Spring Security 与 JWT：过滤器链上的无状态认证

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbGljZSIsInJvbGVzIjpbIlVTRVIiXX0.xK9f...(签名示意)

Header     {"alg":"HS256"}                                    用什么算法签名
Payload    {"sub":"alice","roles":["USER"],"exp":1790000000}   声明（claims）
Signature  HMACSHA256(base64url(Header) + "." + base64url(Payload), 密钥)

请求 → CSRF 过滤器 → … → JWT 过滤器（我们插入）→ … → 授权过滤器 → Controller
                              │                        │
                   解析 token、塞 SecurityContext    对照权限规则放行或拒绝

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.12.6</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.12.6</version>
    <scope>runtime</scope>
</dependency>

@Configuration
@EnableMethodSecurity                        // 打开 @PreAuthorize 方法级授权
public class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http, JwtAuthenticationFilter jwtFilter) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated())
            .exceptionHandling(e -> e.authenticationEntryPoint((req, resp, ex) -> {
                resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                resp.setContentType("application/json;charset=UTF-8");
                resp.getWriter().write("{\"code\":401,\"message\":\"未登录或凭证无效\"}");
            }))
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    UserDetailsService userDetailsService(PasswordEncoder encoder) {
        return username -> {                              // 演示用内存用户；生产改为从库查询
            if (!"alice".equals(username)) {
                throw new UsernameNotFoundException("用户不存在");
            }
            // 存的是 BCrypt 哈希，不是明文
            return User.withUsername("alice").password(encoder.encode("user123")).roles("USER").build();
        };
    }

    @Bean
    AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

@Component
public class JwtService {

    private static final SecretKey KEY = Keys.hmacShaKeyFor(
            "change-me-in-prod-at-least-32-bytes-long!!".getBytes(StandardCharsets.UTF_8));
    private static final long EXPIRE_MS = Duration.ofHours(2).toMillis();

    public String issue(String username, List<String> roles) {
        Date now = new Date();
        return Jwts.builder()
                .subject(username)
                .claim("roles", roles)
                .issuedAt(now)
                .expiration(new Date(now.getTime() + EXPIRE_MS))
                .signWith(KEY)
                .compact();
    }

    public Claims parse(String token) {
        return Jwts.parser().verifyWith(KEY).build().parseSignedClaims(token).getPayload();
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final AuthenticationManager authenticationManager;
    private final JwtService jwtService;

    public AuthController(AuthenticationManager authenticationManager, JwtService jwtService) {
        this.authenticationManager = authenticationManager;
        this.jwtService = jwtService;
    }

    public record LoginRequest(String username, String password) { }

    public record LoginResponse(String token) { }

    @PostMapping("/login")
    public LoginResponse login(@RequestBody LoginRequest req) {
        try {
            authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(req.username(), req.password()));
        } catch (BadCredentialsException e) {
            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "用户名或密码错误");
        }
        List<String> roles = List.of("USER");             // 生产：从库查用户角色
        return new LoginResponse(jwtService.issue(req.username(), roles));
    }
}

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;

    public JwtAuthenticationFilter(JwtService jwtService) {
        this.jwtService = jwtService;
    }

    @Override
    @SuppressWarnings("unchecked")
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
        String header = request.getHeader("Authorization");
        if (header == null || !header.startsWith("Bearer ")) {
            chain.doFilter(request, response);            // 没 token 不拦，交给授权环节裁决
            return;
        }
        try {
            Claims claims = jwtService.parse(header.substring(7));
            List<String> roles = (List<String>) claims.get("roles");
            var authorities = roles.stream().map(r -> new SimpleGrantedAuthority("ROLE_" + r)).toList();
            var authentication = new UsernamePasswordAuthenticationToken(
                    claims.getSubject(), null, authorities);
            SecurityContextHolder.getContext().setAuthentication(authentication);
        } catch (JwtException | IllegalArgumentException e) {
            SecurityContextHolder.clearContext();         // 签名错、格式错、过期，一律当作未登录
        }
        chain.doFilter(request, response);
    }
}

@RestController
public class BookController {

    @GetMapping("/api/books")
    public String books() {
        return "公开书单";
    }

    @GetMapping("/api/me")
    public String me(Authentication authentication) {
        return "你好，" + authentication.getName();
    }

    @PreAuthorize("hasRole('ADMIN')")
    @DeleteMapping("/api/admin/books/{id}")
    public String remove(@PathVariable Long id) {
        return "已删除 " + id;
    }
}

# 1. 公开接口放行
curl -i http://localhost:8080/api/books
# HTTP/1.1 200

# 2. 无 token 访问受保护接口
curl -i -X DELETE http://localhost:8080/api/admin/books/1
# HTTP/1.1 401  {"code":401,"message":"未登录或凭证无效"}

# 3. 登录拿 token
curl -s -X POST http://localhost:8080/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"username":"alice","password":"user123"}'
# {"token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIi..."}

# 4. 带 token 但角色不够（alice 是 USER，接口要 ADMIN）
curl -i -X DELETE http://localhost:8080/api/admin/books/1 \
     -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIi..."
# HTTP/1.1 403

# 5. 篡改 token（末尾加一个字母，签名对不上）
curl -i http://localhost:8080/api/me \
     -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIi...x"
# HTTP/1.1 401