微服务之间jwt校验

spring5-auth/spring5-auth-client/src/main/java/com/yaozhitech/spring5/config/FeignOkHttpConfig.java

@@ -9,7 +9,7 @@ import org.springframework.cloud.openfeign.FeignAutoConfiguration;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-import com.yaozhitech.spring5.intercept.OkHttpTokenInterceptor;
+import com.yaozhitech.spring5.intercept.OkHttpInterceptor;
 
 import feign.Feign;
 
@@ -19,7 +19,7 @@ import feign.Feign;
 public class FeignOkHttpConfig {
 
 	@Autowired
-	OkHttpTokenInterceptor okHttpLoggingInterceptor;
+	private OkHttpInterceptor okHttpInterceptor;
 
 	private int feignOkHttpReadTimeout = 60;
 	private int feignConnectTimeout = 60;
@@ -31,6 +31,7 @@ public class FeignOkHttpConfig {
 				.readTimeout(feignOkHttpReadTimeout, TimeUnit.SECONDS)
 				.connectTimeout(feignConnectTimeout, TimeUnit.SECONDS)
 				.writeTimeout(feignWriteTimeout, TimeUnit.SECONDS)
+				.addInterceptor(okHttpInterceptor)
 //				.connectionPool(new ConnectionPool())
 //				.addInterceptor(okHttpLoggingInterceptor)
 //				.addInterceptor(interceptor)

spring5-auth/spring5-auth-client/src/main/java/com/yaozhitech/spring5/intercept/OkHttpInterceptor.java

@@ -0,0 +1,53 @@
+package com.yaozhitech.spring5.intercept;
+
+import java.io.IOException;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+
+import com.yaozhitech.spring5.utils.JwtUtils;
+
+import lombok.extern.slf4j.Slf4j;
+import okhttp3.Interceptor;
+import okhttp3.Request;
+import okhttp3.Response;
+
+@Component
+@Slf4j
+public class OkHttpInterceptor implements Interceptor{
+	
+	@Value("${spring.application.name}")
+    private String applicationName;
+	
+	@Value("${auth.client.secret}")
+    private String clientSecret;
+	
+	private Map<String, String> headerMap = new ConcurrentHashMap<String, String>();
+
+	@Override
+	public Response intercept(Chain chain) throws IOException {
+		Request request = chain.request();
+		String path = request.url().pathSegments().get(0);
+		
+		if (headerMap.containsKey(path)) {
+			log.info("request {} header {} ", "x-auth-client-" + path, headerMap.get(path));
+			request = request.newBuilder().addHeader("x-auth-client-" + path, headerMap.get(path)).build();
+		} else {
+			String token = JwtUtils.sign(applicationName + "." + clientSecret, JwtUtils.generateSalt(), 3600);
+			log.info("request {} header {} ", "x-auth-client", token);
+			request = request.newBuilder().addHeader("x-auth-client", token).build();
+		}
+		
+		Response response = chain.proceed(request);
+		String authClientResponse = response.header("x-auth-client-response");
+		
+		if (authClientResponse != null) {
+			headerMap.put(path, authClientResponse);
+		}
+		
+		return response;
+	}
+
+}

spring5-auth/spring5-auth-client/src/main/java/com/yaozhitech/spring5/intercept/OkHttpTokenInterceptor.java

@@ -1,22 +1,21 @@
 package com.yaozhitech.spring5.intercept;
 
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.context.annotation.Configuration;
 
 import com.yaozhitech.spring5.utils.JwtUtils;
 
 import feign.RequestInterceptor;
 import feign.RequestTemplate;
 
-@Configuration
-public class OkHttpTokenInterceptor implements RequestInterceptor{
+//@Configuration
+public class OpenFeignInterceptor implements RequestInterceptor{
 
 	@Value("${spring.application.name}")
     private String applicationName;
 	
 	@Value("${auth.client.secret}")
     private String clientSecret;
-
+	
 	@Override
 	public void apply(RequestTemplate template) {
 		template.header("x-auth-client", JwtUtils.sign(applicationName + "." + clientSecret, JwtUtils.generateSalt(), 3600));

spring5-auth/spring5-auth-client/src/main/java/com/yaozhitech/spring5/intercept/ServiceAuthRestInterceptor.java

@@ -3,10 +3,9 @@ package com.yaozhitech.spring5.intercept;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.util.StringUtils;
 import org.springframework.web.method.HandlerMethod;
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 
@@ -24,7 +23,6 @@ import lombok.extern.slf4j.Slf4j;
  */
 @Slf4j
 public class ServiceAuthRestInterceptor extends HandlerInterceptorAdapter {
-    private Logger logger = LoggerFactory.getLogger(ServiceAuthRestInterceptor.class);
 
   @Autowired
   private AuthServerProvider clientAuthProvider;
@@ -49,12 +47,29 @@ public class ServiceAuthRestInterceptor extends HandlerInterceptorAdapter {
           return super.preHandle(request, response, handler);
       }
 
+		String clientToken = request.getHeader("x-auth-client-" + applicationName);
 		String client = request.getHeader("x-auth-client");
 		
 		try {
-			String uniqueName = JwtUtils.getUsername(client);
-			if (Boolean.TRUE.equals(clientAuthProvider.verify(applicationName, uniqueName.split("\\.")[0], uniqueName.split("\\.")[1]))) {
-				return super.preHandle(request, response, handler);
+			if (StringUtils.isEmpty(clientToken)) {
+				String clientName = JwtUtils.getUsername(client);
+				// authServer校验 客户端是否合法&能否有权限访问
+				if (Boolean.TRUE.equals(clientAuthProvider.verify(applicationName, clientName.split("\\.")[0], clientName.split("\\.")[1]))) {
+					// 给该客户端签名
+					String signToken = JwtUtils.sign(JwtUtils.generateSalt(), "xP3La8IhZjl4fmWXD.AYVH5tor5bn-Rr", 3600*12);
+					response.addHeader("x-auth-client-response", signToken);
+					
+					log.info("auth-server verify success, sign with {}", signToken);
+					
+					return super.preHandle(request, response, handler);
+				}
+				
+			} else {
+				// jwt校验
+				if (!JwtUtils.isTokenExpired(clientToken) && JwtUtils.verifyToken(clientToken, "xP3La8IhZjl4fmWXD.AYVH5tor5bn-Rr") != null) {
+					log.info("local service jwt verify success");
+					return super.preHandle(request, response, handler);
+				}
 			}
 			
 		} catch (Exception e) {

spring5-order/src/main/resources/bootstrap.yml

@@ -10,3 +10,9 @@ spring:
       config:
         server-addr: ${REGISTER_HOST:192.168.99.100}:${REGISTER_PORT:8848}
         file-extension: yml
+        
+feign:
+   httpclient:
+      enabled: false
+   okhttp:
+      enabled: true