Token_使用JWT生成token

使用token替换session保存信息，防篡改

1.token三部分

header
   {
　　"typ": "JWT",
　　"alg": "HS256"
   }
payload
  {
　　"iss": "ninghao.net",
　　"exp": "1438955445",
　　"name": "wanghao",
　　"admin": true
  }
  iss：Issuer，发行者
  sub：Subject，主题
  aud：Audience，观众
  exp：Expiration time，过期时间
  nbf：Not before
  iat：Issued at，发行时间
  jti：JWT ID

signature
　　先是用 Base64 编码的 header.payload ，再用加密算法加密一下，加密的时候要放进去一个 Secret ，这个相当于是一个密码，这个密码秘密地存储在服务端。

2.Base64 编码
　　eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJuaW5naGFvLm5ldCIsImV4cCI6IjE0Mzg5NTU0NDUiLCJuYW1lIjoid2FuZ2hhbyIsImFkbWluIjp0cnVlfQ.SwyHTEx_RQppr97g4J5lKXtabJecpejuef8AqKYMAJc

3.token生成 验证
　生成token     

import java.lang.reflect.Field;
import java.lang.reflect.Modifier;
import java.security.Key;
import java.util.Date;
import java.util.TreeMap;
import java.util.UUID;

import com.alibaba.fastjson.JSONObject;

import io.jsonwebtoken.JwtBuilder;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

public class SignToken {
    private String id; // token对外的ID号

    private String mid; // 开发者编号
    private String docId; // 合同编号
    private String devId; // 签约的ID号码

    private Date createTime; // Token的创建时间
    private Date expiredIn; // Token的过期时间

    private String value; // token的值

    public SignToken(String mid, String docId, String devId) {
        this.id=getUID();
        this.mid = mid;
        this.docId = docId;
        this.devId = devId;
    }


    public static synchronized String getUID() {
        UUID uuid = UUID.randomUUID();
        return uuid.toString().replace("-", "");
    }
    
    
    /////////////////////////////////////////////////////////
    public void setData(String jsonString) {
        JSONObject json = JSONObject.parseObject(jsonString);
        this.setData(json);
    }
    public String toJSONString() {
        return this.toJSONObject().toJSONString();
    }    
    
    public void setData(JSONObject json) {
        Class<?> clazz = this.getClass();
        for (String name: json.keySet()) {
            Object value = json.get(name);
            try {
                Field field = clazz.getDeclaredField(name);
                field.setAccessible(true);
                field.set(this, value);
            } catch (IllegalArgumentException e) {
                e.printStackTrace();
            } catch (IllegalAccessException e) {
                e.printStackTrace();
            } catch (NoSuchFieldException e) {
                e.printStackTrace();
            } catch (SecurityException e) {
                e.printStackTrace();
            }
        }
    }

    public JSONObject toJSONObject() {
        Field[] fields = this.getClass().getDeclaredFields();
        if (fields.length == 0) {
            return null;
        }
        TreeMap<String, Object> map = new TreeMap<String, Object>();
        for (int i = 0; i < fields.length; i++) {
            Field field = fields[i];
            int modifier = field.getModifiers();
            //if (!Modifier.isPublic(modifier) || Modifier.isStatic(modifier) || Modifier.isFinal(modifier)) {
            //    continue;
            //}
            if (Modifier.isStatic(modifier) || Modifier.isFinal(modifier)) {
                continue;
            }
            field.setAccessible(true);
            String name = field.getName();
            Object value = null;
            try {
                value = field.get(this);
            } catch (IllegalArgumentException e) {
                continue;
            } catch (IllegalAccessException e) {
                continue;
            }
            map.put(name, value);
        }
        JSONObject object = new JSONObject(map);
        return object;
    }
        
    
    
    public String getId() {
        return id;
    }

    public void setId(String id) {
        this.id = id;
    }

    public String getMid() {
        return mid;
    }

    public void setMid(String mid) {
        this.mid = mid;
    }

    public String getDocId() {
        return docId;
    }

    public void setDocId(String docId) {
        this.docId = docId;
    }

    public String getDevId() {
        return devId;
    }

    public void setDevId(String devId) {
        this.devId = devId;
    }

    public Date getCreateTime() {
        return createTime;
    }

    public void setCreateTime(Date createTime) {
        this.createTime = createTime;
    }

    public Date getExpiredIn() {
        return expiredIn;
    }

    public void setExpiredIn(Date expiredIn) {
        this.expiredIn = expiredIn;
    }

    public String getValue() {
        return value;
    }

    public void setValue(String value) {
        this.value = value;
    }

}

  验签

package cn.bestsign.mixed.token;

import java.security.InvalidKeyException;
import java.security.Key;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;

import java.security.Signature;
import java.security.SignatureException;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

import javax.xml.bind.DatatypeConverter;

import org.junit.Test;

import cn.gov.shnotary.fingerprint.service.PublicKey;
import io.jsonwebtoken.Jwt;
import io.jsonwebtoken.JwtBuilder;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.impl.crypto.RsaProvider;
import net.sf.json.JSONObject;

public class SignTokenTest {
 
    @Test
    public void generateTokenTest3() throws Exception {
        String pubKey="xxx";
        String priKey="xxx";
        byte[] privateKeyBytes = org.apache.commons.codec.binary.Base64.decodeBase64(priKey);
        byte[] pubKeyBytes = org.apache.commons.codec.binary.Base64.decodeBase64(pubKey);        
 
        PrivateKey privateKey = getPrivateKey("RSA",  privateKeyBytes);
        java.security.PublicKey publicKey = getPublicKey("RSA",  pubKeyBytes);

        SignToken token1 = generateToken("E0000000000000000009", "101101-00000004", "13003618788", 7, SignatureAlgorithm.RS256, privateKey);
        System.out.println(token1.getValue());
        String tokenString = token1.getValue();
        Jwt jwt = Jwts.parser().setSigningKey(publicKey).parse(tokenString);
        System.out.println(jwt.getHeader());
        System.out.println(jwt.getBody());
        Jwt jwt = verifyToken(pubKey, token1.getValue());
        System.out.println(jwt.getHeader());
        System.out.println(jwt.getBody());
        JSONObject json  = JSONObject.fromObject(jwt.getBody()); 
        JSONObject aud = json.getJSONObject("aud");
        System.out.println(aud);
    }
    
    public static PrivateKey getPrivateKey(String KEY_ALGORITHM, byte[] priKey) throws NoSuchAlgorithmException, InvalidKeySpecException {
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(priKey);
        return keyFactory.generatePrivate(pkcs8KeySpec);
    }

    public static java.security.PublicKey getPublicKey(String KEY_ALGORITHM, byte[] pubKey) throws InvalidKeySpecException, NoSuchAlgorithmException {

        X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(pubKey);
        KeyFactory keyFactory = KeyFactory.getInstance(KEY_ALGORITHM);
        return  keyFactory.generatePublic(x509KeySpec);
    }
    
    @Test
    public void generateTokenTest2() throws Exception {
        String pubKey="";
        String priKey="";
        
        KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
        // 初始化密钥对儿生成器
        keyPairGen.initialize(512);
        // 生成密钥对儿
        KeyPair keyPair = keyPairGen.generateKeyPair();
        RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();
        RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();        
 
        SignToken token1 = generateToken("460cfedac66149c2a832e66fa1de28a6", "101101-00000004", "13003618788", 7, SignatureAlgorithm.RS256, privateKey);
        System.out.println(token1.getValue());
        String tokenString = token1.getValue();
        Jwt jwt = Jwts.parser().setSigningKey(publicKey).parse(tokenString);
        System.out.println(jwt.getHeader());
        System.out.println(jwt.getBody());
    }
 
    
    
    @Test
    public void generateTokenTest1() throws Exception {
        KeyPair kp = RsaProvider.generateKeyPair(512);
        java.security.PublicKey publicKey = kp.getPublic();
        PrivateKey privateKey = kp.getPrivate();
     
        SignToken token1 = generateToken("460cfedac66149c2a832e66fa1de28a6", "101101-00000004", "13003618788", 7, SignatureAlgorithm.RS256, privateKey);
        System.out.println(token1.getValue());
        String tokenString = token1.getValue();

        // String tokenInfo[] = tokenString.split("\.");
        // for (String str : tokenInfo) {
        //
        // // String info = new String(Base64.getDecoder().decode(str));
        // // System.out.println(info);
        // }

        Jwt jwt = Jwts.parser().setSigningKey(publicKey).parse(tokenString);
        System.out.println(jwt.getHeader());
        System.out.println(jwt.getBody());

        // Jwts.parser().setSigningKey(publicKey).parseClaimsJws(jwt).getBody();

    }

    public SignToken generateToken(String mid, String docId, String devId, long delay, SignatureAlgorithm alg, Key signingKey) {
        SignToken token = new SignToken(mid, docId, devId);
        // 定义开始时间
        Date now = new Date();
        Date end = new Date(now.getTime() + delay * 24 * 60 * 60 * 1000);
        token.setCreateTime(now);
        token.setExpiredIn(end);
 
        // 构建一个Token
        JwtBuilder builder = Jwts.builder().setId(token.getId());
        builder.setIssuedAt(token.getCreateTime());     // Token颁布的时间
        builder.setExpiration(token.getExpiredIn());     // Token失效的时间
        
        builder.setIssuer(mid);                             //发行者 授权者"ssqian.com.cn"
        builder.setSubject("hand-sign");                //主题
        builder.setAudience(token.toJSONString());        // 观众
        builder.signWith(alg, signingKey);
 
        token.setValue(builder.compact());
        return token;

    }
 
    public static byte[] rsaSign(byte[] data, String privateKey) throws NoSuchAlgorithmException, InvalidKeySpecException, InvalidKeyException, SignatureException {
        // 解密由base64编码的私钥
        byte[] privateKeyBytes = org.apache.commons.codec.binary.Base64.decodeBase64(privateKey);

        // 构造PKCS8EncodedKeySpec对象
        PKCS8EncodedKeySpec pkcs8KeySpec = new PKCS8EncodedKeySpec(privateKeyBytes);

        // KEY_ALGORITHM 指定的加密算法
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");

        // 取私钥匙对象
        PrivateKey priKey = keyFactory.generatePrivate(pkcs8KeySpec);

        // 用私钥对信息生成数字签名
        Signature signature = Signature.getInstance("SHA1withRSA");
        signature.initSign(priKey);
        signature.update(data);

        return signature.sign();
    }

 
}