添加依赖

<dependencies>

        <!--   jwt     -->

        <dependency>

            <groupId>io.jsonwebtoken</groupId>

            <artifactId>jjwt</artifactId>

            <version>0.9.0</version>

        </dependency>

        <dependency>

            <groupId>com.alibaba</groupId>

            <artifactId>fastjson</artifactId>

            <version>1.2.51</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-oauth2</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-security</artifactId>

        </dependency>

        <dependency>

            <groupId>org.projectlombok</groupId>

            <artifactId>lombok</artifactId>

            <optional>true</optional>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

            <exclusions>

                <exclusion>

                    <groupId>org.junit.vintage</groupId>

                    <artifactId>junit-vintage-engine</artifactId>

                </exclusion>

            </exclusions>

        </dependency>

    </dependencies>

    <dependencyManagement>

        <dependencies>

            <dependency>

                <groupId>org.springframework.cloud</groupId>

                <artifactId>spring-cloud-dependencies</artifactId>

                <version>${spring-cloud.version}</version>

                <type>pom</type>

                <scope>import</scope>

            </dependency>

        </dependencies>

    </dependencyManagement>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

            </plugin>

        </plugins>

        <resources>

            <!--注意这里要加上这些,不然证书无法加载-->

            <resource>

                <directory>src/main/resources</directory>

                <filtering>true</filtering>

                <excludes>

                    <exclude>**/*.jks</exclude>

                </excludes>

            </resource>

            <resource>

                <directory>src/main/resources</directory>

                <filtering>false</filtering>

                <includes>

                    <include>**/*.jks</include>

                </includes>

            </resource>

        </resources>

    </build>

普通方式创建jwt令牌

package com.example.demo;

import io.jsonwebtoken.Claims;

import io.jsonwebtoken.JwtBuilder;

import io.jsonwebtoken.Jwts;

import io.jsonwebtoken.SignatureAlgorithm;

import javax.crypto.spec.SecretKeySpec;

import java.security.Key;

import java.util.Date;

/**

 * @author liuyalong

 */

public class JwtTest {

    public static void main(String[] args) {

        final String keyStr = "4379";

        Key key = new SecretKeySpec(keyStr.getBytes(), SignatureAlgorithm.HS512.getJcaName());

        // expire_time为token有效时长, 单位毫秒

        final long expire_time =10000;

        Date expiresDate = new Date(System.currentTimeMillis() + expire_time);

        //生成jwt令牌

        JwtBuilder jwtBuilder = Jwts.builder()

                //设置jwt编码

                .setId("66")

                //设置jwt主题

                .setSubject("我是主题")

                //设置jwt签发日期

                .setIssuedAt(new Date())

                .claim("a", "admin")

                .claim("b", "aaaa")

                .claim("c", "yalong")

                //设置jwt的过期时间,好像必须在claim后面

                .setExpiration(expiresDate)

                //注意,这里的密码应该使用Key类型,不应使用String类型

                //如果使用String类型,比如4379123加密,那么解密使用4379也可以解开,

                // 因为这个String类型是base64EncodedSecretKey

                .signWith(SignatureAlgorithm.HS256, key);

        //生成jwt

        String jwtToken = jwtBuilder.compact();

        System.out.println(jwtToken);

        //解析jwt,得到其内部的数据

        Claims claims = Jwts.parser().setSigningKey(key).parseClaimsJws(jwtToken).getBody();

        System.out.println(claims.get("exp"));

        System.out.println(claims);

    }

}

使用keytool生成证书

keytool -genkeypair -alias test -keyalg RSA -keypass yalong -keystore "D://yalong.jks" -storepass yalong -validity 3650 -dname "CN=localhost,OU=localhost,O=localhost,L=SH,ST=SH,C=CN" -storetype pkcs12

注意:这里有个大坑,keypass 必须和storepass一样,不然私钥解不开,或许是keytool的原因造成的

alias：密钥的别名
keyalg：使用的hash算法
keypass：密钥的访问密码
keystore：密钥库文件名，yalong.jks保存了生成的证书
storepass：密钥库的访问密码
validity 3650 : 有效期10年
dname :证书的相关信息,
- CN:名字与形式
- OU:组织单位名称
- O:组织机构名称
- L:城市信息
- ST:省份信息
- C:国家信息

查看密钥库

keytool -list -keystore "D://yalong.jks" -storepass liuyalong

导出公钥证书文件.cer

keytool -export -alias test -keystore "D://yalong.jks" -file "D://publicKey.cer" -storepass yalong

使用密钥对生成JWT并加密解密

使用私钥生成JWT令牌,使用公钥解密,公钥可以公开,私钥留在授权服务里,公钥可以导出,私钥不可以导出

package com.example.demo;

import java.io.FileInputStream;

import java.security.KeyPair;

import java.security.KeyStore;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.interfaces.RSAPrivateKey;

import java.util.HashMap;

import java.util.Map;

import com.alibaba.fastjson.JSON;

import org.apache.commons.codec.binary.Base64;

import org.springframework.core.io.ClassPathResource;

import org.springframework.security.jwt.Jwt;

import org.springframework.security.jwt.JwtHelper;

import org.springframework.security.jwt.crypto.sign.RsaSigner;

import org.springframework.security.jwt.crypto.sign.RsaVerifier;

import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;

/**

 * @author liuyalong

 */

public class GetRsaKey {

    public static void main(String[] args) throws Exception {

        //证书库文件路径

        // 这里使用ClassPathResource路径,所以不带D:/

        String storePath = "yalong.jks";

        //这个路径用来获取私钥

        String storePath1 = "D:/yalong.jks";

        //公钥证书文件路径

        //从keystore 导出公钥证书文件.cer,命令如下

        //keytool -export -alias test -keystore "D://yalong.keystore" -file "D://publicKey.cer"

        String cerPath = "D:/publicKey.cer";

        //证书别名

        String alias = "test";

        //证书库密码

        String storePw = "yalong";

        //证书密码

        String keyPw = "yalong";

        String publicKey = getPublicKey(cerPath);

        String privateKey = getPrivateKey(storePath1, alias, storePw, keyPw);

        System.out.println("从证书获取的公钥为:" + publicKey);

        System.out.println("从证书获取的私钥为:" + privateKey);

        Map<String, String> map = new HashMap<>();

        map.put("company", "honbow");

        map.put("address", "shenzhen");

        String jwt = createJwt(storePath, alias, storePw, keyPw, map);

        System.out.println("生成JWT为:" + jwt);

        String s = parseJwt(jwt, publicKey);

        System.out.println("校验后:" + s);

    }

    /**

     * 从公钥证书中获取公钥

     *

     * @param cerPath 公钥证书的路径

     */

    private static String getPublicKey(String cerPath) throws Exception {

        CertificateFactory certificatefactory = CertificateFactory.getInstance("X.509");

        FileInputStream fis = new FileInputStream(cerPath);

        // X509Certificate cert = (X509Certificate) certificatefactory.generateCertificate(fis);

        Certificate cert = certificatefactory.generateCertificate(fis);

        PublicKey pk = cert.getPublicKey();

        String pkString = new Base64().encodeToString(pk.getEncoded());

        //这里需要拼接开头和结尾,不然无法解析出来结果,可能有其他验证方法

        return "-----BEGIN PUBLIC KEY-----" + pkString + "-----END PUBLIC KEY-----";

    }

    private static String getPublicKey(String cerPath, String instanceType) throws Exception {

        CertificateFactory certificatefactory = CertificateFactory.getInstance(instanceType);

        FileInputStream fis = new FileInputStream(cerPath);

        Certificate cert = certificatefactory.generateCertificate(fis);

        PublicKey pk = cert.getPublicKey();

        return new Base64().encodeToString(pk.getEncoded());

    }

    /**

     * @param storePath 证书库的路径

     * @param alias     证书别名,创建时指定的

     * @param storePw   访问证书库的密码

     * @param keyPw     访问证书的密码

     * @param JwtMap    需要设置进Jwt的内容

     * @return jwt 字符串

     */

    private static String createJwt(String storePath,

                                    String alias,

                                    String storePw,

                                    String keyPw,

                                    Map<String, String> JwtMap) {

        ClassPathResource classPathResource = new ClassPathResource(storePath);

        KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(classPathResource, keyPw.toCharArray());

        KeyPair keyPair = keyStoreKeyFactory.getKeyPair(alias, storePw.toCharArray());

        //将当前的私钥转换为rsa私钥

        RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();

        Jwt jwt = JwtHelper.encode(JSON.toJSONString(JwtMap), new RsaSigner(rsaPrivateKey));

        return jwt.getEncoded();

    }

    /**

     * 生成私钥

     *

     * @param storePath 证书库的路径

     * @param alias     证书别名,创建时指定的

     * @param storePw   访问证书库的密码

     * @param keyPw     访问证书的密码

     */

    private static String getPrivateKey(String storePath, String alias, String storePw, String keyPw) throws Exception {

        FileInputStream is = new FileInputStream(storePath);

        KeyStore ks = KeyStore.getInstance("PKCS12");

        ks.load(is, storePw.toCharArray());

        is.close();

        PrivateKey key = (PrivateKey) ks.getKey(alias, keyPw.toCharArray());

        return new Base64().encodeToString(key.getEncoded());

    }

    private static String getPrivateKey(String storePath, String alias, String storePw, String keyPw, String storeType) throws Exception {

        FileInputStream is = new FileInputStream(storePath);

        KeyStore ks = KeyStore.getInstance(storeType);

        ks.load(is, storePw.toCharArray());

        is.close();

        PrivateKey key = (PrivateKey) ks.getKey(alias, keyPw.toCharArray());

        return new Base64().encodeToString(key.getEncoded());

    }

    /**

     * @param jwt jwt字符串

     * @param publicKey 公钥

     * @return 解密后的字符串token

     */

    private static String parseJwt(String jwt, String publicKey) {

        Jwt token = JwtHelper.decodeAndVerify(jwt, new RsaVerifier(publicKey));

        return token.getClaims();

    }

}

RSA的公钥和私钥到底哪个才是用来加密和哪个用来解密？

既然是加密，那肯定是不希望别人知道我的消息，所以只有我才能解密，所以可得出公钥负责加密，私钥负责解密；同理，既然是签名，那肯定是不希望有人冒充我发消息，只有我才能发布这个签名，所以可得出私钥负责签名，公钥负责验证。

注:

JWT保证的是数据传输过程中的完整性而不是机密性。

由于payload是使用base64url编码的，所以相当于明文传输，如果在payload中携带了敏感信息（如存放密钥对的文件路径），单独对payload部分进行base64url解码，就可以读取到payload中携带的信息。

巴特西

Jwt令牌创建