實(shí)現(xiàn)Spring Boot應(yīng)用中基于JWT的REST API安全機(jī)制，首先需理解用戶登錄后由服務(wù)器頒發(fā)JWT，客戶端在后續(xù)請求的Authorization頭中攜帶該令牌，服務(wù)器通過自定義過濾器驗(yàn)證令牌有效性；2. 在pom.xml中添加spring-boot-starter-security、spring-boot-starter-web及jjwt-api、jjwt-impl、jjwt-jackson依賴；3. 創(chuàng)建JwtUtil工具類，用于生成、解析和驗(yàn)證JWT，包含提取用戶名、過期時(shí)間、生成令牌及校驗(yàn)令牌是否有效的方法；4. 編寫JwtRequestFilter繼承OncePerRequestFilter，在請求中提取Bearer令牌，解析用戶名并加載用戶詳情，若令牌有效則設(shè)置Authentication到SecurityContext；5. 配置SecurityConfig類，禁用CSRF，設(shè)置/authenticate和/register路徑放行，其余請求需認(rèn)證，并配置無狀態(tài)會話管理，將JwtRequestFilter添加到過濾鏈中；6. 提供AuthController處理認(rèn)證請求，通過AuthenticationManager驗(yàn)證憑據(jù)，成功后生成JWT并返回AuthResponse；7. 實(shí)現(xiàn)UserDetailsService加載用戶信息用于認(rèn)證；8. 安全最佳實(shí)踐包括使用HTTPS、避免硬編碼密鑰、設(shè)置合理過期時(shí)間、不存儲敏感信息在payload中、驗(yàn)證簽發(fā)者和受眾、在分布式系統(tǒng)中使用JWKs；通過整合Spring Security與JWT，可實(shí)現(xiàn)無狀態(tài)、可擴(kuò)展的安全架構(gòu)，支持后續(xù)添加角色權(quán)限和刷新令牌機(jī)制。

Securing Java REST APIs is a critical requirement in modern web applications, especially when using stateless authentication mechanisms like JSON Web Tokens (JWT). Spring Security, combined with JWT, provides a robust and flexible way to protect your endpoints. Here's how to implement it effectively in a Spring Boot application.

1. Understanding the Architecture

Before diving into code, it’s important to understand the flow:

• The user sends login credentials (e.g., username and password).
• The server validates them and returns a JWT.
• The client includes this JWT in the Authorization header (as Bearer <token></token>) for subsequent requests.
• The server validates the token on each request using a filter before allowing access.

Spring Security handles authentication and authorization, while a custom filter intercepts requests to validate the JWT.

2. Add Required Dependencies

In your pom.xml, include:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
</dependencies>

3. Create JWT Utility Class

This class handles token generation, validation, and extraction.

@Component
public class JwtUtil {

    private final String SECRET_KEY = "yourSecretKeyThatIsLongEnoughForHS512"; // Use a strong key
    private final int EXPIRATION_TIME = 86400000; // 24 hours

    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

    public Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }

    public <T> T extractClaim(String token, Function<Claims, T> claimResolver) {
        final Claims claims = extractAllClaims(token);
        return claimResolver.apply(claims);
    }

    private Claims extractAllClaims(String token) {
        return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
    }

    private Boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    public String generateToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        return createToken(claims, userDetails.getUsername());
    }

    private String createToken(Map<String, Object> claims, String subject) {
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(subject)
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis()   EXPIRATION_TIME))
                .signWith(SignatureAlgorithm.HS512, SECRET_KEY)
                .compact();
    }

    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }
}

4. Custom JWT Authentication Filter

This filter runs before most Spring Security checks and validates the JWT from the Authorization header.

@Component
public class JwtRequestFilter extends OncePerRequestFilter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtUtil jwtUtil;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        final String authorizationHeader = request.getHeader("Authorization");

        String username = null;
        String jwt = null;

        if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
            jwt = authorizationHeader.substring(7);
            username = jwtUtil.extractUsername(jwt);
        }

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);

            if (jwtUtil.validateToken(jwt, userDetails)) {
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        chain.doFilter(request, response);
    }
}

5. Configure Spring Security

Override WebSecurityConfigurerAdapter (or use component-based config in newer versions).

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtRequestFilter jwtRequestFilter;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests()
                .antMatchers("/authenticate").permitAll()
                .antMatchers("/register").permitAll()
                .anyRequest().authenticated()
            .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
    }
}

Note: In Spring Boot 3 , use SecurityFilterChain bean instead of extending WebSecurityConfigurerAdapter.

6. Create Authentication Endpoint

@RestController
public class AuthController {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtUtil jwtUtil;

    @PostMapping("/authenticate")
    public ResponseEntity<?> createAuthenticationToken(@RequestBody AuthRequest authRequest) throws Exception {
        try {
            authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(authRequest.getUsername(), authRequest.getPassword())
            );
        } catch (BadCredentialsException e) {
            throw new Exception("Incorrect username or password", e);
        }

        final UserDetails userDetails = userDetailsService.loadUserByUsername(authRequest.getUsername());
        final String jwt = jwtUtil.generateToken(userDetails);

        return ResponseEntity.ok(new AuthResponse(jwt));
    }
}

With DTOs:

public class AuthRequest {
    private String username;
    private String password;
    // Getters and setters
}

public class AuthResponse {
    private String token;
    public AuthResponse(String token) { this.token = token; }
    // Getter
}

7. UserDetailsService Implementation

@Service
public class MyUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) {
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));

        return new org.springframework.security.core.userdetails.User(
                user.getUsername(), user.getPassword(), new ArrayList<>());
    }
}

8. Best Practices & Security Tips

• Use HTTPS in production — JWTs are sensitive.
• Keep the secret key secure — never hardcode in source; use environment variables or secret management tools.
• Set reasonable token expiration times — short-lived tokens with refresh tokens are better.
• Avoid storing sensitive data in JWT payload — it's Base64-encoded, not encrypted.
• Validate issuer and audience claims in production-grade apps.
• Consider using JWKs (JSON Web Key Sets) for distributed systems.

Summary

By combining Spring Security and JWT, you get a clean, stateless way to secure REST APIs. The key components are:

• A JWT utility for token creation/validation
• A filter to intercept and authenticate requests
• Proper Spring Security configuration
• A login endpoint to issue tokens

This setup is widely used, scalable, and integrates well with frontend frameworks and mobile apps.

Basically, once the foundation is in place, extending roles, permissions, or adding refresh tokens becomes manageable.

以上是使用Spring Security和JWT確保Java Rest API的詳細(xì)內(nèi)容。更多信息請關(guān)注PHP中文網(wǎng)其他相關(guān)文章！