Java Web 架构、接口设计与认证拦截

HTTP Request
  -> Controller
    -> Service
      -> Mapper / Dao
        -> Database

public class Result<T> {
    private Integer code; // 1-成功, 0-失败
    private String msg;
    private T data;

    public static <T> Result<T> success(T data) {
        Result<T> r = new Result<>();
        r.code = 1;
        r.msg = "success";
        r.data = data;
        return r;
    }

    public static Result<String> error(String msg) {
        Result<String> r = new Result<>();
        r.code = 0;
        r.msg = msg;
        r.data = null;
        return r;
    }
}

@RestControllerAdvice
public class GlobalExceptionHandler {
    @ExceptionHandler(Exception.class)
    public Result<String> handleException(Exception e) {
        e.printStackTrace();
        return Result.error("对不起，操作失败，请联系管理员");
    }
}

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.Map;

SecretKey key = Keys.hmacShaKeyFor(
        "your-secret-key-your-secret-key-123456".getBytes(StandardCharsets.UTF_8)
);

String jwt = Jwts.builder()
        .claims(claims) // 注入非敏感业务上下文
        .expiration(new Date(System.currentTimeMillis() + 3600 * 1000))
        .signWith(key)
        .compact();

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwtException;
import io.jsonwebtoken.Jwts;

try {
    Claims claims = Jwts.parser()
            .verifyWith(key)
            .build()
            .parseSignedClaims(jwt)
            .getPayload(); // 若遭篡改或已过期，将抛出异常
} catch (JwtException e) {
    // 阻断请求，返回 401 Unauthorized
}

Map<String, Object> accessClaims = new HashMap<>();
accessClaims.put("userId", user.getId());
accessClaims.put("username", user.getUsername());

SecretKey accessKey = Keys.hmacShaKeyFor(
        "access-secret-key-access-secret-key-123456".getBytes(StandardCharsets.UTF_8)
);

String accessToken = Jwts.builder()
        .claims(accessClaims)
        .expiration(new Date(System.currentTimeMillis() + 30 * 60 * 1000))
        .signWith(accessKey)
        .compact();

Map<String, Object> refreshClaims = new HashMap<>();
refreshClaims.put("userId", user.getId());
refreshClaims.put("type", "refresh");

SecretKey refreshKey = Keys.hmacShaKeyFor(
        "refresh-secret-key-refresh-secret-key-123456".getBytes(StandardCharsets.UTF_8)
);

String refreshToken = Jwts.builder()
        .claims(refreshClaims)
        .expiration(new Date(System.currentTimeMillis() + 7L * 24 * 60 * 60 * 1000))
        .signWith(refreshKey)
        .compact();

@PostMapping("/auth/refresh")
public Result<String> refreshToken(@RequestBody Map<String, String> body) {
    String refreshToken = body.get("refreshToken");

    try {
        Claims claims = Jwts.parser()
                .verifyWith(refreshKey)
                .build()
                .parseSignedClaims(refreshToken)
                .getPayload();

        Integer userId = (Integer) claims.get("userId");
        String type = (String) claims.get("type");

        if (!"refresh".equals(type)) {
            return Result.error("无效的 refreshToken");
        }

        // 企业项目中通常还会补：查用户状态、查 Redis 中的 refreshToken 是否仍然有效
        Map<String, Object> newAccessClaims = new HashMap<>();
        newAccessClaims.put("userId", userId);

        String newAccessToken = Jwts.builder()
                .claims(newAccessClaims)
                .expiration(new Date(System.currentTimeMillis() + 30 * 60 * 1000))
                .signWith(accessKey)
                .compact();

        return Result.success(newAccessToken);
    } catch (JwtException e) {
        return Result.error("refreshToken 已失效，请重新登录");
    }
}

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.annotation.WebFilter;
import java.io.IOException;

@WebFilter(urlPatterns = "/*")
public class LoginFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        System.out.println("1. Filter 拦截到了请求，可以在这里做前置校验...");
        chain.doFilter(request, response);
        System.out.println("5. Filter 处理响应，在响应返回给前端之前执行...");
    }
}

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

@Component
public class LoginInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        System.out.println("2. Interceptor: preHandle，Controller 方法执行前校验...");
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
                           ModelAndView modelAndView) throws Exception {
        System.out.println("3. Interceptor: postHandle");
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler,
                                Exception ex) throws Exception {
        System.out.println("4. Interceptor: afterCompletion");
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Autowired
    private LoginInterceptor loginInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(loginInterceptor)
                .addPathPatterns("/**")
                .excludePathPatterns("/login");
    }
}