JWT知识

JWT概念

JWT组成

Java实现JWT

Header

String getHeader() {String header = "{\"alg\":\"HS256\",\"typ\":\"JWT\"}";String encodeBase64URLSafeString = Base64.encodeBase64URLSafeString(header.getBytes(StandardCharsets.UTF_8));System.out.println(encodeBase64URLSafeString);
}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9

PayLoad

void getPayLoad(){String payload = "{\"sub\":\"7isi\",\"id\":\"1001\",\"role\":\"admin\"}";String encodeBase64URLSafeString = Base64.encodeBase64URLSafeString(payload.getBytes(StandardCharsets.UTF_8));System.out.println(encodeBase64URLSafeString);
}

eyJzdWIiOiI3aXNpIiwiaWQiOiIxMDAxIiwicm9sZSI6ImFkbWluIn0

Signature

@Test
void generatesignature() throws NoSuchAlgorithmException, InvalidKeyException {String secret = UUID.randomUUID().toString().replaceAll("-", "");String data = getHeader() +"." + getPayLoad();Mac mac = Mac.getInstance("HmacSHA256");SecretKeySpec spec = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8),"HmacSHA256");mac.init(spec);byte[] bytes = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));String res = Base64.encodeBase64URLSafeString(bytes);String jwt = data + "." + res;System.out.println(jwt);
}

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI3aXNpIiwiaWQiOiIxMDAxIiwicm9sZSI6ImFkbWluIn0.vpwacNY4fLdQzF7iSDyGLnYMqbgBoWRVLNG7Ail15Ss

验证签名值

计算出来和原来的对比，我们的secreat是早就准备好的

Web中使用JWT

JJWT

依赖

<dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-api</artifactId><version>0.11.5</version></dependency><dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-impl</artifactId><version>0.11.5</version><scope>runtime</scope></dependency><dependency><groupId>io.jsonwebtoken</groupId><artifactId>jjwt-jackson</artifactId><version>0.11.5</version><scope>runtime</scope></dependency><dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15on</artifactId><version>1.70</version><scope>runtime</scope></dependency>

例子

生成jws