SpringCloud Gateway 权限认证的实现

目录

• 一、添加依赖
• 二、配置 Spring Security
• 三、实现 JWT 工具类
• 四、实现 JWT 认证管理器
• 五、实现 Bearer Token 转换器
• 六、配置 Gateway 路由
• 七、总结

在微服务架构中，Spring Cloud Gateway 作为网关层，承担着请求转发、权限校验等重要职责。通过集成 Spring Security 和 JWT（jsON Web Token），可以在网关层实现集中式的权限认证，确保系统的安全性和数据保护。以下是详细的实现步骤：

一、添加依js赖

在 Spring Bwww.devze.comoot 项目中，添加 Spring Cloud Gateway、Spring Security 和 JWT 相关依赖。以下是 pom.XML 的配置示例：

<dependencies>
    <!-- Spring Cloud Gateway -->
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-gateway</artifactId>
    </dependency>

    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>

    <!-- JWT Support -->
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
</dependencies>

二、配置 Spring Security

在 Spring Cloud Gateway 中，使用 Spring Security 的 WebFlux 模块来实现权限校验。以下是一个典型的配置类：

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http, JwtAuthenticationManager jwtAuthenticationManager) {
        http
            .csrf().disable() // 禁用 CSRF 保护
            .authorizeExchange(exchanges -> exchanges
                .pathMatchers("/login", "/register").permitAll() // 公开登录和注册接口
                .anyExchange().authenticated()) // 其他请求需要认证
            .addFilterAt(jwtAuthenticationFilter(jwtAuthenticationManager), SecurityWebFilterChain.class);

        return http.build();
    }

    private AuthenticationWebFilter jwtAuthenticationFilter(JwtAuthenticationManager jwtAuthenticationManager) {
        AuthenticationWebFilter filter = new AuthenticationWebFilter(jwtAuthenticationManager);
        filter.setServerAuthenticationConverter(new BearerTokenServerAuthenticationConverter());
        return filter;
    }
}

三、实现 JWT 工具类

JWT 工具类用于生成和解析 JWT 令牌。以下是工具类的实现：

@Component
public class JwtUtil {
    private String secret = "yourSecretKey"; // 密钥应存储在安全的地方，避免硬编码

    public Mono<String> extractUsername(String token) {
        return Mono.just(extractClaim(token, Claims::getSubject));
    }

    public Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }

    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }

    private Claims extractAllClaims(String token) {
        return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
    }

    public Mono<String> generateToken(UserDetails userDetails) {
        Map<String, Object> claims = new HashMap<>();
        return Mono.just(createToken(claims, userDetails.getUsername()));
    }

    private String createToken(Map<String, Object> claims, String subject) {
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(subject)
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10)) // 10小时过期
                .signWith(SignatureAlgorithm.HS256, secret)
                .compact();
    }

    public Mono<Boolean> validateToken(String token, UserDetails userDetails) {
        final String username = exandroidtractUsername(token).block();
        return Mono.just(username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }

    private Boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }
}

四、实现 JWT 认证管理器

JWT 认证管理器用于处理 JWT 的验证逻辑：

@Component
public class JwtAuthenticationManager implements ReactiveAuthenticationManager {
    private final JwtUtil jwtUtil;
    private final UserDetailsService userDetailsService;

    public JwtAuthenticationManager(JwtUtil jwtUtil, UserDetailsService userDetailsService) {
        this.jwtUtil = jwtUtil;
        this.userDetailsService = userDetailsService;
    }

    @Override
    public Mono<Authentication> authenticate(Authentication authentication) {
        String token = (String) authentica编程tion.getCredentials();
        return jwtUtil.extractUsername(token)
                .flatMap(username -> {
                    if (jwtUtil.validateToken(token, userDetailsService.loadUserByUsername(username)).block()) {
                        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
                        return Mono.just(new Usernhttp://www.devze.comamePasswordAuthenticationToken(userDetails, token, userDetails.getAuthorities()));
                    } else {
                        return Mono.empty();
                    }
                });
    }
}

五、实现 Bearer Token 转换器

Bearer Token 转换器用于从请求头中提取 JWT 令牌：

public class BearerTokenServerAuthenticationConverter implements ServerAuthenticationConverter {
    @Override
    public Mono<Authentication> convert(ServerWebExchange exchange) {
        String authHeader = exchange.getRequest().getHeaders().getFirst("Authorization");
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            String token = authHeader.substring(7);
            return Mono.just(new BearerTokenAuthentication(token));
        }
        return Mono.empty();
    }
}

六、配置 Gateway 路由

在 application.yml 文件中配置路由规则：

spring:
  cloud:
    gateway:
      routes:
        - id: user-service
          uri: lb://USER-SERVICE
          predicates:
            - Path=/users/**
          filters:
            - JwtAuthenticationFilter

七、总结

到此这篇关于SpringCloud Gateway 权限认证的实现的文章就介绍到这了,更多相关SpringCloud Gateway 权限认证内容请搜索编程客栈(www.devze.com)以前的文章或继续浏览下面的相关文章希望大家以后多多支持编程客栈(www.devze.com)！