Java验证jwt token

https://jwt.io/

RS256加密JWT生成、验证

https://blog.csdn.net/u011411069/article/details/79966226

How to load public certificate from pem file..?

https://www.howtobuildsoftware.com/index.php/how-do/ciLJ/java-ssl-cryptography-bouncycastle-public-key-how-to-load-public-certificate-from-pem-file

1.HS256对称加密

package jwt;

import java.io.FileInputStream;
import java.io.IOException;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Base64;
import java.util.Date;
import java.util.Vector;
import java.util.Map;

import sun.misc.BASE64Decoder;

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTVerificationException;
import com.auth0.jwt.interfaces.Claim;
import com.auth0.jwt.interfaces.DecodedJWT;


public class JWTValidator {	
	private static String JWT_Type = "JWT";
	
	protected boolean validated;
	protected Object[] claims;
	
	public JWTValidator() {
		setValidated(false);
		setClaims(null);
	}
	public String Generate(String secret, String issuer, String audience, String subject){
		try {
		    Algorithm algorithm = Algorithm.HMAC256(secret);  // HS256
		    String token = JWT.create()
		        .withIssuer(issuer)
		        .withAudience(audience)
		        .withSubject(subject)
		        .sign(algorithm);
		    System.out.println(token);
		    return token;
		} catch (Exception exception){
		    //UTF-8 encoding not supported
			return "";
		} 
	}
	

	public void Validate(String token, String secret, String issuer, String audience, String subject) {
		DecodedJWT jwt = null;
		setValidated(false);
		
		if (token == null || secret == null || issuer == null || audience == null || subject == null)
			return;
		
		try {
			jwt = JWT.require(Algorithm.HMAC256(secret.getBytes())).build().verify(token);
		} catch (JWTVerificationException e) {
			return;
		}
		
		if (jwt == null || jwt.getType() == null || !jwt.getType().contentEquals(JWT_Type))
			return;
		
		if (!jwt.getIssuer().contentEquals(issuer) ||
			!jwt.getAudience().contains(audience) ||
			!jwt.getSubject().contentEquals(subject))
			return;
		
		Date now = new Date();
		
		if ((jwt.getNotBefore() != null && jwt.getNotBefore().after(now)) ||
			(jwt.getExpiresAt() != null && jwt.getExpiresAt().before(now)))
			return;
		
		setValidated(true);

		Map<String, Claim> claimsMap = jwt.getClaims();
		Vector<Claim> claimsVector = new Vector<Claim>();
		
		if (claimsMap != null) {
			for (Map.Entry<String, Claim> entry : claimsMap.entrySet()) {
				String key = entry.getKey();
				if (key != null && !key.matches("aud|sub|iss|exp|iat")) {					
					//claimsVector.add(new Claim(key, entry.getValue().asString()));
				}
			}		
		}

		setClaims(claimsVector.isEmpty() ? null : claimsVector.toArray());
	}

	public boolean isValidated() { return validated; }
	public void setValidated(boolean val) { validated = val; }

	public Object[] getClaims() { return claims; }
	public void setClaims(Object[] val) { claims = (val == null ? new Object[0] : val); }
}

　　

2.RS256不对称加密，需要用public cert来验证

package jwt;

import junit.framework.TestCase;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.io.IOUtils;
import org.jose4j.jws.AlgorithmIdentifiers;
import org.jose4j.jws.JsonWebSignature;
import org.jose4j.jwt.JwtClaims;
import org.jose4j.jwt.consumer.JwtConsumer;
import org.jose4j.jwt.consumer.JwtConsumerBuilder;
import org.jose4j.lang.JoseException;
import sun.security.util.DerInputStream;
import sun.security.util.DerValue;

import java.io.ByteArrayInputStream;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.math.BigInteger;
import java.security.*;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.RSAPrivateCrtKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.text.SimpleDateFormat;
import java.util.UUID;
 
public class JWTValidatorForRSA extends TestCase{
 
    public void testCreateToken() throws IOException {
        System.out.println(createToken());
    }
 
    public void testVerifyToken() throws Exception {
        String token = createToken();
        System.out.println(token);
        
        String pkeyPath = "D:\temp\idsrv4.crt";
        JwtClaims jwtClaims = verifyToken(token,pkeyPath);
        System.out.println(jwtClaims.getClaimValue("name"));
        System.out.println(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(jwtClaims.getIssuedAt().getValueInMillis()));
        System.out.println(new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(jwtClaims.getExpirationTime().getValueInMillis()));
    }
 
    /**
     * 生成jwt,SHA256加密
     * @return
     * @throws IOException
     */
    public String createToken() throws IOException {
    	String  privateKeyPath = "D:\temp\idsrv4.key";
        PrivateKey privateKey = getPrivateKey(getStringFromFile(privateKeyPath));
        final JwtClaims claims = new JwtClaims();
        claims.setClaim("name", "jack");
        claims.setSubject("a@a.com");
        claims.setAudience("test");//用于验证签名是否合法，验证方必须包含这些内容才验证通过
        claims.setExpirationTimeMinutesInTheFuture(-1); // 60*24*30);
        claims.setIssuedAtToNow();
 
        // Generate the payload
        final JsonWebSignature jws = new JsonWebSignature();
        jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
        jws.setPayload(claims.toJson());
        jws.setKeyIdHeaderValue(UUID.randomUUID().toString());
 
        // Sign using the private key
        jws.setKey(privateKey);
        try {
            return jws.getCompactSerialization();
        } catch (JoseException e) {
            return null;
        }
    }
 
    /**
     * 验证jwt
     * @param token
     * @return
     * @throws Exception
     */
    public JwtClaims verifyToken(String token,String publicKeyPath) throws Exception {
 
        try {
            PublicKey publicKey = getPublicKey(publicKeyPath);
 
            JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                    .setRequireExpirationTime()
                    .setVerificationKey(publicKey)
                    .setExpectedAudience("test")//用于验证签名是否合法，可以设置多个，且可设置必须存在项，如果jwt中不包含这些内容则不通过
                    .build();
 
            return jwtConsumer.processToClaims(token);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
 
    private String getStringFromFile(String  filePath) throws IOException {
        //    生成方法：安装openssl,执行     openssl genrsa -out private.pem 2048
        return IOUtils.toString(new FileInputStream(filePath));
    }
 
    /**
     * 获取PublicKey对象
     * @param publicKeyBase64
     * @return
     * @throws NoSuchAlgorithmException
     * @throws InvalidKeySpecException
     * @throws CertificateException 
     * @throws FileNotFoundException 
     */
    private PublicKey getPublicKey(String publicKeyPath) throws NoSuchAlgorithmException, InvalidKeySpecException, CertificateException, FileNotFoundException {
    	/* Not work : data isn't an object ID (tag = 2)
    	String pem = publicKeyBase64
                .replaceAll("\-*BEGIN.*CERTIFICATE\-*", "")
                .replaceAll("\-*END.*CERTIFICATE\-*", "");
        java.security.Security.addProvider(
                new org.bouncycastle.jce.provider.BouncyCastleProvider()
        );
        System.out.println(pem);
        
        X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(Base64.decodeBase64(pem));
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
 
        PublicKey publicKey = keyFactory.generatePublic(pubKeySpec);
        */
        
        CertificateFactory fact = CertificateFactory.getInstance("X.509");
        FileInputStream is = new FileInputStream (publicKeyPath);
        X509Certificate cer = (X509Certificate) fact.generateCertificate(is);
        PublicKey publicKey = cer.getPublicKey();
        
        System.out.println(publicKey);
        
        return publicKey;
    }
 
    /**
     * 获取PrivateKey对象
     * @param privateKeyBase64
     * @return
     */
    private PrivateKey getPrivateKey(String privateKeyBase64) {
        String privKeyPEM = privateKeyBase64
                .replaceAll("\-*BEGIN.*KEY\-*", "")
                .replaceAll("\-*END.*KEY\-*", "");
 
        // Base64 decode the data
        byte[] encoded = Base64.decodeBase64(privKeyPEM);
 
        try {
            DerInputStream derReader = new DerInputStream(encoded);
            DerValue[] seq = derReader.getSequence(0);
 
            if (seq.length < 9) {
                throw new GeneralSecurityException("Could not read private key");
            }
 
            // skip version seq[0];
            BigInteger modulus = seq[1].getBigInteger();
            BigInteger publicExp = seq[2].getBigInteger();
            BigInteger privateExp = seq[3].getBigInteger();
            BigInteger primeP = seq[4].getBigInteger();
            BigInteger primeQ = seq[5].getBigInteger();
            BigInteger expP = seq[6].getBigInteger();
            BigInteger expQ = seq[7].getBigInteger();
            BigInteger crtCoeff = seq[8].getBigInteger();
 
            RSAPrivateCrtKeySpec keySpec = new RSAPrivateCrtKeySpec(modulus, publicExp, privateExp,
                    primeP, primeQ, expP, expQ, crtCoeff);
 
            KeyFactory factory = KeyFactory.getInstance("RSA");
            return factory.generatePrivate(keySpec);
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }
}