从0到1开发测试平台（十三）前后端接口token验证

package com.caomingyu.cctestplatform.dao;

import com.caomingyu.cctestplatform.bean.UserLogin;
import org.apache.ibatis.annotations.Mapper;

import java.sql.Timestamp;

@Mapper
public interface UserLoginDao {
    UserLogin queryByToken(String token, Timestamp now);

}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.caomingyu.cctestplatform.dao.UserLoginDao">
    <resultMap id="userLogin" type="com.caomingyu.cctestplatform.bean.UserLogin">
        <result column="ID" property="id"/>
        <result column="USER_ID" property="userId"/>
        <result column="TOKEN" property="token"/>
        <result column="EXPIRATION_DATE" property="expirationDate"/>
        <result column="CREATE_DATE" property="createDate"/>
        <result column="LAST_UPDATE_DATE" property="lastUpdateDate"/>
        <result column="IS_VALID" property="isValid"/>
    </resultMap>
    <select id="queryByToken" resultMap="userLogin">
        select *
        from user_login
        where TOKEN = #{token}
        and EXPIRATION_DATE > #{now}
        and IS_VALID = 1
    </select>
</mapper>

package com.caomingyu.cctestplatform.config;

import com.alibaba.fastjson.JSONObject;
import com.caomingyu.cctestplatform.bean.Result;
import com.caomingyu.cctestplatform.bean.UserLogin;
import com.caomingyu.cctestplatform.common.ResultType;
import com.caomingyu.cctestplatform.common.StatusCode;
import com.caomingyu.cctestplatform.dao.UserLoginDao;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.sql.Timestamp;
import java.util.Date;

@Component
@Slf4j
public class LoginInterceptor implements HandlerInterceptor {

    @Autowired
    private UserLoginDao userLoginDao;
    /**
     * 预处理回调方法，实现处理器的预处理
     * 返回值：true表示继续流程；false表示流程中断，不会继续调用其他的拦截器或处理器
     */
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        String token = request.getHeader("token");
        log.info("token:{}",token);
        //登录表里查下token是否存在
        UserLogin userLogin = userLoginDao.queryByToken(token, new Timestamp(new Date().getTime()));
        System.out.println("userLogin:" + userLogin);
        System.out.println("userLogin:" + request.getRequestURL());
        if (userLogin == null){
            //校验失败
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/json; charset=utf-8");
            response.setHeader("Access-Control-Allow-Headers", "token,content-type");
            response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin"));
            Result result = Result.result(null,true, StatusCode.NEED_LOGIN, ResultType.NEED_LOGIN);
            response.getWriter().write(JSONObject.toJSONString(result));
            return false;
        }
        return true;
    }

    /**
     * 后处理回调方法，实现处理器（controller）的后处理，但在渲染视图之前
     * 此时我们可以通过modelAndView对模型数据进行处理或对视图进行处理
     */
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
                           ModelAndView modelAndView) throws Exception {
        // TODO Auto-generated method stub

    }

    /**
     * 整个请求处理完毕回调方法，即在视图渲染完毕时回调，
     * 如性能监控中我们可以在此记录结束时间并输出消耗时间，
     * 还可以进行一些资源清理，类似于try-catch-finally中的finally，
     * 但仅调用处理器执行链中
     */
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
            throws Exception {
        // TODO Auto-generated method stub

    }
}

package com.caomingyu.cctestplatform.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

import java.util.ArrayList;
import java.util.List;

/**
 * 和springmvc的webmvc拦截配置一样
 * @author BIANP
 */
@Configuration
public class WebConfigurer implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        // 拦截所有请求，通过判断是否有 @LoginRequired 注解 决定是否需要登录
        List<String> patternList = new ArrayList<>();
        patternList.add("/api/v1/user/login");
        registry.addInterceptor(LoginInterceptor()).addPathPatterns("/api/**").excludePathPatterns(patternList);
    }

    @Bean
    public LoginInterceptor LoginInterceptor() {
        return new LoginInterceptor();
    }
}

//添加一个请求拦截器
axios.interceptors.request.use(function (config) {
  config.headers.common['token'] = window.sessionStorage.getItem('token');
  return config;
}, function (error) {
  // Do something with request error
  console.info("error: ");
  console.info(error);
  return Promise.reject(error);
});