diff --git a/.gitignore b/.gitignore index 6c0187813872b085601abdf653cd52410f9f3836..83b060c2c4acfa75de95be6763f4949a2f2e616a 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,7 @@ out/ ### VS Code ### .vscode/ +/gradlew +/gradlew.bat +/gradle/ +/logs/ diff --git a/README.md b/README.md index 7dd0a3f5efa91d87d5d2066e57ad1f8798c9243a..c63fe8c7711d89e4bd7ce3a156aee2f512363829 100644 --- a/README.md +++ b/README.md @@ -8,5 +8,6 @@ SpringSecurity的逻辑 TokenFilter是比SpringSecurity先校验的过滤器。TokenFilter的作用就是获取SpringSecurity校验的权限信息。如果获取不到则必然无法通过校验。 TokenFilter是验证认证的,SpringSecurity是验证授权的。 +![](./asset/img/SpringSecurityJWT.png) ![](./asset/img/token.png) \ No newline at end of file diff --git a/asset/img/SpringSecurityJWT.png b/asset/img/SpringSecurityJWT.png new file mode 100644 index 0000000000000000000000000000000000000000..48637ae00e8c4f3c2ce661e9336132a0b9d0ab0e Binary files /dev/null and b/asset/img/SpringSecurityJWT.png differ diff --git a/settings.gradle b/settings.gradle index 3ba2b3bfd50976fa4a4518c6783aaeadde6eabdf..c71a624061737cb7764d0ae7b3a2f673179b2f8d 100644 --- a/settings.gradle +++ b/settings.gradle @@ -1 +1 @@ -rootProject.name = 'token' +rootProject.name = 'spring-security-jwt-token' diff --git a/src/main/java/org/xian/token/secutiry/TokenFilter.java b/src/main/java/org/xian/token/secutiry/TokenFilter.java index 2a0f8862d67e44da3c43d0b95d740e9e00d84db9..d18ca28751106908f79061c94b7e2907c8d2b064 100644 --- a/src/main/java/org/xian/token/secutiry/TokenFilter.java +++ b/src/main/java/org/xian/token/secutiry/TokenFilter.java @@ -55,7 +55,7 @@ public class TokenFilter extends OncePerRequestFilter { if (authorizationValue != null && authorizationValue.startsWith(bearer)) { // token String token = authorizationValue.substring(bearer.length()); - + // 验证用户的token信息,一旦认证的token没有问题则认为用户合法!认证通过则将用户的用户名和角色信息交与授权的 SysUser sysUser = tokenUtils.validationToken(token); if (sysUser != null) { // Spring Security 角色名称默认使用 "ROLE_" 开头 @@ -68,7 +68,7 @@ public class TokenFilter extends OncePerRequestFilter { UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken( userDetails, null, userDetails.getAuthorities()); authentication.setDetails(userDetails.getUsername()); - // 授权 + // 拿着合法的认证过的信息去授权 SecurityContextHolder.getContext().setAuthentication(authentication); } }