springmvc跨域+token验证

时间：2023-12-20 23:36:56

  1）app后台跨域设置

     2）拦截器中设置http报文header中token

     3）token的生成实现

====================================================================================================

1，app后台跨域的设置

1.1   springmvc4 有直接在请求映射中对跨域的处理，只需加一个@CrossOrign()

    @CrossOrigin(origins = "http://localhost:9000")

    @GetMapping("/greeting")

    public Greeting greeting(@RequestParam(required=false, defaultValue="World") String name) {

        System.out.println("==== in greeting ====");

        return new Greeting(counter.incrementAndGet(), String.format(template, name));

    }

对全局请求路径的拦截的，则需要在配置类里声明：

  @Bean

    public WebMvcConfigurer corsConfigurer() {

        return new WebMvcConfigurerAdapter() {

            @Override

            public void addCorsMappings(CorsRegistry registry) {

                registry.addMapping("/greeting-javaconfig").allowedOrigins("http://localhost:9000");

            }

        };

    }

“/greeting-javaconfig” 则是你定义的请求路径了，你也可以直接设置为 /api/* 之类的，allowedOrigins也可以匹配成 * 

可以参考官方文档：https://spring.io/guides/gs/rest-service-cors/

1.2 通过filter过滤器进行处理

其实，spring的拦截器也是可以处理跨域的问题，但对于post+json的支持不是很好，用拦截器的支持会好一些：

首先，定义拦截器：

public class CrossFilter extends OncePerRequestFilter {

    @Override

    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        if (request.getHeader("Access-Control-Request-Method") != null && "OPTIONS".equals(request.getMethod())) {

            // CORS "pre-flight" request

            response.addHeader("Access-Control-Allow-Origin", "*");

            response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");

            response.addHeader("Access-Control-Allow-Headers", "Content-Type");

            response.addHeader("Access-Control-Max-Age", "1800");//30 min

        }

        filterChain.doFilter(request, response);

    }

}

其次，在web.xml设置过滤：

<filter>

    <filter-name>cors</filter-name>

    <filter-class>cn.***.filter.CrossFilter</filter-class>

</filter>

<filter-mapping>

    <filter-name>cors</filter-name>

    <url-pattern>/*</url-pattern>

</filter-mapping>

当然spring4  appalication.xml 也可以配置成：

<mvc:cors>

        <mvc:mapping path="/**" allowed-origins="*" allow-credentials="true" max-age="1800" allowed-methods="GET,POST,OPTIONS"/>

    </mvc:cors>

3）我的配置类配置：

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.*;

import org.springframework.core.env.Environment;

import org.springframework.web.cors.CorsConfiguration;

import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import org.springframework.web.filter.CorsFilter;

import org.springframework.web.servlet.HandlerInterceptor;

import org.springframework.web.servlet.ViewResolver;

import org.springframework.web.servlet.config.annotation.*;

import org.springframework.web.servlet.mvc.Controller;

import org.springframework.web.servlet.view.InternalResourceViewResolver;

import java.util.ArrayList;

import java.util.List;

/**

 * Created by ThinkPad on 2017/6/15.

 */

@Configuration

@EnableWebMvc

@ComponentScan(basePackages = {"com.ouyang.teson"},useDefaultFilters = true)

@PropertySource({"classpath:teson.properties"})

public class WebConfig extends WebMvcConfigurerAdapter{

    private final static Logger logger = LoggerFactory.getLogger(WebConfig.class);

    public ViewResolver viewResolver() {

        InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();

        viewResolver.setPrefix("/WEB-INF/views/jsp/function/");

        viewResolver.setSuffix(".jsp");

        return viewResolver;

    }

    //静态文件

    @Override

    public void addResourceHandlers(ResourceHandlerRegistry registry) {

        logger.info("addResourceHandlers");

        registry.addResourceHandler("/static/**").addResourceLocations("/WEB-INF/static/");

    }

    //允许跨域的接口

    @Override

    public void addCorsMappings(CorsRegistry registry) {

        registry.addMapping("/api/*").allowedOrigins("*")

                .allowCredentials(false)

                .allowedMethods("GET", "POST", "DELETE", "PUT")

                .allowedHeaders("Access-Control-Allow-Origin","Access-Control-Allow-Headers","Access-Control-Allow-Methods"

                ,"Access-Control-Max-Age")
                 .exposedHeaders("Access-Control-Allow-Origin")
                 .maxAge(3600); 
  } 

}

2) 在拦截器中设置token

在拦截器中设置token这个比较简单，我就直接带过了，看配置：

  拦截器类：HeaderTokenInterceptor.java

package com.ouyang.teson.intercept;

import com.ouyang.teson.WebConfig;

import com.ouyang.teson.util.JwtUtil;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.web.servlet.HandlerInterceptor;

import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.io.PrintWriter;

/**

 * Created by ThinkPad on 2017/6/20.

 */

public class HeaderTokenInterceptor implements HandlerInterceptor {

    private final static Logger logger = LoggerFactory.getLogger(HeaderTokenInterceptor.class);

    @Autowired

    JwtUtil jwtUtil;

    @Override

    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) throws Exception {

       // String  contentPath=httpServletRequest.getContextPath();

        // System.out.println("contenxPath:"+contentPath);

        String requestURI=httpServletRequest.getRequestURI();

        String tokenStr=httpServletRequest.getParameter("token");

        String token="";

        if(requestURI.contains("/api/")){

            token=httpServletRequest.getHeader("token");

            if(token==null && tokenStr==null){

                System.out.println("real token:======================is null");

                String str="{'errorCode':801,'message':'缺少token，无法验证','data':null}";

                dealErrorReturn(httpServletRequest,httpServletResponse,str);

                return false;

            }

            if(tokenStr!=null){

                token=tokenStr;

            }

            token=jwtUtil.updateToken(token);

            System.out.println("real token:=============================="+token);

            System.out.println("real ohter:=============================="+httpServletRequest.getHeader("Cookie"));

        }

        httpServletResponse.setHeader("token",token);

      /*  httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");

        httpServletResponse.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");

        httpServletResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT");*/

        return true;

    }

    @Override

    public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception {

    }

    @Override

    public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception {

    }

    // 检测到没有token，直接返回不验证

    public void dealErrorReturn(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse,Object obj){

        String json = (String)obj;

        PrintWriter writer = null;

        httpServletResponse.setCharacterEncoding("UTF-8");

        httpServletResponse.setContentType("text/html; charset=utf-8");

        try {

            writer = httpServletResponse.getWriter();

            writer.print(json);

        } catch (IOException ex) {

            logger.error("response error",ex);

        } finally {

            if (writer != null)

                writer.close();

        }

    }

}
httpServletResponse.setHeader("token",token)是设置返回response的header的token信息，每一次拦截的时候，会查看是否有token，如果没有就直接报错

springmvc跨域+token验证

在webconfig.java 类中添加以下两个方法：

 @Override

    public void addInterceptors(InterceptorRegistry registry) {

        registry.addInterceptor(getTokenHeader())

                .addPathPatterns("/api/*")

                .excludePathPatterns(

                        "/robots.txt");

    }

    //token 在header的拦截器

    @Bean

    public HandlerInterceptor getTokenHeader(){

        return new HeaderTokenInterceptor();

    }

3） token的实现

token的实现使用jwt组件生成token，如果想要自己通过md5，或者rsa加密生成token也比较简便了，只是这个token要缓存起来，每次进行验证，验证完更新token。更新token主要是更新token里包含的时间，防止token过期。如果使用token的话，可以不用存放缓存，对于登陆验证成功后，我们会生成token，这个token还能带有用户的id等基本信息，我们就可以验证他的过期时间，id等信息。

关于jwt 组件的介绍，可以去看看我的 java组件的jwt的介绍。

直接进入主题了：

maven需要导入

<!-- java-web-token 验证授权-->

    <dependency>

      <groupId>com.auth0</groupId>

      <artifactId>java-jwt</artifactId>

      <version>3.2.0</version>

    </dependency>

  <!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt -->

  <dependency>

    <groupId>io.jsonwebtoken</groupId>

    <artifactId>jjwt</artifactId>

    <version>0.7.0</version>

  </dependency>

jjwt 主要是对jwt进一步封装，可以快速开发web的token认证。

jwt工具类：jwtUtil.java

package com.ouyang.teson.util;

import io.jsonwebtoken.Claims;

import io.jsonwebtoken.JwtBuilder;

import io.jsonwebtoken.Jwts;

import io.jsonwebtoken.SignatureAlgorithm;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.stereotype.Component;

import sun.misc.BASE64Decoder;

import sun.misc.BASE64Encoder;

import javax.crypto.spec.SecretKeySpec;

import javax.xml.bind.DatatypeConverter;

import java.security.Key;

import java.util.Date;

/**

 * Created by ThinkPad on 2017/6/17.

 */

@Component

public class JwtUtil {

    public static String sercetKey="mingtianhenganghao";

    public final static long  keeptime=1800000;

   /* @Value("${token.sercetKey}")

    public  static String sercetKey;

    @Value("${token.keeptime:30000}")

    public static long keeptime;*/

    public static String generToken(String id, String issuer, String subject){

        long ttlMillis=keeptime;

        SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;

        long nowMillis = System.currentTimeMillis();

        Date now = new Date(nowMillis);

        byte[] apiKeySecretBytes = DatatypeConverter.parseBase64Binary(sercetKey);

        Key signingKey = new SecretKeySpec(apiKeySecretBytes, signatureAlgorithm.getJcaName());

        JwtBuilder builder = Jwts.builder().setId(id)

                .setIssuedAt(now);

        if(subject!=null){

            builder.setSubject(subject);

        }

        if(issuer!=null){

            builder.setIssuer(issuer);

        }

        builder .signWith(signatureAlgorithm, signingKey);

        if (ttlMillis >= 0) {

            long expMillis = nowMillis + ttlMillis;

            Date exp = new Date(expMillis);

            builder.setExpiration(exp);

        }

        return builder.compact();

    }

    public String updateToken(String token){

        try {

            Claims claims=verifyToken(token);

            String id=claims.getId();

            String subject=claims.getSubject();

            String issuer=claims.getIssuer();

            Date date = claims.getExpiration();

            return generToken(id, issuer, subject);

        }catch (Exception ex){

            ex.printStackTrace();

        }

        return "0";

    }

    public String updateTokenBase64Code(String token)  {

        BASE64Encoder base64Encoder=new  BASE64Encoder();

        BASE64Decoder decoder = new BASE64Decoder();

        try {

            token=new String(decoder.decodeBuffer(token),"utf-8");

            Claims claims=verifyToken(token);

            String id=claims.getId();

            String subject=claims.getSubject();

            String issuer=claims.getIssuer();

            Date date = claims.getExpiration();

            String newToken = generToken(id, issuer, subject);

            return base64Encoder.encode(newToken.getBytes());

        }catch (Exception ex){

            ex.printStackTrace();

        }

        return "0";

    }

    public static Claims verifyToken(String token){

        Claims claims = Jwts.parser()

                .setSigningKey(DatatypeConverter.parseBase64Binary(sercetKey))

                .parseClaimsJws(token).getBody();

        return  claims;

    }

}

关于拦截器的处理token，及更新token，上面已经给出代码，这里不再列出。来看一下简单的控制类，仅供学习，如果要运用到生产环境还得各种配置和测试。

登陆的控制方法：

@RequestMapping("/login")

    public String login(String name,String password, Model model){

        if(name==null || password==null){

            return "error";

        }

        String token = jwtUtil.generToken("xiaoming",null,null);

        model.addAttribute("token", token);

        return "redirect:/api/liu";

    }

这里没有做验证，只是简单根据账户密码，生成token后，重定向；接下来的任务就交给拦截器了，拦截器会拦截/api/* 下的请求，然后请求参数有token的会验证token，并更新token，并把token放到header里。

springmvc跨域+token验证

这里可以看到token字符串有两个点，最好把jwt生成的token进行base64位编码，jwtUtil.java里有updateTokenBase64Code(String token)就是处理token进行base64位编码的。

相关文章