@Component
public class JwtTokenUtil {
    // 密鑰，用于簽名和驗(yàn)證 JWT，應(yīng)妥善保管
    @Value("${jwt.secret}")
    private String secret;
    // JWT 的過(guò)期時(shí)間，這里設(shè)置為 10 小時(shí)
    @Value("${jwt.expiration}")
    private Long expiration;

    // 根據(jù)用戶詳細(xì)信息生成 JWT
    public String generateToken(SysRoleNameUserId sysRoleNameUserId) {
        //自定義的聲明
        Map<String, Object> claims = new HashMap<>();
        //鑒權(quán)所需的權(quán)限角色
        claims.put("identities",sysRoleNameUserId.getRoleNames());
        return createToken(claims, String.valueOf(sysRoleNameUserId.getUserId()));
    }

    // 創(chuàng)建 JWT 的具體方法
    private String createToken(Map<String, Object> claims, String subject) {
        return Jwts.builder()
                .setClaims(claims)//自定義的聲明
                .setSubject(subject)//存的用戶id
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + expiration))
                .signWith(SignatureAlgorithm.HS256, secret)
                .compact();
    }

    //解析jwt
    public Claims extractAllClaims(String token) {
        return Jwts.parserBuilder()
                .setSigningKey(secret)
                .build()
                .parseClaimsJws(token)
                .getBody();
    }
}

jwt:
  secret: your-secret-key-here-must-be-at-least-256-bits-long
  expiration: 1000 * 60 * 60 * 10 # 10 hour

@Component
public class JwtFilter implements GlobalFilter, Ordered {

    @Resource
    private JwtTokenUtil jwtTokenUtil;

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        HttpHeaders headers = request.getHeaders();
        List<String> authHeader = headers.get("Authorization");
        if (authHeader != null && authHeader.get(0).startsWith("Bearer ")) {
            String token = authHeader.get(0).substring(7);
            // 驗(yàn)證 JWT 并提取角色信息
            Claims claims = null;
            try{
                claims = jwtTokenUtil.extractAllClaims(token);
            }catch (IllegalArgumentException e) {
                //解析 JWT 時(shí)發(fā)生其他錯(cuò)誤
                System.out.println("解析 token 時(shí)發(fā)生其他錯(cuò)誤");
            } catch (ExpiredJwtException e) {
                //JWT 已過(guò)期
                System.out.println("token 已過(guò)期");
            }
            //取出權(quán)限角色列表
            Object identitiesObj = claims.get("identities");
            List<GrantedAuthority> authorities = new ArrayList<>();
            if (identitiesObj instanceof List<?>) {
                for (Object role : (List<?>) identitiesObj) {
                    if (role instanceof String) {
                        // 將字符串轉(zhuǎn)換為 SimpleGrantedAuthority
                        authorities.add(new SimpleGrantedAuthority((String) role));
                    }
                }
            }
            String userId = claims.getSubject();
            //將 Authentication 對(duì)象設(shè)置到 SecurityContextHolder 中后，Spring Security 就能在后續(xù)的授權(quán)過(guò)程中使用這些權(quán)限信息了。
            Authentication authentication = new UsernamePasswordAuthenticationToken(userId, null, authorities);
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return -1;
    }
}

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        http.csrf().disable()// 關(guān)閉 CSRF（跨站請(qǐng)求偽造）防護(hù)。在無(wú)狀態(tài) API（如 JWT 場(chǎng)景）中，CSRF 防護(hù)不必要（通常依賴 Authorization 頭而非 Cookie）。 避免對(duì) POST、PUT 等請(qǐng)求要求攜帶 CSRF Token。
                .authorizeExchange()
                .pathMatchers("/api/product/**").permitAll()
                .pathMatchers("/admin/**").permitAll()
                .anyExchange().authenticated();
        return http.build();
    }
}