Spring Boot+JWT+Shiro+MybatisPlus怎么实现Restful快速开发后端脚手架

Spring Boot+JWT+Shiro+MybatisPlus怎么实现Restful快速开发后端脚手架

在现代Web开发中，快速搭建一个高效、安全的后端服务是每个开发者的追求。Spring Boot作为Java生态中最流行的框架之一，以其简洁的配置和强大的功能赢得了广泛的青睐。结合JWT（JSON Web Token）、Shiro（Apache Shiro）和MybatisPlus，我们可以快速构建一个功能完善的后端脚手架。本文将详细介绍如何使用这些技术栈实现一个Restful风格的后端服务。

1. 项目初始化

首先，我们需要创建一个Spring Boot项目。可以使用Spring Initializr来快速生成项目骨架。选择以下依赖：

• Spring Web
• MyBatis Plus
• Spring Security
• Shiro
• JWT
• Lombok

生成项目后，导入到IDE中，确保项目结构如下：

src ├── main │ ├── java │ │ └── com │ │ └── example │ │ └── demo │ │ ├── config │ │ ├── controller │ │ ├── entity │ │ ├── mapper │ │ ├── service │ │ └── DemoApplication.java │ └── resources │ ├── application.yml │ └── mapper └── test └── java └── com └── example └── demo 

2. 配置MybatisPlus

MybatisPlus是Mybatis的增强工具，提供了许多便捷的功能。首先，我们需要在application.yml中配置数据库连接和MybatisPlus的相关设置：

spring: datasource: url: jdbc:mysql://localhost:3306/demo?useSSL=false&serverTimezone=UTC username: root password: root driver-class-name: com.mysql.cj.jdbc.Driver mybatis-plus: mapper-locations: classpath:mapper/*.xml type-aliases-package: com.example.demo.entity configuration: map-underscore-to-camel-case: true log-impl: org.apache.ibatis.logging.stdout.StdOutImpl 

接下来，创建一个实体类User：

@Data @TableName("user") public class User { @TableId(type = IdType.AUTO) private Long id; private String username; private String password; private String role; } 

然后，创建Mapper接口UserMapper：

@Mapper public interface UserMapper extends BaseMapper<User> { } 

3. 集成Shiro和JWT

Shiro是一个强大的安全框架，而JWT是一种轻量级的身份验证机制。我们将结合两者来实现用户认证和授权。

首先，添加Shiro和JWT的依赖：

<dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.7.1</version> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt</artifactId> <version>0.9.1</version> </dependency> 

接下来，创建一个JWT工具类JwtUtil：

public class JwtUtil { private static final String SECRET_KEY = "your-secret-key"; public static String generateToken(String username) { return Jwts.builder() .setSubject(username) .setExpiration(new Date(System.currentTimeMillis() + 86400000)) // 1天 .signWith(SignatureAlgorithm.HS512, SECRET_KEY) .compact(); } public static String getUsernameFromToken(String token) { return Jwts.parser() .setSigningKey(SECRET_KEY) .parseClaimsJws(token) .getBody() .getSubject(); } } 

然后，配置Shiro的Realm和Filter：

public class JwtRealm extends AuthorizingRealm { @Autowired private UserMapper userMapper; @Override public boolean supports(AuthenticationToken token) { return token instanceof JwtToken; } @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { String username = (String) principals.getPrimaryPrincipal(); User user = userMapper.selectOne(new QueryWrapper<User>().eq("username", username)); SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); info.addRole(user.getRole()); return info; } @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { String jwtToken = (String) token.getPrincipal(); String username = JwtUtil.getUsernameFromToken(jwtToken); if (username == null) { throw new AuthenticationException("Invalid token"); } User user = userMapper.selectOne(new QueryWrapper<User>().eq("username", username)); if (user == null) { throw new AuthenticationException("User not found"); } return new SimpleAuthenticationInfo(username, jwtToken, getName()); } } 

public class JwtFilter extends AuthenticatingFilter { @Override protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception { HttpServletRequest httpRequest = (HttpServletRequest) request; String token = httpRequest.getHeader("Authorization"); if (token == null || !token.startsWith("Bearer ")) { return null; } return new JwtToken(token.substring(7)); } @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { AuthenticationToken token = createToken(request, response); if (token == null) { return true; } try { getSubject(request, response).login(token); return true; } catch (Exception e) { return false; } } } 

最后，配置Shiro的SecurityManager和Filter：

@Configuration public class ShiroConfig { @Bean public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) { ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean(); factoryBean.setSecurityManager(securityManager); Map<String, Filter> filters = new HashMap<>(); filters.put("jwt", new JwtFilter()); factoryBean.setFilters(filters); Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>(); filterChainDefinitionMap.put("/login", "anon"); filterChainDefinitionMap.put("/**", "jwt"); factoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap); return factoryBean; } @Bean public SecurityManager securityManager(JwtRealm jwtRealm) { DefaultSecurityManager securityManager = new DefaultSecurityManager(); securityManager.setRealm(jwtRealm); return securityManager; } @Bean public JwtRealm jwtRealm() { return new JwtRealm(); } } 

4. 实现Restful API

现在，我们可以实现一些Restful API来测试我们的脚手架。首先，创建一个UserController：

@RestController @RequestMapping("/user") public class UserController { @Autowired private UserMapper userMapper; @PostMapping("/login") public String login(@RequestParam String username, @RequestParam String password) { User user = userMapper.selectOne(new QueryWrapper<User>().eq("username", username)); if (user != null && user.getPassword().equals(password)) { return JwtUtil.generateToken(username); } throw new RuntimeException("Invalid username or password"); } @GetMapping("/info") public User info(@RequestHeader("Authorization") String token) { String username = JwtUtil.getUsernameFromToken(token.substring(7)); return userMapper.selectOne(new QueryWrapper<User>().eq("username", username)); } } 

5. 测试

启动项目后，可以使用Postman或其他工具测试API。首先，调用/user/login接口获取JWT令牌，然后在请求其他接口时在Header中添加Authorization: Bearer <token>。

6. 总结

通过Spring Boot、JWT、Shiro和MybatisPlus的结合，我们快速搭建了一个功能完善的后端脚手架。这个脚手架不仅支持用户认证和授权，还提供了Restful风格的API接口。希望本文能帮助你快速上手这些技术，并在实际项目中应用它们。