Spring Boot与JWT和Shiro整合实践步骤(非常详细!)

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class MyApplication {

    public static void main(String[] args) {
        SpringApplication.run(MyApplication.class, args);
    }
}

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
</dependencies>

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
}

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

String permission = "user:create"; // 创建用户的权限

<!-- Spring Boot Starter -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter</artifactId>
</dependency>

<!-- Shiro -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.1</version>
</dependency>

<!-- JWT -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>

# Shiro 配置
shiro.ini=classpath:shiro.ini

[main]
# 配置自定义的Realm
myRealm=com.example.MyRealm

# 设置SecurityManager的Realm
securityManager.realms=$myRealm

# 配置会话管理器
sessionManager=org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager=$sessionManager

# JWT认证过滤器配置
authc=org.apache.shiro.web.filter.authc.FormAuthenticationFilter
jwtAuthc=org.example.MyJWTFilter

# 将自定义的JWT认证过滤器加入Shiro过滤器链
[urls]
# 登录请求不拦截
/login=authc
# 其他请求需要通过JWT认证
/**=jwtAuthc

@Bean
public SecurityManager securityManager() {
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    securityManager.setRealm(myRealm());
    securityManager.setSessionManager(sessionManager());
    return securityManager;
}

@Bean
public SessionManager sessionManager() {
    DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
    // 自定义会话ID生成器
    sessionManager.setSessionIdGenerator(sessionIdGenerator());
    return sessionManager;
}

@Bean
public MyJWTFilter jwtFilter() {
    return new MyJWTFilter();
}

public class JWTUtil {
    private static final SignatureAlgorithm SIGNATURE_ALGORITHM = SignatureAlgorithm.HS256;
    private static final String ISSUE_ON_KEY = "issueOn";
    private static final String EXP_KEY = "exp";

    public static String createJWT(String subject, String issuer, String secret, long ttlMillis) {
        // 获取当前时间
        Date now = new Date();
        // 获取过期时间
        Date expTime = new Date(now.getTime() + ttlMillis);
        // 获取JWT ID
        String jwtId = IdUtils.simpleUUID();

        // 创建JWT
        JwtBuilder builder = Jwts.builder()
                .setId(jwtId)
                .setIssuedAt(now)
                .setSubject(subject)
                .setIssuer(issuer)
                .signWith(SIGNATURE_ALGORITHM, secret);

        // 添加过期时间
        if (expTime != null) {
            builder.setExpiration(expTime);
        }

        return builder.compact();
    }

    public static Claims parseJWT(String jwt, String secret) {
        return Jwts.parser()
                .setSigningKey(secret.getBytes())
                .parseClaimsJws(jwt)
                .getBody();
    }
}

public class JWTUtil {
    // ... JWT的生成和解析方法

    // 获取当前用户的方法
    public static String getCurrentUser(String jwt, String secret) {
        Claims claims = parseJWT(jwt, secret);
        return claims.getSubject();
    }
}

@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);

    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/login", "authc"); // 登录请求，不进行JWT认证
    filterChainDefinitionMap.put("/**", "jwtAuthc"); // 其他请求进行JWT认证
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

    return shiroFilterFactoryBean;
}

public class MyExceptionHandler implements ExceptionMapper<Exception> {
    @Override
    public String toHTML(Exception e) {
        // 根据异常类型返回不同的错误信息
        if (e instanceof AuthorizationException) {
            return "<p>您没有权限访问此资源。</p>";
        } else if (e instanceof AuthenticationException) {
            return "<p>认证失败，请重新登录。</p>";
        } else {
            return "<p>服务器异常，请稍后再试。</p>";
        }
    }
}

public class MyRealm extends AuthorizingRealm {
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // 从principals中获取当前用户的principal信息
        String username = (String) principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        // 根据用户名查询用户权限信息，然后添加到authorizationInfo中
        List<String> permissions = getPermissionsByUsername(username);
        authorizationInfo.addStringPermissions(permissions);
        return authorizationInfo;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        // 这里实现用户的登录验证逻辑，通常会根据token信息查询数据库验证用户名和密码
        // 如果验证通过，返回一个SimpleAuthenticationInfo对象
        // 如果验证失败，可以抛出相应的AuthenticationException异常
    }
}

@Controller
public class MyController {
    @RequestMapping("/admin")
    public String adminPage(Principal principal) {
        // 只有拥有admin权限的用户才能访问此页面
        if (SecurityUtils.getSubject().isPermitted("admin")) {
            return "admin";
        } else {
            return "accessDenied";
        }
    }
}

.
├── src
│   ├── main
│   │   ├── java
│   │   │   └── com
│   │   │       └── example
│   │   │           └── myproject
│   │   │               ├── MyProjectApplication.java
│   │   │               ├── config
│   │   │               │   ├── SecurityConfig.java
│   │   │               │   └── ShiroConfig.java
│   │   │               ├── controller
│   │   │               │   ├── UserController.java
│   │   │               │   └── ResourceController.java
│   │   │               ├── service
│   │   │               │   ├── UserService.java
│   │   │               │   └── ResourceService.java
│   │   │               ├── model
│   │   │               │   ├── User.java
│   │   │               │   └── Resource.java
│   │   │               └── repository
│   │   │                   ├── UserRepository.java
│   │   │                   └── ResourceRepository.java
│   │   └── resources
│   │       ├── application.properties
│   │       └── static
│   └── test
│       └── java
│           └── com
│               └── example
│                   └── myproject
│                       └── MyProjectApplicationTests.java
└── pom.xml

@Configuration
public class ShiroConfig {

    @Bean
    public SecurityManager securityManager(Realm realm) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(realm);
        return securityManager;
    }

    @Bean
    public Realm realm() {
        return new CustomRealm();
    }
    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
        shiroFilter.setSecurityManager(securityManager);
        shiroFilter.setLoginUrl("/login");
        shiroFilter.setUnauthorizedUrl("/403");
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilter;
    }
    // Other beans and configurations...
}

@RestController
@RequestMapping("/user")
public class UserController {

    @Autowired
    private UserService userService;
    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody LoginRequest loginRequest) {
        // Authenticate user
        User user = userService.authenticateUser(loginRequest.getUsername(), loginRequest.getPassword());
        if (user != null) {
            // Create JWT token and send it back to the user
            String token = JwtUtil.createToken(user);
            return ResponseEntity.ok(new JwtResponse(token));
        } else {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid credentials");
        }
    }
}

@RestController
@RequestMapping("/resources")
public class ResourceController {

    @GetMapping("/{id}")
    @RequiresPermissions("resource:view")
    public ResponseEntity<?> viewResource(@PathVariable Long id) {
        // Fetch the resource and return it
        Resource resource = resourceService.findById(id);
        return ResponseEntity.ok(resource);
    }
    @PostMapping("/create")
    @RequiresRoles("admin")
    public ResponseEntity<?> createResource(@RequestBody Resource resource) {
        // Create a new resource
        Resource createdResource = resourceService.createResource(resource);
        return ResponseEntity.ok(createdResource);
    }
}

@RunWith(SpringRunner.class)
@SpringBootTest
public class MyProjectApplicationTests {

    @Autowired
    private MockMvc mockMvc;

    @MockBean
    private UserService userService;

    @Test
    public void testLoginSuccess() throws Exception {
        User mockUser = new User(...);
        when(userService.authenticateUser(anyString(), anyString())).thenReturn(mockUser);
        mockMvc.perform(post("/user/login")
                .contentType(MediaType.APPLICATION_JSON)
                .content("{\"username\":\"user\", \"password\":\"pass\"}"))
                .andExpect(status().isOk());
    }
}