Spring Boot 3 整合 Spring Security 6 实现 JWT 认证

# Spring Boot 3 整合 Spring Security 6 实现 JWT 认证 ## 核心架构 Spring Security 6 移除了 `WebSecurityConfigurerAdapter`，改用组件化配置。 ## 安全配置 ```java @Configuration @EnableMethodSecurity public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .csrf(csrf -> csrf.disable()) .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .authorizeHttpRequests(auth -> auth .requestMatchers("/api/auth/**").permitAll() .requestMatchers("/api/admin/**").hasRole("ADMIN") .anyRequest().authenticated() ) .addFilterBefore(jwtFilter(), UsernamePasswordAuthenticationFilter.class); return http.build(); } } ``` ## JWT 工具类 ```java @Component public class JwtUtil { private static final long ACCESS_TOKEN_EXPIRY = 15 * 60 * 1000; // 15 分钟 private static final long REFRESH_TOKEN_EXPIRY = 7 * 24 * 3600 * 1000; // 7 天 private final SecretKey key; public JwtUtil(@Value("${jwt.secret}") String secret) { this.key = Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8)); } public String generateAccessToken(UserDetails user) { return Jwts.builder() .subject(user.getUsername()) .claim("roles", user.getAuthorities().stream() .map(GrantedAuthority::getAuthority) .collect(Collectors.toList())) .issuedAt(new Date()) .expiration(new Date(System.currentTimeMillis() + ACCESS_TOKEN_EXPIRY)) .signWith(key) .compact(); } } ``` ## Token 刷新机制 ```java @PostMapping("/auth/refresh") public Result refreshToken(@RequestBody RefreshRequest request) { String refreshToken = request.getRefreshToken(); // 1. 验证 refresh token Claims claims = jwtUtil.parseToken(refreshToken); // 2. 检查黑名单 if (tokenBlacklist.contains(refreshToken)) { throw new UnauthorizedException("Token 已失效"); } // 3. 签发新的 access token String newAccessToken = jwtUtil.generateAccessToken(claims.getSubject()); return Result.success(Map.of("accessToken", newAccessToken)); } ``` ## Token 黑名单（Redis） ```java @Service public class TokenBlacklistService { private final StringRedisTemplate redis; public void blacklist(String token) { Claims claims = jwtUtil.parseToken(token); long ttl = claims.getExpiration().getTime() - System.currentTimeMillis(); if (ttl > 0) { redis.opsForValue().set("bl:" + token, "1", ttl, TimeUnit.MILLISECONDS); } } public boolean isBlacklisted(String token) { return Boolean.TRUE.equals(redis.hasKey("bl:" + token)); } } ``` ## 安全建议 1. Access Token 有效期设为 15 分钟 2. Refresh Token 有效期 7 天，存储在 HttpOnly Cookie 3. 退出登录时将 Token 加入黑名单