如何从 JWT 令牌身份验证中获取声明值

Question

我已经在令牌提供者的 JWT 令牌中设置了声明。现在我想在 API 被命中时通过身份验证获得声明价值。我已经检查了委托人、详细信息、凭证、权限，但我没有收到任何索赔。Claims claims = Jwts.claims().setSubject(authentication.getName());    claims.put(AUTHORITIES_KEY, authorities);    claims.put("userId", userRepo.findUserIdByUsername(authentication.getName()));   return Jwts.builder()            .setSubject(authentication.getName())            .setClaims(claims)            //.claim(AUTHORITIES_KEY, authorities)            .signWith(SignatureAlgorithm.HS512, SIGNING_KEY)            .setIssuedAt(new Date(System.currentTimeMillis()))            .setExpiration(new Date(System.currentTimeMillis() + ACCESS_TOKEN_VALIDITY_SECONDS*1000))            .compact();我想从身份验证中获取“userId”声明或从令牌中获取声明值的任何其他方式。

Answer 1

这就是我从令牌中读取声明的方式

private Claims getAllClaimsFromToken(String token) {

        Claims claims;

        try {

            claims = Jwts.parser()

                    .setSigningKey(SECRET)

                    .parseClaimsJws(token)

                    .getBody();

        } catch (Exception e) {

            LOGGER.error("Could not get all claims Token from passed token");

            claims = null;

        }

        return claims;

    }

我将它用于 JWT

<dependency>

    <groupId>io.jsonwebtoken</groupId>

    <artifactId>jjwt</artifactId>

    <version>0.9.0</version>

</dependency>

编辑1：

添加过滤器以从请求和验证中获取令牌

import java.io.IOException;

import javax.servlet.FilterChain;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.web.filter.OncePerRequestFilter;

public class TokenAuthenticationFilter extends OncePerRequestFilter {

    protected final Log logger = LogFactory.getLog(getClass());

    private TokenHelper tokenHelper;

    private UserDetailsService userDetailsService;

    public TokenAuthenticationFilter(TokenHelper tokenHelper, UserDetailsService userDetailsService) {

        this.tokenHelper = tokenHelper;

        this.userDetailsService = userDetailsService;

    }

    @Override

    public void doFilterInternal(

            HttpServletRequest request,

            HttpServletResponse response,

            FilterChain chain

    ) throws IOException, ServletException {

        String username;

        String authToken = tokenHelper.getToken(request);

        logger.info("AuthToken: "+authToken);

        if (authToken != null) {

            // get username from token

            username = tokenHelper.getUsernameFromToken(authToken);

            logger.info("UserName: "+username);

            if (username != null) {

                // get user

                UserDetails userDetails = userDetailsService.loadUserByUsername(username);

                if (tokenHelper.validateToken(authToken, userDetails)) {

                    // create authentication

                    TokenBasedAuthentication authentication = new TokenBasedAuthentication(userDetails);

                    authentication.setToken(authToken);

                    SecurityContextHolder.getContext().setAuthentication(authentication);

                }

            }else{

                logger.error("Something is wrong with Token.");

            }

        }

        chain.doFilter(request, response);

    }

}