<!-- https://mvnrepository.com/artifact/com.auth0/java-jwt -->
<dependency>
  <groupId>com.auth0</groupId>
  <artifactId>java-jwt</artifactId>
  <version>3.8.3</version>
</dependency>

compile group: 'com.auth0', name: 'java-jwt', version: '3.8.3'

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.Claim;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.io.Serializable;
import java.util.Calendar;
import java.util.Date;

/**
 * @author Lehr
 * @create: 2020-02-04
 */
public class JwtUtils {

  /**
   簽發(fā)對(duì)象：這個(gè)用戶的id
   簽發(fā)時(shí)間：現(xiàn)在
   有效時(shí)間：30分鐘
   載荷內(nèi)容：暫時(shí)設(shè)計(jì)為：這個(gè)人的名字，這個(gè)人的昵稱
   加密密鑰：這個(gè)人的id加上一串字符串
   */
  public static String createToken(String userId,String realName, String userName) {

    Calendar nowTime = Calendar.getInstance();
    nowTime.add(Calendar.MINUTE,30);
    Date expiresDate = nowTime.getTime();

    return JWT.create().withAudience(userId)  //簽發(fā)對(duì)象
        .withIssuedAt(new Date())  //發(fā)行時(shí)間
        .withExpiresAt(expiresDate) //有效時(shí)間
        .withClaim("userName", userName)  //載荷，隨便寫(xiě)幾個(gè)都可以
        .withClaim("realName", realName)
        .sign(Algorithm.HMAC256(userId+"HelloLehr"));  //加密
  }

  /**
   * 檢驗(yàn)合法性，其中secret參數(shù)就應(yīng)該傳入的是用戶的id
   * @param token
   * @throws TokenUnavailable
   */
  public static void verifyToken(String token, String secret) throws TokenUnavailable {
    DecodedJWT jwt = null;
    try {
      JWTVerifier verifier = JWT.require(Algorithm.HMAC256(secret+"HelloLehr")).build();
      jwt = verifier.verify(token);
    } catch (Exception e) {
      //效驗(yàn)失敗
      //這里拋出的異常是我自定義的一個(gè)異常，你也可以寫(xiě)成別的
      throw new TokenUnavailable();
    }
  }

  /**
  * 獲取簽發(fā)對(duì)象
  */
  public static String getAudience(String token) throws TokenUnavailable {
    String audience = null;
    try {
      audience = JWT.decode(token).getAudience().get(0);
    } catch (JWTDecodeException j) {
      //這里是token解析失敗
      throw new TokenUnavailable();
    }
    return audience;
  }


  /**
  * 通過(guò)載荷名字獲取載荷的值
  */
  public static Claim getClaimByName(String token, String name){
    return JWT.decode(token).getClaim(name);
  }
}

  /**
   * 用戶登錄
   * @param userName
   * @param password
   * @param req
   * @return
   * @throws Exception
   */
  @SneakyThrows
  @PostMapping(value = "/login")
  public AccountVO login(String userName, String password, HttpServletRequest req){
    //嘗試登錄
    Subject subject = SecurityUtils.getSubject();
    try {
      subject.login(new UsernamePasswordToken(userName, password));
    } catch (Exception e) {
      throw new LoginFailed();
    }
    AccountVO account = accountService.getAccountByUserName(userName);
    String id = account.getId();
    //生成jwtToken
    String jwtToken = JwtUtils.createToken(id, account.getRealName(),account.getUserName(), subject.getSession().getId().toString());
    //設(shè)置好token，后來(lái)會(huì)在全局處理的時(shí)候放入響應(yīng)里
    req.setAttribute("token", jwtToken);
    return account;
  }

String jwtToken = JwtUtils.createToken(id,account.getRealName(),account.getUserName(),subject.getSession().getId().toString());

public String logout(HttpServletRequest req) {
    SecurityUtils.getSubject().logout();
    return "用戶已經(jīng)安全登出";
  }

package com.imlehr.internship.shiroJwt;

import com.imlehr.internship.exception.TokenUnavailable;
import lombok.SneakyThrows;
import org.apache.shiro.session.mgt.SessionKey;
import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.util.WebUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.Serializable;
import java.util.UUID;

/**
 * @author Lehr
 * @create: 2020-02-10
 */
public class CustomSessionManager extends DefaultWebSessionManager {


  //這里我為了省事用了lombok的標(biāo)簽
  @SneakyThrows
  @Override
  protected Serializable getSessionId(ServletRequest request, ServletResponse response) {

    String token = WebUtils.toHttp(request).getHeader("token");
    System.out.println("會(huì)話管理器得到的token是：" + token);
    if (token == null || token.length()<1) {
      return UUID.randomUUID().toString();
    }

    //在這里驗(yàn)證一下jwt了，雖然我知道這樣不好
    String userId = JwtUtils.getAudience(token);
    JwtUtils.verifyToken(token, userId);
    String sessionId = JwtUtils.getClaimByName(token, "sessionId").asString();

    if (sessionId == null) {
      return new TokenUnavailable();
    }

    
    request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "header");
    request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, token);
    request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
    request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());

    return sessionId;
  }


}

@Override
public Serializable getSessionId(SessionKey key) {
  Serializable id = super.getSessionId(key);
  if (id == null && WebUtils.isWeb(key)) {
    ServletRequest request = WebUtils.getRequest(key);
    ServletResponse response = WebUtils.getResponse(key);
    //調(diào)用第二個(gè)同名方法
    id = getSessionId(request, response);
  }
  return id;
}

public DefaultWebSessionManager sessionManager()
{
  CustomSessionManager customSessionManager = new CustomSessionManager();
  return customSessionManager;
}

public SecurityManager securityManager(MyRealm myRealm) {
  
  DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  securityManager.setRealm(myRealm);
  
  return securityManager;
}