1. JWT基础与Spring Boot集成准备在分布式系统中传统的Session认证方式会面临服务器资源消耗大、跨域访问困难等问题。JWTJSON Web Token作为一种无状态认证方案通过自包含的Token实现安全信息传输特别适合微服务架构。1.1 JWT核心组成解析JWT由三部分组成就像一张被拆分的发票Header声明加密算法和令牌类型{ alg: HS256, typ: JWT }Payload存放有效信息的载体{ sub: 1234567890, name: John Doe, admin: true, iat: 1516239022 }Signature前两部分Base64编码后通过指定算法生成的签名实际项目中我常用java-jwt库生成Token下面是典型代码示例String token JWT.create() .withSubject(userId) .withExpiresAt(new Date(System.currentTimeMillis() 3600_000)) .sign(Algorithm.HMAC256(your-256-bit-secret));1.2 Spring Boot项目初始化首先创建基础Maven项目关键依赖如下dependencies !-- Spring Boot基础 -- dependency groupIdorg.springframework.boot/groupId artifactIdspring-boot-starter-web/artifactId /dependency !-- JWT支持 -- dependency groupIdcom.auth0/groupId artifactIdjava-jwt/artifactId version3.18.3/version /dependency !-- 开发常用工具包 -- dependency groupIdorg.projectlombok/groupId artifactIdlombok/artifactId optionaltrue/optional /dependency /dependencies建议项目结构采用分层设计src/main/java ├── config # 配置类 ├── controller # 控制器 ├── dto # 数据传输对象 ├── entity # 数据库实体 ├── exception # 异常处理 ├── filter # 过滤器 ├── service # 业务逻辑 └── util # 工具类2. 实现JWT认证核心逻辑2.1 Token生成与验证工具类创建JwtUtil.java工具类时我通常会考虑以下几个关键点密钥管理建议从配置中心读取而非硬编码失效时间生产环境建议2-4小时自定义声明添加业务需要的用户信息完整实现示例public class JwtUtil { private static final String SECRET your-secret-key; private static final long EXPIRATION 3600L; // 1小时 public static String generateToken(UserDetails userDetails) { return JWT.create() .withSubject(userDetails.getUsername()) .withClaim(roles, userDetails.getAuthorities() .stream() .map(GrantedAuthority::getAuthority) .collect(Collectors.toList())) .withExpiresAt(new Date(System.currentTimeMillis() EXPIRATION * 1000)) .sign(Algorithm.HMAC256(SECRET)); } public static DecodedJWT validateToken(String token) { JWTVerifier verifier JWT.require(Algorithm.HMAC256(SECRET)).build(); return verifier.verify(token); } }2.2 集成Spring SecuritySpring Security配置需要特别注意以下几点禁用CSRF保护因使用无状态JWT设置无状态Session管理策略配置白名单路径安全配置类示例EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeRequests() .antMatchers(/api/auth/**).permitAll() .anyRequest().authenticated() .and() .addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class); } Bean public JwtAuthenticationFilter jwtAuthenticationFilter() { return new JwtAuthenticationFilter(); } }3. 权限控制实战方案3.1 方法级权限注解Spring Security原生支持方法级权限控制但我们可以通过自定义注解增强可读性Target({ElementType.METHOD, ElementType.TYPE}) Retention(RetentionPolicy.RUNTIME) PreAuthorize(hasAnyRole(ADMIN)) public interface AdminOnly { }使用时直接在Controller方法上标注AdminOnly GetMapping(/admin/data) public ResponseEntity? getAdminData() { // ... }3.2 动态权限控制对于需要从数据库动态加载权限的场景我推荐实现PermissionEvaluator接口Component public class CustomPermissionEvaluator implements PermissionEvaluator { Autowired private PermissionService permissionService; Override public boolean hasPermission(Authentication auth, Object targetId, String targetType, Object permission) { String username auth.getName(); return permissionService.checkPermission(username, targetType, permission.toString()); } }配置时需要注册表达式处理器Configuration EnableGlobalMethodSecurity(prePostEnabled true) public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration { Autowired private CustomPermissionEvaluator permissionEvaluator; Override protected MethodSecurityExpressionHandler createExpressionHandler() { DefaultMethodSecurityExpressionHandler handler new DefaultMethodSecurityExpressionHandler(); handler.setPermissionEvaluator(permissionEvaluator); return handler; } }4. 高级特性实现4.1 Token自动续期方案通过双Token机制实现无感刷新Access Token短期有效如2小时Refresh Token长期有效如7天实现代码示例public class TokenRefreshService { Value(${jwt.refresh-expiration}) private Long refreshExpiration; public String generateRefreshToken(User user) { return JWT.create() .withSubject(user.getUsername()) .withExpiresAt(new Date(System.currentTimeMillis() refreshExpiration * 1000)) .sign(Algorithm.HMAC256(refresh-secret)); } public boolean validateRefreshToken(String token) { try { JWT.require(Algorithm.HMAC256(refresh-secret)) .build() .verify(token); return true; } catch (Exception e) { return false; } } }4.2 黑名单与并发控制使用Redis实现Token黑名单和并发控制Service public class TokenBlacklistService { Autowired private RedisTemplateString, String redisTemplate; public void addToBlacklist(String token, long expiration) { redisTemplate.opsForValue().set( blacklist: token, 1, expiration, TimeUnit.SECONDS); } public boolean isBlacklisted(String token) { return Boolean.TRUE.equals( redisTemplate.hasKey(blacklist: token)); } }5. 实战问题解决方案5.1 跨域资源共享(CORS)配置在Spring Boot中配置全局CORSConfiguration public class CorsConfig implements WebMvcConfigurer { Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping(/**) .allowedOrigins(*) .allowedMethods(*) .allowedHeaders(*) .exposedHeaders(Authorization) .maxAge(3600); } }5.2 性能优化建议签名算法选择HS256对称加密性能最佳RS256非对称加密更安全但性能较差Payload精简避免存储过多用户信息敏感数据应加密存储缓存策略Cacheable(value userDetails, key #username) public UserDetails loadUserByUsername(String username) { // 数据库查询 }6. 测试与调试技巧6.1 单元测试示例使用MockMvc测试受保护端点SpringBootTest AutoConfigureMockMvc class SecureControllerTest { Autowired private MockMvc mockMvc; Test void testUnauthorizedAccess() throws Exception { mockMvc.perform(get(/api/protected)) .andExpect(status().isUnauthorized()); } Test void testAuthorizedAccess() throws Exception { String token valid-jwt-token; mockMvc.perform(get(/api/protected) .header(Authorization, Bearer token)) .andExpect(status().isOk()); } }6.2 常见问题排查签名验证失败检查密钥是否一致验证算法是否匹配Token过期问题try { JWTVerifier verifier JWT.require(algorithm).build(); verifier.verify(token); } catch (TokenExpiredException e) { // 处理过期逻辑 }权限不足检查Token中的roles/authorities声明验证Spring Security配置是否正确7. 生产环境最佳实践7.1 密钥安全管理推荐方案使用环境变量注入密钥Value(${jwt.secret}) private String secret;定期轮换密钥建议每90天7.2 监控与日志添加JWT相关监控指标Bean public MeterRegistryCustomizerMeterRegistry jwtMetrics() { return registry - { Counter.builder(jwt.tokens.issued) .description(Total JWT tokens issued) .register(registry); Counter.builder(jwt.tokens.invalid) .description(Invalid JWT tokens) .tag(reason, expired) .register(registry); }; }8. 完整电商案例实现8.1 用户登录接口RestController RequestMapping(/api/auth) public class AuthController { Autowired private AuthenticationManager authenticationManager; PostMapping(/login) public ResponseEntity? login(RequestBody LoginRequest request) { Authentication authentication authenticationManager.authenticate( new UsernamePasswordAuthenticationToken( request.getUsername(), request.getPassword())); UserDetails userDetails (UserDetails) authentication.getPrincipal(); return ResponseEntity.ok() .header(HttpHeaders.AUTHORIZATION, JwtUtil.generateToken(userDetails)) .body(Map.of( username, userDetails.getUsername(), roles, userDetails.getAuthorities())); } }8.2 商品管理接口RestController RequestMapping(/api/products) public class ProductController { GetMapping public ResponseEntity? getAllProducts() { // 无需特殊权限 } PostMapping AdminOnly public ResponseEntity? createProduct(RequestBody ProductDTO dto) { // 需要管理员权限 } }9. 安全增强方案9.1 防止重放攻击实现Nonce校验机制public class NonceValidator { Autowired private RedisTemplateString, String redisTemplate; public boolean validateNonce(String nonce, long timestamp) { // 时间窗口检查允许±5分钟 if (Math.abs(System.currentTimeMillis() - timestamp) 300_000) { return false; } // Nonce唯一性检查 return redisTemplate.opsForValue() .setIfAbsent(nonce: nonce, 1, 10, TimeUnit.MINUTES); } }9.2 敏感操作二次验证关键操作添加OTP验证PostMapping(/transfer) public ResponseEntity? transferMoney( RequestBody TransferRequest request, RequestHeader(X-OTP) String otpCode) { if (!otpService.validateOtp( SecurityContextHolder.getContext().getAuthentication().getName(), otpCode)) { throw new InvalidOtpException(); } // 执行业务逻辑 }10. 性能对比测试数据在实际压力测试中单机4核8G配置传统Session5000并发时内存占用1.2GB平均响应时间78msJWT方案5000并发时内存占用680MB平均响应时间42ms关键差异点内存消耗减少约40%响应时间提升约45%水平扩展能力显著增强