как обновлять время истечения токена jwt при каждом запросе - PullRequest
Новая
       11

как обновлять время истечения токена jwt при каждом запросе

0 голосов
/ 24 октября 2019

мне нужно обновление сервера (Spring boot security), время истечения токена jwt при каждом запросе ... например, время истечения 30 сек. и токен заканчивается в 13:00:30, через 15 секунд, если я отправляю запрос от клиента (почтальона), срок действия должен быть 13:00:45, а не 13:00:30. Но моя программа не обновляет эту дату истечения. вот мои конфиги:

application.properties: 

spring.datasource.url=jdbc:mysql://localhost:3306/springbootdb?        
useUnicode=true&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=UTC
spring.datasource.username=root
spring.datasource.password=
spring.jpa.generate-ddl=false
grokonez.app.jwtSecret=jwtGrokonezSecretKey
grokonez.app.jwtExpiration=60

конфигурация безопасности пружины: 

@Configuration
@EnableWebSecurity
@ComponentScan("test.spring.rest")
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserDetailsServiceImpl userDetailsService;

    @Autowired
    private JwtAuthEntryPoint unauthorizedHandler;

    @Bean
    public JwtAuthTokenFilter authenticationJwtTokenFilter() {
        return new JwtAuthTokenFilter();
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder
            .userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable().
                authorizeRequests()
                .antMatchers("/api/test/**").permitAll()
                .antMatchers("/api/auth/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    }
}

JwtAuthEntryPoint: 

@Component
public class JwtAuthEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Error -> Unauthorized");
    }
}

JwtAuthTokenFilter:

public class JwtAuthTokenFilter extends OncePerRequestFilter {

@Autowired
private JwtProvider tokenProvider;

@Autowired
private UserDetailsServiceImpl userDetailsService;

@Value("${grokonez.app.jwtExpiration}")
private int jwtExpiration;


@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

    try {

        String jwt = getJwt(request);
        if (jwt != null && tokenProvider.validateJwtToken(jwt)) {

            System.err.println("I\'m in  (doFilterInternal())");

            String username = tokenProvider.getUserNameFromJwtToken(jwt);

            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                    userDetails, null, userDetails.getAuthorities());
            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
    } catch (Exception e) {
        logger.error("Can NOT set user authentication -> Message: {}", e);
    }

    filterChain.doFilter(request, response);
}

private String getJwt(HttpServletRequest request) {
    String authHeader = request.getHeader("Authorization");

    if (authHeader != null && authHeader.startsWith("Bearer ")) {
        return authHeader.replace("Bearer ", "");
    }

    return null;
}
}

JwtProvider: 

@Component

открытый класс JwtProvider {

@Value("${grokonez.app.jwtSecret}")
private String jwtSecret;

@Value("${grokonez.app.jwtExpiration}")
private int jwtExpiration;

public String generateJwtToken(Authentication authentication) {

    UserPrinciple userPrincipal = (UserPrinciple) authentication.getPrincipal();



    System.out.println("---------------------------------------------------");
    System.out.println(new Date((new Date()).getTime() + jwtExpiration*1000));
    System.out.println("---------------------------------------------------");


    return Jwts.builder()
            .setSubject((userPrincipal.getUsername()))
            .setIssuedAt(new Date())
            .setExpiration(new Date((new Date()).getTime() + jwtExpiration*1000))
            .signWith(SignatureAlgorithm.HS512, jwtSecret)
            .compact();
}

public boolean validateJwtToken(String authToken) {
    try {
        Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(authToken);
        return true;
    } catch (SignatureException e) {
    } catch (MalformedJwtException e) {
    } catch (ExpiredJwtException e) {
    } catch (UnsupportedJwtException e) {
    } catch (IllegalArgumentException e) {
    }

    return false;
}

public String getUserNameFromJwtToken(String token) {
    return Jwts.parser()
            .setSigningKey(jwtSecret)
            .parseClaimsJws(token)
            .getBody().getSubject();
}
}
...