我正在嘗試實現某種基于角色的身份驗證。我正在使用 JWT 令牌。我一直在看指南，但都提到了“彈簧靴”的使用。如何在 Java 中對我的寧靜端點設置基于角色的身份驗證？最好通過某種過濾器。我正在尋找一種簡單地添加的方法：在端點之前。@Role(Role.ADMIN)我已經設置了以下類：枚舉角色：public enum Role { User, Admin}簡單的智威湯遜令牌：{ "sub": "users/TzMUocMF4p", "exp": 1554646441, "username": "[email protected]", "ID": 6, "Role": "Admin", "iat": 1554641041}簡單 CRUD 端點@Path("User")public class UserResource { @EJB private UserDAO userappDAO; @GET @JWTTokenNeeded @Produces("application/json") public List<Userapp> all() { return userappDAO.getAll(); }}JWT 驗證 （） 類如下：@[email protected]@Retention(RUNTIME)@Target({TYPE, METHOD})public @interface JWTTokenNeeded {}實際過濾器：@Provider@JWTTokenNeeded@Priority(Priorities.AUTHENTICATION)public class JWTTokenNeededFilter implements ContainerRequestFilter { @Override public void filter(ContainerRequestContext requestContext) throws IOException {// Get the HTTP Authorization header from the requestString authorizationHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);try { // Extract the token from the HTTP Authorization header String token = authorizationHeader.substring("Bearer".length()).trim(); // Validate the token Jwts.parser().setSigningKey("MYSECRET".getBytes("UTF-8")).parseClaimsJws(token);}catch (Exception e) { requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());}}}如果用戶未獲得授權，我想通過以下方式退出：requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());如果用戶已獲得授權，則端點必須執行該操作。
1 回答
米琪卡哇伊
TA貢獻1998條經驗 獲得超6個贊
我找到了一個可行的解決方案。它包括向接口和類添加幾行。@JWTTokenNeededJWTTokenNeededFilter
我最終得到了以下代碼：
JWTTokenNeedFilter：
@Provider
@JWTTokenNeeded
@Priority(Priorities.AUTHENTICATION)
public class JWTTokenNeededFilter implements ContainerRequestFilter {
@Context
private ResourceInfo resourceInfo;
@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
// Get the HTTP Authorization header from the request
String authorizationHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION);
try {
// Extract the token from the HTTP Authorization header
String token = authorizationHeader.substring("Bearer".length()).trim();
// Validate the token
Claims claims = Jwts.parser().setSigningKey("MYSECRET".getBytes("UTF-8")).parseClaimsJws(token).getBody();
Method method =resourceInfo.getResourceMethod();
if( method != null){
// Get allowed permission on method
JWTTokenNeeded JWTContext = method.getAnnotation(JWTTokenNeeded.class);
Role permission = JWTContext.Permissions();
if(permission != Role.NoRights ) {
// Get Role from jwt
String roles = claims.get("Role", String.class);
Role roleUser = Role.valueOf(roles);
// if role allowed != role jwt -> UNAUTHORIZED
if (!permission.equals(roleUser)) {
throw new Exception("no roles");
}
}
}
}
catch (Exception e) {
e.printStackTrace();
requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());
}
}
}
@JWTTokenNeeded接口：
@javax.ws.rs.NameBinding
@Retention(RUNTIME)
@Target({TYPE, METHOD})
public @interface JWTTokenNeeded {
Role Permissions() default Role.NoRights;
}
允許角色訪問終端節點就像添加@JWTTokenNeeded(Permissions = Role.Admin)
下面是一個示例：
@Path("User")
public class UserResource {
@EJB
private UserappDAO userDAO;
@GET
@JWTTokenNeeded(Permissions = Role.Admin)
@Produces("application/json")
public List<Userapp> all() {
return userDAO.getAll();
}
}
添加回答
舉報
0/150
提交
取消