jjwt官网链接：https://github.com/jwtk/jjwt
POM 依赖
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-api</artifactId><version>0.12.3</version>
</dependency>
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-impl</artifactId><version>0.12.3</version><scope>runtime</scope>
</dependency>
<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-jackson</artifactId> <!-- or jjwt-gson if Gson is preferred --><version>0.12.3</version><scope>runtime</scope>
</dependency>
<!-- Uncomment this next dependency if you are using:
- JDK 10 or earlier, and you want to use RSASSA-PSS (PS256, PS384, PS512) signature algorithms.
- JDK 10 or earlier, and you want to use EdECDH (X25519 or X448) Elliptic Curve Diffie-Hellman encryption.
- JDK 14 or earlier, and you want to use EdDSA (Ed25519 or Ed448) Elliptic Curve signature algorithms.
It is unnecessary for these algorithms on JDK 15 or later.
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId> or bcprov-jdk15to18 on JDK 7
<version>1.76</version>
<scope>runtime</scope>
</dependency>
-->
生成token
PS: 基本和java-jwt使用一致。只是最新的jjwt舍弃了一些api，换了新的api
① 标准载荷：
JwtBuilder为JWT规范中定义的标准载荷提供了方便的构建器方法。
● issuer: sets the iss(Issuer) Claim jwt签发者
● subject: sets the sub(Subject) Claim jwt针对的用户
● audience: sets the aud(Audience) Claim 校验jwt的一方
● expiration: sets the exp(Expiration Time) Claim jwt过期时间
● notBefore: sets the nbf(Not Before) Claim 定义在某个时间前该jwt是不可用的
● issuedAt: sets the iat(Issued At) Claim 签发时间
● id: sets the jti(JWT ID) Claim jwt的唯一身份标识，作一次性token,防重放攻击。
② 自定义载荷：
● claime(key,value)
● claime(Map对象)
// 创建token密钥的key,并且使用 HMAC-SHA-256 加密算法
private static SecretKey key = Jwts.SIG.HS256.key().build();/*** 生成token* @return*/
public static String genToken(){// 2. 构建jwt,将签发人设置为joe,并且使用密钥将签名jwt生成为jwsString jws = Jwts.builder().subject("Joe"). // setSubject 设置jwt针对的用户issuer("张三"). // issuer 签发人claim("name","zhangsan"). // 自定义载荷数据claim("role","admin"). // 自定义载荷数据signWith(key). // token加签认证expiration(new Date(System.currentTimeMillis()+7200*1000)). // 设置token过期时间为2Hcompact(); // 生成token字符串return jws;
}
生成token的两句核心代码：
SecretKey key = Jwts.SIG.HS256.key().build();
Jwts.builder().setSubject("Joe").signWith(key).compact();
验证解析token
/*** token 校验* @param key 密钥* @param token jws* @return*/
public static String checkToken(SecretKey key,String token ){String msg = null;try {Jws<Claims> claimsJws = Jwts.parser().verifyWith(key).build().parseSignedClaims(token);// 获取载荷的一些数据信息Claims payload = claimsJws.getPayload(); // payload 为一个map对象String issuer = payload.getIssuer();Date expiration = payload.getExpiration();String name = (String)payload.get("name");String role = (String)payload.get("role");// 测试就直接打印出去了...System.out.println("标准载荷：issuer===>"+issuer+"\texpiration=>"+expiration + "自定义载荷数据："+name+"\t"+role);return "token正确";} catch (SignatureException se) {msg = "密钥错误";return msg;}catch (MalformedJwtException me) {msg = "密钥算法或者密钥转换错误";return msg;}catch (MissingClaimException mce) {msg = "密钥缺少校验数据";return msg;}catch (ExpiredJwtException mce) {msg = "密钥已过期";return msg;}catch (JwtException jwte) {msg = "密钥解析错误";return msg;}
}
完整代码
package jwt_test;import io.jsonwebtoken.*;
import io.jsonwebtoken.security.SignatureException;
import javax.crypto.SecretKey;
import java.util.Date;/*** jjwt*/
public class JJwtUtils {// 创建token密钥的key,并且使用 HMAC-SHA-256 加密算法private static SecretKey key = Jwts.SIG.HS256.key().build();/*** 生成token* @return*/public static String genToken(){// 2. 构建jwt,将签发人设置为joe,并且使用密钥将签名jwt生成为jwsString jws = Jwts.builder().subject("Joe"). // setSubject 设置jwt针对的用户issuer("张三"). // issuer 签发人claim("name","zhangsan"). // 自定义载荷数据claim("role","admin"). // 自定义载荷数据signWith(key). // token加签认证expiration(new Date(System.currentTimeMillis()+7200*1000)). // 设置token过期时间为2Hcompact(); // 生成token字符串return jws;}/*** token 校验* @param key 密钥* @param token jws* @return*/public static String checkToken(SecretKey key,String token ){String msg = null;try {Jws<Claims> claimsJws = Jwts.parser().verifyWith(key).build().parseSignedClaims(token);// 获取载荷的一些数据信息Claims payload = claimsJws.getPayload(); // payload 为一个map对象String issuer = payload.getIssuer();Date expiration = payload.getExpiration();String name = (String)payload.get("name");String role = (String)payload.get("role");// 测试就直接打印出去了...System.out.println("标准载荷：issuer===>"+issuer+"\texpiration=>"+expiration + "自定义载荷数据："+name+"\t"+role);return "token正确";} catch (SignatureException se) {msg = "密钥错误";return msg;}catch (MalformedJwtException me) {msg = "密钥算法或者密钥转换错误";return msg;}catch (MissingClaimException mce) {msg = "密钥缺少校验数据";return msg;}catch (ExpiredJwtException mce) {msg = "密钥已过期";return msg;}catch (JwtException jwte) {msg = "密钥解析错误";return msg;}}/*** 测试*/public static void main(String[] args) {String token = genToken();System.out.println(token);// 断言测试// assert Jwts.parser().verifyWith(key).build().parseSignedClaims(token).getPayload().getSubject().equals("Joe");String res = checkToken(key, token);System.out.println(res);}}
详解)
