如果你还在为 JWT 单令牌的安全性和用户体验问题头疼那么双令牌认证方案可能是你需要的答案。传统的单 token 方案要么设置较长的过期时间导致安全风险要么频繁要求用户重新登录影响体验。而双令牌机制通过 access_token 和 refresh_token 的分离在安全性和流畅度之间找到了最佳平衡点。但仅仅实现双令牌还不够真正的企业级方案必须解决两个关键问题如何实现无感知的 token 刷新以及如何确保登出后 token 立即失效。这需要 Redis 黑名单机制的配合形成完整的认证闭环。本文将深入解析大厂标配的 JWT 双令牌认证方案从核心原理到完整实现带你掌握这一在现代 Web 应用中至关重要的安全架构。1. 双令牌认证要解决的真实问题在深入技术细节之前我们先明确为什么要放弃简单的单 token 方案。假设你开发了一个电商应用用户登录后获得一个 JWT token。这时候面临两个选择如果设置 token 过期时间为 24 小时用户体验很好但安全风险巨大。一旦 token 被盗攻击者可以在整整一天内冒充用户进行任何操作。如果设置过期时间为 15 分钟安全性提高了但用户每隔 15 分钟就要重新登录一次这种体验在移动端尤其令人沮丧。双令牌机制的核心思路是用短期的 access_token 保障安全性用长期的 refresh_token 维持登录状态。access_token 负责日常的 API 调用有效期通常为 15-30 分钟refresh_token 专门用于获取新的 access_token有效期可达 7-30 天。但这里有一个关键陷阱单纯的令牌刷新无法解决 token 被盗后的安全问题。如果攻击者获取了有效的 refresh_token他们可以无限期地获取新的 access_token。这就是为什么必须引入黑名单机制——在用户主动登出或检测到异常行为时立即将相关令牌加入黑名单使其失效。2. JWT 与双令牌基础概念2.1 JWT 结构解析JWTJSON Web Token由三部分组成通过点号分隔Header包含令牌类型和签名算法Payload包含声明用户信息、过期时间等Signature用于验证令牌完整性的签名一个典型的 JWT 看起来像这样eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c2.2 双令牌分工明确在双令牌方案中两种令牌有明确的职责划分access_token有效期短15-30分钟携带用户身份信息每次API请求都需要携带过期后需要刷新refresh_token有效期长7-30天不携带用户敏感信息仅用于获取新的access_token需要安全存储HttpOnly Cookie2.3 黑名单机制的必要性由于 JWT 本身是无状态的服务端无法直接让单个令牌失效。黑名单机制通过 Redis 等内存数据库记录已失效但尚未过期的令牌在每次认证时进行检查场景无黑名单有黑名单用户主动登出令牌继续有效直到过期立即加入黑名单下次验证失败检测到异常登录无法立即终止会话立即加入黑名单阻断攻击令牌被盗用攻击者可用到过期加入黑名单后攻击失效3. 环境准备与依赖配置3.1 技术栈选择本文以 Spring Boot 为例但核心原理适用于任何技术栈Spring Boot 3.x现代Java开发框架JJWTJWT创建和验证库Redis黑名单存储Spring Security认证授权框架3.2 Maven 依赖配置!-- pom.xml -- dependencies dependency groupIdorg.springframework.boot/groupId artifactIdspring-boot-starter-web/artifactId /dependency dependency groupIdorg.springframework.boot/groupId artifactIdspring-boot-starter-security/artifactId /dependency dependency groupIdorg.springframework.boot/groupId artifactIdspring-boot-starter-data-redis/artifactId /dependency dependency groupIdio.jsonwebtoken/groupId artifactIdjjwt-api/artifactId version0.11.5/version /dependency dependency groupIdio.jsonwebtoken/groupId artifactIdjjwt-impl/artifactId version0.11.5/version scoperuntime/scope /dependency dependency groupIdio.jsonwebtoken/groupId artifactIdjjwt-jackson/artifactId version0.11.5/version scoperuntime/scope /dependency /dependencies3.3 Redis 配置# application.yml spring: redis: host: localhost port: 6379 password: database: 0 timeout: 2000ms lettuce: pool: max-active: 8 max-wait: -1ms max-idle: 8 min-idle: 0 jwt: secret: your-256-bit-secret-key-here-must-be-long-enough access-token-expire: 1800000 # 30分钟 refresh-token-expire: 2592000000 # 30天4. JWT 工具类完整实现4.1 令牌生成与解析// src/main/java/com/example/auth/util/JwtUtil.java Component public class JwtUtil { Value(${jwt.secret}) private String secretKey; Value(${jwt.access-token-expire}) private long accessTokenExpire; Value(${jwt.refresh-token-expire}) private long refreshTokenExpire; // 生成access_token public String generateAccessToken(String username) { return Jwts.builder() .setSubject(username) .setIssuedAt(new Date()) .setExpiration(new Date(System.currentTimeMillis() accessTokenExpire)) .signWith(SignatureAlgorithm.HS256, secretKey) .compact(); } // 生成refresh_token public String generateRefreshToken(String username) { return Jwts.builder() .setSubject(username) .setIssuedAt(new Date()) .setExpiration(new Date(System.currentTimeMillis() refreshTokenExpire)) .signWith(SignatureAlgorithm.HS256, secretKey) .compact(); } // 解析用户名 public String extractUsername(String token) { return Jwts.parserBuilder() .setSigningKey(secretKey) .build() .parseClaimsJws(token) .getBody() .getSubject(); } // 验证令牌是否过期 public boolean isTokenExpired(String token) { return extractExpiration(token).before(new Date()); } private Date extractExpiration(String token) { return Jwts.parserBuilder() .setSigningKey(secretKey) .build() .parseClaimsJws(token) .getBody() .getExpiration(); } // 验证令牌有效性 public boolean validateToken(String token) { try { Jwts.parserBuilder().setSigningKey(secretKey).build().parseClaimsJws(token); return true; } catch (Exception e) { return false; } } }4.2 Redis 黑名单管理// src/main/java/com/example/auth/service/TokenBlacklistService.java Service public class TokenBlacklistService { Autowired private RedisTemplateString, String redisTemplate; private static final String BLACKLIST_KEY jwt:blacklist:; // 将令牌加入黑名单 public void addToBlacklist(String token, long expirationTime) { String key BLACKLIST_KEY token; // 计算剩余过期时间秒 long ttl (expirationTime - System.currentTimeMillis()) / 1000; if (ttl 0) { redisTemplate.opsForValue().set(key, blacklisted, ttl, TimeUnit.SECONDS); } } // 检查令牌是否在黑名单中 public boolean isBlacklisted(String token) { String key BLACKLIST_KEY token; return Boolean.TRUE.equals(redisTemplate.hasKey(key)); } // 用户登出时将该用户的所有令牌加入黑名单 public void logoutUser(String username) { // 实际项目中可能需要更复杂的逻辑来追踪用户的所有活跃令牌 String pattern BLACKLIST_KEY *; // 这里简化处理实际需要根据业务需求实现 } }5. 认证流程完整实现5.1 登录接口实现// src/main/java/com/example/auth/controller/AuthController.java RestController RequestMapping(/api/auth) public class AuthController { Autowired private JwtUtil jwtUtil; Autowired private TokenBlacklistService blacklistService; PostMapping(/login) public ResponseEntity? login(RequestBody LoginRequest request) { // 1. 验证用户名密码这里简化实际需要数据库验证 if (!authenticateUser(request.getUsername(), request.getPassword())) { return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build(); } // 2. 生成双令牌 String accessToken jwtUtil.generateAccessToken(request.getUsername()); String refreshToken jwtUtil.generateRefreshToken(request.getUsername()); // 3. 构建响应 AuthResponse response new AuthResponse(accessToken, refreshToken, Bearer, jwtUtil.getAccessTokenExpire() / 1000); return ResponseEntity.ok(response); } PostMapping(/refresh) public ResponseEntity? refreshToken(RequestBody RefreshTokenRequest request) { try { String refreshToken request.getRefreshToken(); // 1. 验证refresh_token有效性 if (!jwtUtil.validateToken(refreshToken) || blacklistService.isBlacklisted(refreshToken)) { return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build(); } // 2. 提取用户名并生成新的access_token String username jwtUtil.extractUsername(refreshToken); String newAccessToken jwtUtil.generateAccessToken(username); // 3. 将旧的refresh_token加入黑名单可选增强安全性 blacklistService.addToBlacklist(refreshToken, jwtUtil.extractExpiration(refreshToken).getTime()); // 4. 生成新的refresh_token String newRefreshToken jwtUtil.generateRefreshToken(username); AuthResponse response new AuthResponse(newAccessToken, newRefreshToken, Bearer, jwtUtil.getAccessTokenExpire() / 1000); return ResponseEntity.ok(response); } catch (Exception e) { return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build(); } } PostMapping(/logout) public ResponseEntity? logout(RequestHeader(Authorization) String authHeader) { String token authHeader.substring(7); // 去掉Bearer 前缀 // 将access_token加入黑名单 if (jwtUtil.validateToken(token)) { blacklistService.addToBlacklist(token, jwtUtil.extractExpiration(token).getTime()); } return ResponseEntity.ok().build(); } private boolean authenticateUser(String username, String password) { // 实际项目中这里应该查询数据库验证用户凭证 return admin.equals(username) password.equals(password); } }5.2 Spring Security 配置// src/main/java/com/example/auth/config/SecurityConfig.java Configuration EnableWebSecurity public class SecurityConfig { Autowired private JwtUtil jwtUtil; Autowired private TokenBlacklistService blacklistService; Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.csrf().disable() .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeHttpRequests(authz - authz .requestMatchers(/api/auth/login, /api/auth/refresh).permitAll() .anyRequest().authenticated() ) .addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class); return http.build(); } Bean public JwtAuthenticationFilter jwtAuthenticationFilter() { return new JwtAuthenticationFilter(jwtUtil, blacklistService); } } // JWT认证过滤器 class JwtAuthenticationFilter extends OncePerRequestFilter { private final JwtUtil jwtUtil; private final TokenBlacklistService blacklistService; public JwtAuthenticationFilter(JwtUtil jwtUtil, TokenBlacklistService blacklistService) { this.jwtUtil jwtUtil; this.blacklistService blacklistService; } Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String authHeader request.getHeader(Authorization); if (authHeader null || !authHeader.startsWith(Bearer )) { filterChain.doFilter(request, response); return; } String token authHeader.substring(7); try { if (jwtUtil.validateToken(token) !blacklistService.isBlacklisted(token)) { String username jwtUtil.extractUsername(token); UsernamePasswordAuthenticationToken authentication new UsernamePasswordAuthenticationToken(username, null, new ArrayList()); authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); SecurityContextHolder.getContext().setAuthentication(authentication); } } catch (Exception e) { // 令牌无效继续过滤链但不设置认证上下文 } filterChain.doFilter(request, response); } }6. 前端无感刷新实现6.1 Axios 拦截器配置// src/utils/auth.js import axios from axios; class AuthService { constructor() { this.isRefreshing false; this.failedQueue []; this.setupInterceptors(); } setupInterceptors() { // 请求拦截器自动添加token axios.interceptors.request.use( (config) { const token localStorage.getItem(access_token); if (token) { config.headers.Authorization Bearer ${token}; } return config; }, (error) Promise.reject(error) ); // 响应拦截器处理token过期 axios.interceptors.response.use( (response) response, async (error) { const originalRequest error.config; if (error.response?.status 401 !originalRequest._retry) { if (this.isRefreshing) { // 如果正在刷新将请求加入队列 return new Promise((resolve, reject) { this.failedQueue.push({ resolve, reject }); }).then(token { originalRequest.headers.Authorization Bearer ${token}; return axios(originalRequest); }).catch(err Promise.reject(err)); } originalRequest._retry true; this.isRefreshing true; try { const refreshToken localStorage.getItem(refresh_token); const response await axios.post(/api/auth/refresh, { refreshToken: refreshToken }); const { access_token, refresh_token } response.data; localStorage.setItem(access_token, access_token); localStorage.setItem(refresh_token, refresh_token); this.isRefreshing false; this.processQueue(null, access_token); // 重试原始请求 originalRequest.headers.Authorization Bearer ${access_token}; return axios(originalRequest); } catch (refreshError) { this.isRefreshing false; this.processQueue(refreshError, null); this.logout(); return Promise.reject(refreshError); } } return Promise.reject(error); } ); } processQueue(error, token null) { this.failedQueue.forEach(promise { if (error) { promise.reject(error); } else { promise.resolve(token); } }); this.failedQueue []; } logout() { localStorage.removeItem(access_token); localStorage.removeItem(refresh_token); window.location.href /login; } } export default new AuthService();7. 完整时序流程与测试验证7.1 双令牌认证时序图虽然不能使用 Mermaid但我们可以用文字描述关键流程登录阶段用户提交凭证 → 服务端验证通过生成 access_token30分钟和 refresh_token30天返回双令牌给客户端API 调用阶段客户端携带 access_token 调用 API服务端验证 token 有效性和黑名单状态返回业务数据令牌刷新阶段access_token 过期API 返回 401客户端自动使用 refresh_token 申请新令牌服务端验证 refresh_token生成新双令牌客户端更新令牌重试原始请求登出阶段客户端调用登出接口服务端将 access_token 加入黑名单后续使用该 token 的请求都被拒绝7.2 测试用例// src/test/java/com/example/auth/AuthIntegrationTest.java SpringBootTest AutoConfigureTestDatabase class AuthIntegrationTest { Autowired private TestRestTemplate restTemplate; Test void testCompleteAuthFlow() { // 1. 登录获取令牌 LoginRequest loginRequest new LoginRequest(admin, password); ResponseEntityAuthResponse loginResponse restTemplate.postForEntity( /api/auth/login, loginRequest, AuthResponse.class); assertThat(loginResponse.getStatusCode()).isEqualTo(HttpStatus.OK); AuthResponse authResponse loginResponse.getBody(); // 2. 使用access_token访问受保护接口 HttpHeaders headers new HttpHeaders(); headers.setBearerAuth(authResponse.getAccessToken()); HttpEntityString entity new HttpEntity(headers); ResponseEntityString protectedResponse restTemplate.exchange( /api/protected, HttpMethod.GET, entity, String.class); assertThat(protectedResponse.getStatusCode()).isEqualTo(HttpStatus.OK); // 3. 刷新令牌 RefreshTokenRequest refreshRequest new RefreshTokenRequest(authResponse.getRefreshToken()); ResponseEntityAuthResponse refreshResponse restTemplate.postForEntity( /api/auth/refresh, refreshRequest, AuthResponse.class); assertThat(refreshResponse.getStatusCode()).isEqualTo(HttpStatus.OK); // 4. 登出测试 HttpEntityString logoutEntity new HttpEntity(headers); ResponseEntityVoid logoutResponse restTemplate.exchange( /api/auth/logout, HttpMethod.POST, logoutEntity, Void.class); assertThat(logoutResponse.getStatusCode()).isEqualTo(HttpStatus.OK); // 5. 验证登出后令牌失效 ResponseEntityString afterLogoutResponse restTemplate.exchange( /api/protected, HttpMethod.GET, entity, String.class); assertThat(afterLogoutResponse.getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED); } }8. 常见问题与解决方案8.1 令牌管理问题排查问题现象可能原因解决方案刷新令牌返回401refresh_token过期或无效要求用户重新登录访问接口返回401但令牌未过期令牌被加入黑名单检查是否有登出操作或安全策略触发刷新循环不断要求刷新客户端逻辑错误检查拦截器实现避免无限重试Redis连接失败网络或配置问题检查Redis服务状态和连接配置8.2 安全性强化措施1. 令牌绑定策略// 生成令牌时加入设备指纹或IP地址 public String generateAccessToken(String username, String deviceFingerprint) { return Jwts.builder() .setSubject(username) .claim(device, deviceFingerprint) // 设备指纹 .setIssuedAt(new Date()) .setExpiration(new Date(System.currentTimeMillis() accessTokenExpire)) .signWith(SignatureAlgorithm.HS256, secretKey) .compact(); } // 验证时检查设备一致性 public boolean validateTokenWithDevice(String token, String currentDevice) { String tokenDevice extractDevice(token); return validateToken(token) currentDevice.equals(tokenDevice); }2. 刷新令牌使用次数限制// 在Redis中记录refresh_token使用次数 public boolean canRefreshTokenBeUsed(String refreshToken) { String key refresh_token_usage: refreshToken; Long usageCount redisTemplate.opsForValue().increment(key); redisTemplate.expire(key, 30, TimeDayUnit.DAYS); // 30天内有效 return usageCount 100; // 限制最大使用次数 }9. 生产环境最佳实践9.1 密钥管理安全绝对不要在代码中硬编码密钥# 使用环境变量或配置中心 jwt: secret: ${JWT_SECRET:default-fallback-secret}9.2 Redis 高可用配置spring: redis: cluster: nodes: - redis-node1:6379 - redis-node2:6379 - redis-node3:6379 password: ${REDIS_PASSWORD} timeout: 3000ms lettuce: pool: max-active: 20 max-idle: 10 min-idle: 59.3 监控与告警// 添加令牌使用监控 Component public class TokenUsageMonitor { Autowired private MeterRegistry meterRegistry; private final Counter tokenRefreshCounter; private final Counter blacklistAddCounter; public TokenUsageMonitor(MeterRegistry meterRegistry) { this.meterRegistry meterRegistry; this.tokenRefreshCounter Counter.builder(jwt.token.refresh) .description(Number of token refresh operations) .register(meterRegistry); this.blacklistAddCounter Counter.builder(jwt.blacklist.add) .description(Number of tokens added to blacklist) .register(meterRegistry); } public void recordTokenRefresh() { tokenRefreshCounter.increment(); } public void recordBlacklistAdd() { blacklistAddCounter.increment(); } }9.4 性能优化建议Redis 缓存优化对黑名单查询使用 Pipeline 减少网络开销令牌压缩对于包含大量信息的令牌考虑使用压缩算法分布式会话在网关层统一处理认证避免每个服务重复验证10. 总结与进阶方向双令牌认证 Redis 黑名单的组合确实解决了 JWT 在安全性和用户体验方面的核心矛盾。但要注意这只是一个基础方案在实际生产环境中还需要根据具体业务需求进行扩展。对于高安全要求的场景可以考虑以下进阶方案动态令牌过期策略根据用户行为风险动态调整令牌过期时间多因素认证集成在令牌刷新时要求二次验证令牌撤销列表除了黑名单维护全局的令牌撤销列表零信任架构每次请求都进行完整的身份验证和授权检查实现一个健壮的认证系统需要综合考虑安全、性能、用户体验多个维度。本文提供的方案可以作为一个可靠的起点但真正的挑战在于根据实际业务场景进行恰当的调整和优化。建议在实际项目中先从基础版本开始逐步添加高级特性同时建立完善的监控和告警机制确保认证系统的稳定性和安全性。