return JWT.create().withAudience(userId)
  .withIssuedAt(new Date()) <---- 發(fā)行時(shí)間
  .withExpiresAt(expiresDate) <---- 有效期
  .withClaim("sessionId", sessionId)
  .withClaim("userName", userName)
  .withClaim("realName", realName)
  .sign(Algorithm.HMAC256(userId+"HelloLehr"));

<!-- https://mvnrepository.com/artifact/com.auth0/java-jwt -->
<dependency>
 <groupId>com.auth0</groupId>
 <artifactId>java-jwt</artifactId>
 <version>3.8.3</version>
</dependency>

compile group: 'com.auth0', name: 'java-jwt', version: '3.8.3'

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.Claim;
import com.auth0.jwt.interfaces.DecodedJWT;

import java.io.Serializable;
import java.util.Calendar;
import java.util.Date;

/**
 * @author Lehr
 * @create: 2020-02-04
 */
public class JwtUtils {

 /**
 簽發(fā)對(duì)象：這個(gè)用戶的id
 簽發(fā)時(shí)間：現(xiàn)在
 有效時(shí)間：30分鐘
 載荷內(nèi)容：暫時(shí)設(shè)計(jì)為：這個(gè)人的名字，這個(gè)人的昵稱
 加密密鑰：這個(gè)人的id加上一串字符串
 */
 public static String createToken(String userId,String realName, String userName) {

 Calendar nowTime = Calendar.getInstance();
 nowTime.add(Calendar.MINUTE,30);
 Date expiresDate = nowTime.getTime();

 return JWT.create().withAudience(userId) //簽發(fā)對(duì)象
  .withIssuedAt(new Date()) //發(fā)行時(shí)間
  .withExpiresAt(expiresDate) //有效時(shí)間
  .withClaim("userName", userName) //載荷，隨便寫幾個(gè)都可以
  .withClaim("realName", realName)
  .sign(Algorithm.HMAC256(userId+"HelloLehr")); //加密
 }

 /**
 * 檢驗(yàn)合法性，其中secret參數(shù)就應(yīng)該傳入的是用戶的id
 * @param token
 * @throws TokenUnavailable
 */
 public static void verifyToken(String token, String secret) throws TokenUnavailable {
 DecodedJWT jwt = null;
 try {
  JWTVerifier verifier = JWT.require(Algorithm.HMAC256(secret+"HelloLehr")).build();
  jwt = verifier.verify(token);
 } catch (Exception e) {
  //效驗(yàn)失敗
  //這里拋出的異常是我自定義的一個(gè)異常，你也可以寫成別的
  throw new TokenUnavailable();
 }
 }

 /**
 * 獲取簽發(fā)對(duì)象
 */
 public static String getAudience(String token) throws TokenUnavailable {
 String audience = null;
 try {
  audience = JWT.decode(token).getAudience().get(0);
 } catch (JWTDecodeException j) {
  //這里是token解析失敗
  throw new TokenUnavailable();
 }
 return audience;
 }


 /**
 * 通過(guò)載荷名字獲取載荷的值
 */
 public static Claim getClaimByName(String token, String name){
 return JWT.decode(token).getClaim(name);
 }
}

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

/**
 * @author Lehr
 * @create: 2020-02-03
 */
@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
public @interface PassToken {
 boolean required() default true;
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

/**
* @author lehr
*/
@Configuration
public class JwtInterceptorConfig implements WebMvcConfigurer {
 @Override
 public void addInterceptors(InterceptorRegistry registry) {

 //默認(rèn)攔截所有路徑
 registry.addInterceptor(authenticationInterceptor())
  .addPathPatterns("/**");
 }
 @Bean
 public JwtAuthenticationInterceptor authenticationInterceptor() {
 return new JwtAuthenticationInterceptor();
 }
} 

import com.auth0.jwt.interfaces.Claim;
import com.imlehr.internship.annotation.PassToken;
import com.imlehr.internship.dto.AccountDTO;
import com.imlehr.internship.exception.NeedToLogin;
import com.imlehr.internship.exception.UserNotExist;
import com.imlehr.internship.service.AccountService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.lang.reflect.Method;
import java.util.Map;

/**
 * @author Lehr
 * @create: 2020-02-03
 */
public class JwtAuthenticationInterceptor implements HandlerInterceptor {
 @Autowired
 AccountService accountService;

 @Override
 public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object object) throws Exception {
 // 從請(qǐng)求頭中取出 token 這里需要和前端約定好把jwt放到請(qǐng)求頭一個(gè)叫token的地方
 String token = httpServletRequest.getHeader("token");
 // 如果不是映射到方法直接通過(guò)
 if (!(object instanceof HandlerMethod)) {
  return true;
 }
 HandlerMethod handlerMethod = (HandlerMethod) object;
 Method method = handlerMethod.getMethod();
 //檢查是否有passtoken注釋，有則跳過(guò)認(rèn)證
 if (method.isAnnotationPresent(PassToken.class)) {
  PassToken passToken = method.getAnnotation(PassToken.class);
  if (passToken.required()) {
  return true;
  }
 }
 //默認(rèn)全部檢查
 else {
  System.out.println("被jwt攔截需要驗(yàn)證");
  // 執(zhí)行認(rèn)證
  if (token == null) {
  //這里其實(shí)是登錄失效,沒(méi)token了 這個(gè)錯(cuò)誤也是我自定義的，讀者需要自己修改
  throw new NeedToLogin();
  }
  
  // 獲取 token 中的 user Name
  String userId = JwtUtils.getAudience(token);

  //找找看是否有這個(gè)user 因?yàn)槲覀冃枰獧z查用戶是否存在，讀者可以自行修改邏輯
  AccountDTO user = accountService.getByUserName(userId);

  if (user == null) {
  //這個(gè)錯(cuò)誤也是我自定義的
  throw new UserNotExist();
  }

  // 驗(yàn)證 token 
  JwtUtils.verifyToken(token, userId)
  
  //獲取載荷內(nèi)容
 	String userName = JwtUtils.getClaimByName(token, "userName").asString();
 	String realName = JwtUtils.getClaimByName(token, "realName").asString();
 	
  //放入attribute以便后面調(diào)用
  request.setAttribute("userName", userName);
 	request.setAttribute("realName", realName);
  

  return true;

 }
 return true;
 }

 @Override
 public void postHandle(HttpServletRequest httpServletRequest,
    HttpServletResponse httpServletResponse,
    Object o, ModelAndView modelAndView) throws Exception {

 }

 @Override
 public void afterCompletion(HttpServletRequest httpServletRequest,
    HttpServletResponse httpServletResponse,
    Object o, Exception e) throws Exception {
 }
}

/**
 * 用戶登錄：獲取賬號(hào)密碼并登錄，如果不對(duì)就報(bào)錯(cuò)，對(duì)了就返回用戶的登錄信息
 * 同時(shí)生成jwt返回給用戶
 *
 * @return
 * @throws LoginFailed 這個(gè)LoginFailed也是我自定義的
 */
 @PassToken
 @GetMapping(value = "/login")
 public AccountVO login(String userName, String password) throws LoginFailed{
 
 try{
  service.login(userName,password);
 }
 catch (AuthenticationException e)
 {
  throw new LoginFailed();
 }

 //如果成功了，聚合需要返回的信息
 AccountVO account = accountService.getAccountByUserName(userName);
 
 //給分配一個(gè)token 然后返回
 String jwtToken = JwtUtils.createToken(account);

 //我的處理方式是把token放到accountVO里去了
 account.setToken(jwtToken);

 return account;

 }

 @GetMapping(value = "/username")
 public String checkName(HttpServletRequest req) {
 //之前在攔截器里設(shè)置好的名字現(xiàn)在可以取出來(lái)直接用了
 String name = (String) req.getAttribute("userName");
 return name;
 }