问题描述:当使用Angular作为前端框架,Spring Boot作为后端框架时,无法从Spring Boot接收JWT令牌。
解决方法:
import { HttpClient, HttpHeaders } from '@angular/common/http';
@Injectable()
export class AuthService {
constructor(private http: HttpClient) {}
login(username: string, password: string) {
const headers = new HttpHeaders().set('Authorization', 'Bearer ' + token);
return this.http.post('/api/login', { username, password }, { headers });
}
}
在上述示例中,Authorization
请求头使用 Bearer
方案来传递JWT令牌。
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private JwtTokenProvider jwtTokenProvider;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.antMatchers("/api/login").permitAll()
.anyRequest().authenticated()
.and()
.apply(new JwtConfigurer(jwtTokenProvider));
}
}
@Component
public class JwtConfigurer extends SecurityConfigurerAdapter {
private JwtTokenProvider jwtTokenProvider;
public JwtConfigurer(JwtTokenProvider jwtTokenProvider) {
this.jwtTokenProvider = jwtTokenProvider;
}
@Override
public void configure(HttpSecurity http) throws Exception {
JwtTokenFilter customFilter = new JwtTokenFilter(jwtTokenProvider);
http.addFilterBefore(customFilter, UsernamePasswordAuthenticationFilter.class);
}
}
@Component
public class JwtTokenFilter extends OncePerRequestFilter {
private JwtTokenProvider jwtTokenProvider;
public JwtTokenFilter(JwtTokenProvider jwtTokenProvider) {
this.jwtTokenProvider = jwtTokenProvider;
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {
String token = jwtTokenProvider.resolveToken(request);
if (token != null && jwtTokenProvider.validateToken(token)) {
Authentication auth = jwtTokenProvider.getAuthentication(token);
SecurityContextHolder.getContext().setAuthentication(auth);
}
chain.doFilter(request, response);
}
}
@Component
public class JwtTokenProvider {
private static final String SECRET_KEY = "your_secret_key_here";
public String createToken(String username, List roles) {
// 生成JWT令牌的代码
}
public Authentication getAuthentication(String token) {
// 从JWT令牌中提取用户信息并创建认证对象的代码
}
public boolean validateToken(String token) {
// 验证JWT令牌的有效性的代码
}
public String resolveToken(HttpServletRequest request) {
// 从请求中解析JWT令牌的代码
}
}
上述示例中,JwtTokenProvider
类负责生成、验证和解析JWT令牌;JwtTokenFilter
类负责从请求中提取JWT令牌并进行验证;JwtConfigurer
类负责将JwtTokenFilter
添加到Spring Security的过滤器链中。
请根据自己的实际情况进行相应的调整和配置,确保配置正确。