<dependency> 
	<groupId>org.springframework.boot</groupId> 
	<artifactId>spring-boot-starter-web</artifactId> 
</dependency> 

package com.offcn.controller; 
import org.springframework.web.bind.annotation.RequestMapping; 
import org.springframework.web.bind.annotation.RestController; 
@RestController 
public class HelloController { 
	@RequestMapping("/hello") 
	public String hello(){ 
		return "hello"; 
	} 
}

package com.offcn; 
import org.springframework.boot.SpringApplication; 
import org.springframework.boot.autoconfigure.SpringBootApplication; 
import org.springframework.context.annotation.Bean; 
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; 
@SpringBootApplication 
public class SpringbootSecurityJwtApplication {
public static void main(String[] args) { 
	SpringApplication.run(SpringbootSecurityJwtApplication.class, args); 
	} 
}

<!-- spring-data-jpa --> 
<dependency> 
	<groupId>org.springframework.boot</groupId> 
	<artifactId>spring-boot-starter-data-jpa</artifactId> 
</dependency> 
<!-- mysql --> 
<dependency> 
	<groupId>mysql</groupId> 
	<artifactId>mysql-connector-java</artifactId> 
<version>5.1.30</version> 
</dependency> 
<dependency> 
	<groupId>org.projectlombok</groupId> 
	<artifactId>lombok</artifactId> 
</dependency>

spring: 
	datasource: 
	url: jdbc:mysql://localhost:3306/springboot-security?serverTimezone=GMT%2B8 
	username: root 
	password: 123 
	driver-class-name: com.mysql.jdbc.Driver 
	jpa:
		hibernate: 
		ddl-auto: update 
		show-sql: true 
	application: 
		name: demo1 
		#配置應(yīng)用名稱 

@Entity 
@Table(name = "tb_user") 
@Data 
@NoArgsConstructor 
@AllArgsConstructor 
public class User { 
@Id 
@GeneratedValue 
	private  Long id; 
	private String username; 
	private String password; 
}

package com.offcn.dao; 
import com.offcn.po.User; 
import org.springframework.data.jpa.repository.JpaRepository;
public interface UserDao extends JpaRepository<User,Long> { 
	User findByUsername(String username); 
}

package com.offcn.controller; 
import com.offcn.dao.UserDao; 
import com.offcn.po.User; 
import org.springframework.beans.factory.annotation.Autowired; 
import org.springframework.stereotype.Controller; 
import org.springframework.web.bind.annotation.PostMapping; 
import org.springframework.web.bind.annotation.RequestBody; 
import org.springframework.web.bind.annotation.RequestMapping; 
import org.springframework.web.bind.annotation.ResponseBody; 
@Controller 
@RequestMapping("/users") 
public class UserController { 
	@Autowired 
	private UserDao userDao; 
	/**
	* 
	該方法是注冊(cè)用戶的方法，默認(rèn)放開訪問控制 
	* 
	@param user 
	*/
	@PostMapping("/signup") 
	@ResponseBody 
	public String signUp(@RequestBody User user) { 
		user.setPassword(user.getPassword()); 
		try {
			userDao.save(user); 
			return "success"; 
		} catch (Exception e) { 
			e.printStackTrace(); 
			return "error";
		} 
	} 
}

<dependency> 
	<groupId>org.springframework.boot</groupId> 
	<artifactId>spring-boot-starter-security</artifactId> 
</dependency> 
<dependency> 
	<groupId>io.jsonwebtoken</groupId> 
	<artifactId>jjwt</artifactId> 
	<version>0.7.0</version> 
</dependency> 

/**
* 驗(yàn)證用戶名密碼正確后，生成一個(gè) token，并將 token 返回給客戶端
* 
該類繼承自 UsernamePasswordAuthenticationFilter，重寫了其中的 2 個(gè)方法 
* 
attemptAuthentication ：接收并解析用戶憑證。 
* successfulAuthentication ：用戶成功登錄后，這個(gè)方法會(huì)被調(diào)用，我們?cè)谶@個(gè)方法里生成 
token。 
*
*/
public class JWTLoginFilter extends UsernamePasswordAuthenticationFilter 
{ 
	private AuthenticationManager authenticationManager; 
	public JWTLoginFilter(AuthenticationManager authenticationManager) { 
		this.authenticationManager = authenticationManager; 
	}
	// 接收并解析用戶憑證 
	@Override 
	public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException { 
	try {
		User user = new ObjectMapper() .readValue(req.getInputStream(), User.class); 
		return authenticationManager.authenticate( 
		new UsernamePasswordAuthenticationToken( 
			user.getUsername(), 
			user.getPassword(), 
			new ArrayList<>()) 
		); 
	} catch (IOException e) { 
		throw new RuntimeException(e); 
	} 
}
// 用戶成功登錄后，這個(gè)方法會(huì)被調(diào)用，我們?cè)谶@個(gè)方法里生成 token 
@Override 
protected void successfulAuthentication(HttpServletRequest req, HttpServletResponse res, FilterChain chain, Authentication auth) throws IOException, ServletException {
	String token = Jwts.builder() 
	.setSubject(((org.springframework.security.core.userdetails.User) 
	auth.getPrincipal()).getUsername()) 
	.setExpiration(new Date(System.currentTimeMillis() + 60 * 60 * 24 * 
	1000)) 
	.signWith(SignatureAlgorithm.HS512, "MyJwtSecret") 
	.compact(); 
	res.addHeader("Authorization", "Bearer " + token); 
	} 
}

/**
* 
token 的校驗(yàn) 
* 
該類繼承自 BasicAuthenticationFilter，在 doFilterInternal 方法中， 
* 
從 http 頭的 Authorization 項(xiàng)讀取 token 數(shù)據(jù)，然后用 Jwts 包提供的方法校驗(yàn) token 的合 
法性。
* 如果校驗(yàn)通過，就認(rèn)為這是一個(gè)取得授權(quán)的合法請(qǐng)求 
*
*/
public class JWTAuthenticationFilter extends BasicAuthenticationFilter { 
	public JWTAuthenticationFilter(AuthenticationManager authenticationManager) { 
		super(authenticationManager); 
	}
	@Override 
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain 
chain) throws IOException, ServletException { 
		String header = request.getHeader("Authorization");
		if (header == null || !header.startsWith("Bearer ")) { 
			chain.doFilter(request, response); 
		return; 
		}
		UsernamePasswordAuthenticationToken authentication = 
		getAuthentication(request); 
		SecurityContextHolder.getContext().setAuthentication(authentication); 
		chain.doFilter(request, response); 
	}
	private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
		String token = request.getHeader("Authorization"); 
		if (token != null) { 
		// parse 
			the token. 
			String user = Jwts.parser() 
			.setSigningKey("MyJwtSecret") 
			.parseClaimsJws(token.replace("Bearer ", "")) 
			.getBody() 
			.getSubject(); 
		if (user != null) { 
		return new UsernamePasswordAuthenticationToken(user, null, new 
			ArrayList<>()); 
			}
	return null; 
	}
	return null; 
	} 
}

@Service("userDetailServiceImpl") 
public class UserDetailServiceImpl implements UserDetailsService { 
@Autowired 
private UserDao userDao; 
@Override 
public UserDetails loadUserByUsername(String username) throws 
UsernameNotFoundException { 
//根據(jù)用戶名查詢用戶信息 
com.offcn.po.User user = userDao.findByUsername(username); 
//為用戶授權(quán)（暫時(shí)未驗(yàn)證權(quán)限） 
List<GrantedAuthority> grantedAuthorityList=new ArrayList<>(); 
grantedAuthorityList.add(new SimpleGrantedAuthority("ROLE_USER")); 
return new User(username,user.getPassword(),grantedAuthorityList); 
} 
}

@SpringBootApplication 
public class SpringbootSecurityJwtApplication { 
public static void main(String[] args) { 
SpringApplication.run(SpringbootSecurityJwtApplication.class, args); 
}
@Bean 
public BCryptPasswordEncoder bCryptPasswordEncoder() { 
return new BCryptPasswordEncoder(); 
} 
}

/**
* 
SpringSecurity 的配置 
* 
通過 SpringSecurity 的配置，將 JWTLoginFilter，JWTAuthenticationFilter 組合在一起 
*
*/
@Configuration 
@Order(SecurityProperties.DEFAULT_FILTER_ORDER) 
public class WebSecurityConfig 
extends WebSecurityConfigurerAdapter { 
@Autowired 
private UserDetailsService 
userDetailServiceImpl; 
@Autowired 
private BCryptPasswordEncoder bCryptPasswordEncoder; 
@Override 
protected void configure(HttpSecurity http) throws Exception { 
http.cors().and().csrf().disable().authorizeRequests() 
.antMatchers(HttpMethod.POST, "/users/signup").permitAll() 
.anyRequest().authenticated() 
.and() 
.addFilter(new 
JWTLoginFilter(authenticationManager())) 
.addFilter(new 
JWTAuthenticationFilter(authenticationManager())); 
}
@Override 
public void configure(AuthenticationManagerBuilder auth) throws Exception { 
auth.userDetailsService(userDetailServiceImpl).passwordEncoder(bCryptPasswordEncod 
er);
} 
}

@Controller 
@RequestMapping("/users") 
public class UserController { 
@Autowired 
private BCryptPasswordEncoder bCryptPasswordEncoder; 
@Autowired 
private UserDao userDao; 
/**
* 
該方法是注冊(cè)用戶的方法，默認(rèn)放開訪問控制 
* 
@param user 
*/
@PostMapping("/signup") 
@ResponseBody 
public String signUp(@RequestBody User user) { 
user.setPassword(bCryptPasswordEncoder.encode(user.getPassword())); 
try {
userDao.save(user); 
return "success"; 
} catch (Exception e) { 
e.printStackTrace(); 
return "error"; 
} } }