萱草|记一次token安全认证的实践( 三 ) 背景介绍：

resultUser.setCompanyId(user.getCompanyId());
resultUser.setUserType(user.getLoginUserType());
resultUser.setDeptId(user.getDeptId());
resultUser.setUid(user.getUserId());
resultUser.setToken(access_token);
ru.set(LOGIN_USER+user.getUserId(),resultUser,3600*24*15);
returnResultMap.ok("登录成功",resultUser);//改造——》》获取用户信息保存到redis中实现用户信息在微服务中共享，生成token
}catch(AuthenticationExceptione){
Stringmsg="用户或密码错误";
if(StringUtils.isNotEmpty(e.getMessage())){
msg=e.getMessage();
}
returnResultMap.error(msg);
}
}
}
好了，此时呢，我们已经通过auth工程完成了用户登录授权，并且生成了token 。那么如何在gateway网关中进行token认证呢？
3.gateway网关中编写JwtCheckGatewayFilterFactory过滤器。
此类需要继承gateway的AbstractGatewayFilterFactory 。
代码实现如下：
首先gateway网关yml文件中需要代理auth路由。
spring:
cloud:
gateway:
routes:
-id:neo_route
uri:lb://YUNXI-AUTH
predicates:
-Path=/auth/**
filters:
-StripPrefix=1
-JwtCheck
自定义JwtCheckGatewayFilterFactory继承AbstractGatewayFilterFactory抽象类，代码如下：
publicclassJwtCheckGatewayFilterFactoryextendsAbstractGatewayFilterFactory{
privatestaticfinalLoggerlog=LoggerFactory.getLogger(JwtCheckGatewayFilterFactory.class);
//定义用户认证登录接口
privatestaticfinalStringCURRENCY_URL="/currency/login";
//redis初始KEY值
privatestaticfinalStringLOGIN_USER="login_user";
@Autowired
privateRedisUtilru;
publicJwtCheckGatewayFilterFactory(){
super(Config.class);
}
@Override
publicGatewayFilterapply(Configconfig){
return(exchange,chain)->{
StringjwtToken=exchange.getRequest().getHeaders().getFirst("Authorization");
log.info(exchange.getRequest().getURI().toString());
//校验jwtToken的合法性,如果当前请求url和认证url相同跳过认证，表示用户首次登录认证
if(exchange.getRequest().getURI().toString().contains(CURRENCY_URL)){
returnchain.filter(exchange);
}
if(jwtToken!=null){
log.info(Token.ValidToken(jwtToken).toString());
//解析TOKEN
MapuserMsg=Token.ValidToken(jwtToken);
Longuid=(Long)userMsg.get("uid");
if(ru.hasKey(LOGIN_USER+uid)){
Objectobj=ru.get(LOGIN_USER+uid);
UserMsguserModel=(UserMsg)obj;
//解析客户端传过来的TOKEN是否和缓存中的TOKEN相同，并且判断TOKEN过期时间是否大于当前时间
if(userModel.getToken().equals(jwtToken)){
returnchain.filter(exchange);
}else{
ServerHttpResponseresponse=exchange.getResponse();
StringwarningStr="不合法的请求";
DataBufferbodyDataBuffer=response.bufferFactory().wrap(warningStr.getBytes());
returnresponse.writeWith(Mono.just(bodyDataBuffer));
}
}else{
ServerHttpResponseresponse=exchange.getResponse();
StringwarningStr="登录超时";
DataBufferbodyDataBuffer=response.bufferFactory().wrap(warningStr.getBytes());
returnresponse.writeWith(Mono.just(bodyDataBuffer));