TokenUtils.java 3.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. package org.jeecg.common.util;
  2. import lombok.extern.slf4j.Slf4j;
  3. import org.apache.commons.lang.StringUtils;
  4. import org.apache.shiro.authc.AuthenticationException;
  5. import org.jeecg.common.constant.CommonConstant;
  6. import org.jeecg.common.system.api.ISysBaseAPI;
  7. import org.jeecg.common.system.util.JwtUtil;
  8. import org.jeecg.common.system.vo.LoginUser;
  9. import javax.servlet.http.HttpServletRequest;
  10. /**
  11. * @Author scott
  12. * @Date 2019/9/23 14:12
  13. * @Description: 编程校验token有效性
  14. */
  15. @Slf4j
  16. public class TokenUtils {
  17. /**
  18. * 获取 request 里传递的 token
  19. *
  20. * @param request
  21. * @return
  22. */
  23. public static String getTokenByRequest(HttpServletRequest request) {
  24. String token = request.getParameter("token");
  25. if (token == null) {
  26. token = request.getHeader("X-Access-Token");
  27. }
  28. return token;
  29. }
  30. /**
  31. * 验证Token
  32. */
  33. public static boolean verifyToken(HttpServletRequest request, ISysBaseAPI sysBaseAPI, RedisUtil redisUtil) {
  34. log.info(" -- url --" + request.getRequestURL());
  35. String token = getTokenByRequest(request);
  36. if (StringUtils.isBlank(token)) {
  37. throw new AuthenticationException("token不能为空!");
  38. }
  39. // 解密获得username,用于和数据库进行对比
  40. String username = JwtUtil.getUsername(token);
  41. if (username == null) {
  42. throw new AuthenticationException("token非法无效!");
  43. }
  44. // 查询用户信息
  45. LoginUser user = sysBaseAPI.getUserByName(username);
  46. if (user == null) {
  47. throw new AuthenticationException("用户不存在!");
  48. }
  49. // 判断用户状态
  50. if (user.getStatus() != 1) {
  51. throw new AuthenticationException("账号已被锁定,请联系管理员!");
  52. }
  53. // 校验token是否超时失效 & 或者账号密码是否错误
  54. if (!jwtTokenRefresh(token, username, user.getPassword(), redisUtil)) {
  55. throw new AuthenticationException("Token失效,请重新登录!");
  56. }
  57. return true;
  58. }
  59. /**
  60. * 刷新token(保证用户在线操作不掉线)
  61. * @param token
  62. * @param userName
  63. * @param passWord
  64. * @param redisUtil
  65. * @return
  66. */
  67. private static boolean jwtTokenRefresh(String token, String userName, String passWord, RedisUtil redisUtil) {
  68. String cacheToken = String.valueOf(redisUtil.get(CommonConstant.PREFIX_USER_TOKEN + token));
  69. if (oConvertUtils.isNotEmpty(cacheToken)) {
  70. // 校验token有效性
  71. if (!JwtUtil.verify(cacheToken, userName, passWord)) {
  72. String newAuthorization = JwtUtil.sign(userName, passWord);
  73. // 设置Toekn缓存有效时间
  74. redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, newAuthorization);
  75. redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, JwtUtil.EXPIRE_TIME*2 / 1000);
  76. }
  77. //update-begin--Author:scott Date:20191005 for:解决每次请求,都重写redis中 token缓存问题
  78. // else {
  79. // redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, cacheToken);
  80. // // 设置超时时间
  81. // redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, JwtUtil.EXPIRE_TIME / 1000);
  82. // }
  83. //update-end--Author:scott Date:20191005 for:解决每次请求,都重写redis中 token缓存问题
  84. return true;
  85. }
  86. return false;
  87. }
  88. }