Java基于JWT的token认证( 二 ) _Java

headerClaims是一个Map，包括两个属性typ和alg，typ值固定JWT，alg传过来的签名算法这里使用的
HmacSHA256简称HS256 。typ和alg组成Header头信息。
Payload载荷结构分析关键源码如下：
public abstract class JWT { public JWT() { } public static DecodedJWT decode(String token) throws JWTDecodeException { return new JWTDecoder(token); } public static Verification require(Algorithm algorithm) { return JWTVerifier.init(algorithm); } public static Builder create() { return JWTCreator.init(); }}public static class Builder { private final Map<String, Object> payloadClaims = new HashMap(); private Map<String, Object> headerClaims = new HashMap(); Builder() { } public JWTCreator.Builder withHeader(Map<String, Object> headerClaims) { this.headerClaims = new HashMap(headerClaims); return this; } public JWTCreator.Builder withKeyId(String keyId) { this.headerClaims.put("kid", keyId); return this; } public JWTCreator.Builder withIssuer(String issuer) { this.addClaim("iss", issuer);//签发人 return this; } public JWTCreator.Builder withSubject(String subject) { this.addClaim("sub", subject);//主题 return this; } public JWTCreator.Builder withAudience(String... audience) { this.addClaim("aud", audience);//接受一方 return this; } public JWTCreator.Builder withExpiresAt(Date expiresAt) { this.addClaim("exp", expiresAt);//过期时间 return this; } public JWTCreator.Builder withNotBefore(Date notBefore) { this.addClaim("nbf", notBefore);//生效时间 return this; } public JWTCreator.Builder withIssuedAt(Date issuedAt) { this.addClaim("iat", issuedAt);//签发时间 return this; } public JWTCreator.Builder withJWTId(String jwtId) { this.addClaim("jti", jwtId);//编号 return this; } public JWTCreator.Builder withClaim(String name, Boolean value) throws IllegalArgumentException { this.assertNonNull(name); this.addClaim(name, value); return this; } public JWTCreator.Builder withClaim(String name, Integer value) throws IllegalArgumentException { this.assertNonNull(name); this.addClaim(name, value); return this; } //...其他方法省略...}Payload是一个json对象，存放需要传递的数据，JTW默认规定了几个属性，如果需要添加其他属性可以调用其重载方法witchClaim()添加。
Signature签名部分源码如下：
private String sign() throws SignatureGenerationException { String header = Base64.encodeBase64URLSafeString( this.headerJson.getBytes(StandardCharsets.UTF_8)); String payload = Base64.encodeBase64URLSafeString( this.payloadJson.getBytes(StandardCharsets.UTF_8)); String content = String.format("%s.%s", header, payload); byte[] signatureBytes = this.algorithm.sign( content.getBytes(StandardCharsets.UTF_8)); String signature = Base64.encodeBase64URLSafeString(signatureBytes); return String.format("%s.%s", content, signature);}从这里可以看出，所谓token就是分别对header和payload的json字符串做Base64加密得到a和b，并将结果拼接一起，在进行签名得到c，最终把a、b、c三部分内容以点拼接起来形成token，返回客户端保存，客户端以后每次请求都在header中加入token，服务器采用拦截器方式获取header中的token做校验，识别用户。
三、示例
3.1 数据准备
创建用户表