{
	"alg" : "HS256",
	"type" : "JWT"
}

{
	"sub" : "123",
	"name" : "John Do",
	"admin" : true
}

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret);

<!--引入JWT-->
<dependency>
    <groupId>com.auth0</groupId>
    <artifactId>java-jwt</artifactId>
    <version>3.10.0</version>
</dependency>

HashMap<String,Object> map = new HashMap<>();
        Calendar instance = Calendar.getInstance();
        instance.add(Calendar.SECOND,20);
        String token = JWT.create()
                .withHeader(map) //可以不設(shè)定，就是使用默認的
                .withClaim("userId",20)//payload  //自定義用戶名
                .withClaim("username","zhangsan")
                .withExpiresAt(instance.getTime()) //指定令牌過期時間
                .sign(Algorithm.HMAC256("fdahuifeuw78921"));//簽名

JWTVerifier jwtVerifier = JWT.require(Algorithm.HMAC256("fdahuif921")).build();
        DecodedJWT decodedJWT = jwtVerifier.verify(token);
        decodedJWT.getClaim("userId").asInt();//獲取負載里面對應(yīng)的內(nèi)容
        decodedJWT.getClaim("username").asString();
        decodedJWT.getExpiresAt();//獲取過期時間

SignatureVerificationException //簽名不一致異常
TokenExpiredException //令牌過期異常
AlgorithmMismatchException //算法不匹配異常
InvalidClaimException //失效的payload異常（傳給客戶端后，token被改動，驗證不一致）

public class JWTUtils {
    private static String SIGNATURE = "token!@#$%^7890";
    /**
     * 生成token
     * @param map //傳入payload
     * @return 返回token
     */
    public static String getToken(Map<String,String> map){
        JWTCreator.Builder builder = JWT.create();
        map.forEach((k,v)->{
            builder.withClaim(k,v);
        });
        Calendar instance = Calendar.getInstance();
        instance.add(Calendar.SECOND,7);
        builder.withExpiresAt(instance.getTime());
        return builder.sign(Algorithm.HMAC256(SIGNATURE)).toString();
    }
    /**
     * 驗證token
     * @param token
     */
    public static void verify(String token){
        JWT.require(Algorithm.HMAC256(SIGNATURE)).build().verify(token);
    }
    /**
     * 獲取token中payload
     * @param token
     * @return
     */
    public static DecodedJWT getToken(String token){
        return JWT.require(Algorithm.HMAC256(SIGNATURE)).build().verify(token);
    }
}

//controller層接收數(shù)據(jù)，生成token，并響應(yīng)
Map<String,Object> map = new HashMap<>();
try{
    User userDB = userService.login(user);
    Map<String,String> payload = new HashMap<>();
    payload.put("id",userDB.getId());
    payload.put("name",userDB.getName());
    //生成JWT令牌
    String token = JWTUtils.getToken(payload);
    map.put("state",true);
    map.put("msg","認證成功");
    map.put("token",token);//響應(yīng)token
} catch (Exception e) {
    map.put("state","false");
    map.put("msg",e.getMessage());
}

package com.liup.interceptor;
import com.auth0.jwt.exceptions.AlgorithmMismatchException;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.exceptions.TokenExpiredException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.office.utils.JWTUtils;
import org.springframework.web.servlet.HandlerInterceptor;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashMap;
import java.util.Map;
/**
 * JWT驗證攔截器
 */
public class JWTInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        Map<String,Object> map = new HashMap<>();
        //令牌建議是放在請求頭中，獲取請求頭中令牌
        String token = request.getHeader("token");
        try{
            JWTUtils.verify(token);//驗證令牌
            return true;//放行請求
        } catch (SignatureVerificationException e) {
            e.printStackTrace();
            map.put("msg","無效簽名");
        } catch (TokenExpiredException e) {
            e.printStackTrace();
            map.put("msg","token過期");
        } catch (AlgorithmMismatchException e) {
            e.printStackTrace();
            map.put("msg","token算法不一致");
        } catch (Exception e) {
            e.printStackTrace();
            map.put("msg","token失效");
        }
        map.put("state",false);//設(shè)置狀態(tài)
        //將map轉(zhuǎn)化成json，response使用的是Jackson
        String json = new ObjectMapper().writeValueAsString(map);
        response.setContentType("application/json;charset=UTF-8");
        response.getWriter().print(json);
        return false;
    }
}

package com.liup.config;
import com.office.interceptor.JWTInterceptor;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class InterceptorConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new JWTInterceptor())
                .addPathPatterns("/**")
                .excludePathPatterns("/user/**");
    }
}