springboot jwt redis实现token刷新

这里不会涉及太多Redis相关的东西，如果不熟悉，那么你只需要记住ObjectRedisTemplate的value就是存储的Java对象。

import java.time.Duration;
import java.time.LocalDateTime;
import java.time.ZoneId;
import java.util.Collections;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.UUID;
import java.util.concurrent.TimeUnit;

import javax.servlet.http.cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.HttpHeaders;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;

import io.springboot.jwt.domain.User;
import io.springboot.jwt.redis.ObjectRedisTemplate;
import io.springboot.jwt.web.support.UserToken;

@RestController
@RequestMapping("/login")
public class LoginController {
	
	@Autowired
	private ObjectRedisTemplate objectRedisTemplate;
	
	@Value("${jwt.key}")
	private String jwtKey;		// 从配置中读取到 jwt 的key

	@PostMapping
	public Object login(HttpServletRequest request,
						HttpServletResponse response,
						@RequestParam("account") String account,
						@RequestParam("password") String password,
						@RequestParam(value = "remember", required = false) boolean remember) {

		
		User user = new User(); 
		user.setId(1);
		
		
		String ip = request.getRemoteAddr();							// 客户端ip（如果是反向代理，要根据情况获取实际的ip）
    	String userAgent = request.getHeader(HttpHeaders.USER_AGENT);	// UserAgent
    	
    	// 登录时间
    	LocalDateTime issuedAt = LocalDateTime.now();
    	
    	
    	// 过期时间，如果是“记住我”，则Token有效期是7天，反之则是半个小时
    	LocalDateTime expiresAt = issuedAt.plusSeconds(remember 
    								? TimeUnit.DAYS.toSeconds(7)
    								: TimeUnit.MINUTES.toSeconds(30));
    	
    	// 距离过期时间剩余的秒数
    	int expiresSeconds = (int) Duration.between(issuedAt, expiresAt).getSeconds();
    	
    	
    	UserToken userToken = new UserToken();
    	// 随机生成uuid，作为token的id
    	userToken.setId(UUID.randomUUID().toString().replace("-", ""));
    	userToken.setUserId(user.getId());
    	userToken.setIssuedAt(issuedAt);
    	userToken.setExpiresAt(expiresAt);
    	userToken.setRemember(remember);
    	userToken.setUserAgent(userAgent);
    	userToken.setIp(ip);
    	
    	// 序列化Token对象到Redis
    	this.objectRedisTemplate.opsForValue().set("token:" + user.getId(), userToken, expiresSeconds, TimeUnit.SECONDS);
    	
    	
    	Map jwtHeader = new HashMap <>();
    	jwtHeader.put("alg", "alg");
    	jwtHeader.put("JWT", "JWT");
    	String token = JWT.create()
    			.withHeader(jwtHeader)
    			// 把用户的id写入到token
    			.withClaim("id", user.getId())
    			.withIssuedAt(new Date(issuedAt.atZone(ZoneId.systemDefault()).toInstant().toEpochMilli()))
    			
    			// .withExpiresAt(new Date(expiresAt.atZone(ZoneId.systemDefault()).toInstant().toEpochMilli()))
    			// 使用生成的tokenId作为jwt的id
    			.withJWTId(userToken.getId())
    			.sign(Algorithm.HMAC256(this.jwtKey));

    	
    	cookie cookie = new cookie("_token", token);
    	cookie.setSecure(request.isSecure());
    	cookie.setHttpOnly(true);
    	// 非记住我的状态情况，cookie生命周期设置为-1，浏览器关闭后就立即删除
    	cookie.setMaxAge(remember ? expiresSeconds : -1);
    	cookie.setPath("/");
    	response.addcookie(cookie);
    	
		return Collections.singletonMap("success", true);
	}
}

this.objectRedisTemplate.opsForValue().set("token:" + user.getId() + ":" + userToken.getId(), userToken, expiresSeconds, TimeUnit.SECONDS);

token:{userId}:*

import java.util.concurrent.TimeUnit;

import javax.servlet.http.cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import org.springframework.web.util.WebUtils;

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;

import io.springboot.jwt.redis.ObjectRedisTemplate;
import io.springboot.jwt.web.support.UserToken;

public class TokenValidateInterceptor extends HandlerInterceptorAdapter {

	private static final Logger LOGGER = LoggerFactory.getLogger(TokenValidateInterceptor.class);

	@Autowired
	private ObjectRedisTemplate objectRedisTemplate;

	@Value("${jwt.key}")
	private String jwtKey;

	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {

		// 解析 cookie
		cookie cookie = WebUtils.getcookie(request, "_token");

		if (cookie != null) {

			DecodedJWT decodedJWT = null;

			Integer userId = null;

			try {
				decodedJWT = JWT.require(Algorithm.HMAC256(this.jwtKey)).build().verify(cookie.getValue());
				userId = decodedJWT.getClaim("id").asInt();
			} catch (JWTVerificationException e) {
				LOGGER.warn("解析Token异常：{}，token={}", e.getMessage(), cookie.getValue());
			}

			if (userId != null) {

				String tokenKey = "token:" + userId;

				UserToken userToken = (UserToken) objectRedisTemplate.opsForValue().get(tokenKey);

				if (userToken != null && userToken.getId().equals(decodedJWT.getId()) && userId.equals(userToken.getUserId())) {

					
					this.objectRedisTemplate.expire(tokenKey, userToken.getRemember() 
							? TimeUnit.DAYS.toSeconds(7) 
							: TimeUnit.MINUTES.toSeconds(30),
								TimeUnit.SECONDS);

					//TODO 把当前用户的身份信息，存储到当前请求的上下文，以便在Controller中获取 （例如存储到：ThreadLocal）
					return true;
				}
			}
		}
		
		
		
		// TODO 抛出未登录异常，在全局处理器中响应客户端（也可以直接在这里通过Response响应）
		return false;
	}
	
	@Override
	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)	throws Exception {
		// TODO，需要记得清理存储到当前请求的上下文中的用户身份信息
	}
}