfo", map)//设置个人信息
                .sign(Algorithm.HMAC256(key));//签名
        return token;
    }

 //校验token
    public static boolean verify(String token){
        Verification require = JWT.require(Algorithm.HMAC256(key));
        try {
            require.build().verify(token);
            return true;
        }catch (Exception e){
            System.out.println("token错误");
            return false;
        }
    }

//根据token获取自定义的信息
    public static Map<String,Object> getInfo(String token,String mykey){
        JWTVerifier build = JWT.require(Algorithm.HMAC256(key)).build();
        Claim claim = build.verify(token).getClaim(mykey);
        return claim.asMap();
    }

    private AuthenticationSuccessHandler successHandler(){
//        return new AuthenticationSuccessHandler() {
//            @Override  //
//            public void onAuthenticationSuccess(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Authentication authentication) throws IOException, ServletException {
//                //设置响应的编码
//                httpServletResponse.setContentType("application/json;charset=utf-8");
//                //获取输出对象
//                PrintWriter writer = httpServletResponse.getWriter();
//                //返回json数据即可
//                Map<String,Object> map=new HashMap<>();
//                map.put("username",authentication.getName());
//                Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
//                //获取权限
//                List<String> collect = authorities.stream().map(item -> item.getAuthority()).collect(Collectors.toList());
//
//                map.put("permissions",collect);
//                String token = JWTUtil.createToken(map);
//
//                //返回一个统一的json对象
//                R r=new R(200,"登录成功",token);
//                //转换为json字符串
//                String jsonString = JSON.toJSONString(r);
//                //servlet
//                writer.println(jsonString);
//                writer.flush();
//                writer.close();
//            }
//        };
        //使用Lambda表达式
        return (httpServletRequest, httpServletResponse, authentication) -> {
            //设置响应的编码
            httpServletResponse.setContentType("application/json;charset=utf-8");
            //获取输出对象
            PrintWriter writer = httpServletResponse.getWriter();
            //返回json数据即可
            Map<String,Object> map=new HashMap<>();
            map.put("username",authentication.getName());
            //获取权限信息列表
            Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
            //获取响应的权限标识符
            List<String> collect = authorities.stream().map(item -> item.getAuthority()).collect(Collectors.toList());
            map.put("permissions",collect);
            String token = JWTUtil.createToken(map);
            //返回一个统一的json对象
            R r=new R(200,"登录成功",token);
            //转换为json字符串
            String jsonString = JSON.toJSONString(r);
            //servlet
            writer.println(jsonString);
            writer.flush();
            writer.close();
        };
    }

.successHandler(successHandler())

//登录失败返回json数据
    private  AuthenticationFailureHandler  failureHandler(){
        return (httpServletRequest, httpServletResponse, e)->{
            //设置编码
            httpServletResponse.setContentType("application/json;charset=utf-8");
            //获取输出对象
            PrintWriter writer = httpServletResponse.getWriter();
            R r=new R(500,"登录失败！",e.getMessage());
            String s = JSON.toJSONString(r);
            writer.println(s);
            writer.flush();
            writer.close();
        };
    }

.failureHandler(failureHandler()) 

 //权限不足返回json数据
    private AccessDeniedHandler  accessDeniedHandler(){
        return (httpServletRequest, httpServletResponse, e)->{
            httpServletResponse.setContentType("application/json;charset=utf-8");
            PrintWriter writer = httpServletResponse.getWriter();
            R r=new R(403,"权限不足，请联系管理员",e.getMessage());
            String s = JSON.toJSONString(r);
            writer.println(s);
            writer.flush();
            writer.close();
        };
    }

//指定权限不足跳转的页面
        http.exceptionHandling().accessDeniedHandler(accessDeniedHandler());

@Component //交于spring容器管理
public class LoginFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        //若是登录路径，放行
        String requestURI = httpServletRequest.getRequestURI();
        String method = httpServletRequest.getMethod();
        if("/login".equals(requestURI)&&"POST".equals(method)){
            //放行
            filterChain.doFilter(httpServletRequest,httpServletResponse);
            return;
        }
        //统一编码格式
        httpServletResponse.setContentType("application/json;charset=utf-8");
        //1. 从请求头中获取token令牌
        String token = httpServletRequest.getHeader("token");
        //2. 判断token是否为null
        if(StringUtils.isEmpty(token)){
            //获取传输对象
            PrintWriter writer = httpServletResponse.getWriter();
            R r =new R(500,"未登录",null);
            String s = JSON.toJSONString(r);
            writer.write(s);
            writer.flush();
            writer.close();
            return;
        }
        //3. 验证token
     if(!JWTUtil.verify(token)){
         PrintWriter writer = httpServletResponse.getWriter();
         //返回一个token失效的json数据
         R r=new R(500,"token失效！",null);
         String s = JSON.toJSONString(r);
         writer.write(s);
         writer.flush();
         writer.close();
         return;
     }
     //把当前用户的信息封装到Authentication对象中
        SecurityContext context = SecurityContextHolder.getContext();
        Map<String, Object> userInfo = JWTUtil.getInfo(token, "userInfo");
        Object username = userInfo.get("username");
        //权限标识符
       // List<String> permissions = (List<String>) userInfo.get("permissions");
        List<String> permissions = (List<String>) userInfo.get("permission");
        //通过stream流转换类型
        List<SimpleGrantedAuthority> collect = permissions.stream().map(item -> new SimpleGrantedAuthority(item)).collect(Collectors.toList());
       // List<SimpleGrantedAuthority> collect = permissions.stream().map(item -> new SimpleGrantedAuthority(item)).collect(Collectors.toList());
        //三个参数
        //Object principal,账号
        //Object credentials,密码 null
        //Collection<? extends GrantedAuthority> authorities:权限
        UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken=new UsernamePasswordAuthenticationToken(username,null,collect);
        context.setAuthentication(usernamePasswordAuthenticationToken);
        //放行
        filterChain.doFilter(httpServletRequest,httpServletResponse);
    }
}

 //把自定义的过滤器放在UsernamePasswordAuthenticationFilter之前
        http.addFilterBefore(loginFilter, UsernamePasswordAuthenticationFilter.class);