JWT is an open standard for safe transmission of information. In Java, authentication and authorization can be achieved through the JJWT library. 1. Add JJWT API, Impl and Jackson dependencies; 2. Create JwtUtil tool class to generate, parse and verify the token; 3. Write JwtFilter to intercept requests and verify the Bearer Token in the Authorization header; 4. Register Filter in Spring Boot to protect the specified path; 5. Provide a login interface to return JWT after verifying the user; 6. The protected interface obtains the user's identity and role for access control by parsing the token, and ultimately realizes a stateless and extensible security mechanism, which is suitable for distributed system applications. Pay attention to security suggestions such as key security, token expiration and HTTPS transmission.

In modern web application development, using Java to implement user authentication (authentication) and authorization is a common requirement. JWT (JSON Web Token) has become one of the mainstream solutions for implementing security authentication due to its stateless, scalable and cross-domain support. The following describes how to use JWT to complete authentication and authorization in Java applications.

What is JWT?

JWT is an open standard (RFC 7519) that is used to securely transmit information as a JSON object between parties. It is commonly used for authentication and information exchange. A JWT consists of three parts:

• Header : Contains token type and signature algorithm (such as HMAC SHA256)
• Payload : contains claims, such as user ID, role, expiration time, etc.
• Signature : Signature the first two parts to ensure that the data has not been tampered with

The format is: xxxxx.yyyyy.zzzzz

Basic Process

1. User login, submit username and password
2. Server verification credentials, generate JWT and return to client
3. The client carries the JWT in subsequent requests (usually in the Authorization header)
4. The server verifies the validity of the JWT and decides whether to authorize access to the resource based on the statements therein.

Use Java JWT to implement authentication and authorization

1. Add dependencies (taking Maven as an example)

Use the JJWT library to handle JWT:

 <dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

Note: JJWT 0.11 supports modularity, requiring the introduction of API, Impl and Jackson support.

2. Create JWT tool class

 import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;

import javax.crypto.SecretKey;
import java.util.Date;

public class JwtUtil {
    private static final SecretKey SECRET_KEY = Keys.secretKeyFor(SignatureAlgorithm.HS256);
    private static final long EXPIRATION_TIME = 86400000; // 24 hours

    // Generate JWT
    public static String generateToken(String username, String role) {
        return Jwts.builder()
                .setSubject(username)
                .claim("role", role)
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() EXPIRATION_TIME))
                .signWith(SECRET_KEY)
                .compact();
    }

    // parse and verify JWT
    public static claims parseToken(String token) {
        try {
            return Jwts.parserBuilder()
                    .setSigningKey(SECRET_KEY)
                    .build()
                    .parseClaimsJws(token)
                    .getBody();
        } catch (ExpiredJwtException e) {
            System.out.println("Token expired");
            return null;
        } catch (MalformedJwtException | SignatureException e) {
            System.out.println("Invalid Token");
            return null;
        }
    }

    // Get username public static String getUsernameFromToken(String token) {
        Claims claims = parseToken(token);
        return claims != null ? claims.getSubject() : null;
    }

    // Get the role public static String getRoleFromToken(String token) {
        Claims claims = parseToken(token);
        return (String) claims.get("role");
    }

    // Verify whether Token is valid public static boolean isTokenValid(String token, String username) {
        String tokenUsername = getUsernameFromToken(token);
        return (tokenUsername != null && tokenUsername.equals(username) && parseToken(token) != null);
    }
}

3. Intercept requests: Implement filters (Filters)

Create a JwtFilter to intercept requests and verify JWT.

 import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class JwtFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        String token = httpRequest.getHeader("Authorization");

        if (token != null && token.startsWith("Bearer ")) {
            token = token.substring(7); // Remove "Bearer"
            String username = JwtUtil.getUsernameFromToken(token);

            if (username != null && JwtUtil.isTokenValid(token, username)) {
                // User information can be stored in the request attribute or Security Context
                httpRequest.setAttribute("currentUser", username);
                httpRequest.setAttribute("role", JwtUtil.getRoleFromToken(token));
                chain.doFilter(request, response);
            } else {
                httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                httpResponse.getWriter().write("Invalid or expired Token");
            }
        } else {
            httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            httpResponse.getWriter().write("Missing Token");
        }
    }
}

4. Configure Filter (taking Spring Boot as an example)

If you are using Spring Boot, you can register Filter in the configuration class:

 @Bean
public FilterRegistrationBean<JwtFilter> jwtFilter() {
    FilterRegistrationBean<JwtFilter> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new JwtFilter());
    registrationBean.addUrlPatterns("/api/secure/*"); // protected path return registrationBean;
}

5. Login interface example

 @PostMapping("/login")
public ResponseEntity<?> login(@RequestBody UserLoginRequest request) {
    // Simplified: In fact, the database password should be checked for encryption verification if ("admin".equals(request.getUsername()) && "password".equals(request.getPassword())) {
        String token = JwtUtil.generateToken(request.getUsername(), "ADMIN");
        return ResponseEntity.ok().body(Map.of("token", token));
    }
    return ResponseEntity.status(401).body("Under username or password");
}

6. Protected interface example

 @GetMapping("/secure/data")
public ResponseEntity<?> getSecureData(HttpServletRequest request) {
    String user = (String) request.getAttribute("currentUser");
    String role = (String) request.getAttribute("role");

    if ("ADMIN".equals(role)) {
        return ResponseEntity.ok("Hello " user ", you have admin access!");
    } else {
        return ResponseEntity.status(403).body("Insufficient permission");
    }
}

Safety advice

• Key management : Do not hardcode keys in code, use environment variables or configuration centers
• Token expiration time : Set the expiration time reasonably. It is recommended to use short-term tokens when sensitive operations.
• Refresh token : can improve user experience with the refresh token mechanism
• HTTPS : Ensure the transport layer security and prevent the token from being stolen
• Avoid sensitive information : Do not store sensitive data such as passwords in JWT payload

Summarize

Using JWT to implement authentication and authorization in Java is not complicated, the core is:

• Generate token after login successfully
• Client carries Token request
• The server verifies the token through Filter and extracts user information
• Implement authorization control according to role

This mechanism is suitable for distributed and microservice architectures, avoiding the overhead of server storage sessions.

Basically all this is it, not complicated but it is easy to ignore details, such as exception handling and key security.

The above is the detailed content of Java Authentication and Authorization with JWT. For more information, please follow other related articles on the PHP Chinese website!