Small and medium-sized projects to achieve certification and authorization of hand filter

Code implementation

@Component
@WebFilter(urlPatterns = "/*", filterName = "tokenFilter")
public class TokenFilter implements Filter {
    // token  Expiration time 
    @Value("${token-expired-time}")
    private int tokenExpiredTime;
    
    // uri  Request white list 
    @Resource
    private WhiteListConfig whiteListConfig;
    
    @Resource
    private RedisTemplate<String, Object> redisTemplate;
    
    //  Do exception handling 
    @Resource
    @Qualifier("handlerExceptionResolver")
    private HandlerExceptionResolver resolver;

    @Override
    public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        //  Ask for  token  value , You need to pay attention to your project  token  Corresponding  key  What is it? 
        //  I am here  public static final String AUTH_TOKEN = "auth-token";
        String authToken = request.getHeader(Constants.AUTH_TOKEN);
        //  Request address 
        String requestURI = request.getRequestURI();
        //  Verify whether the white list contains the current  uri
        boolean flag = whiteListConfig.getNotCheck().stream().anyMatch(u -> requestURI.equals("/"+u));
        //  Pass verification 
        if (flag) {
            //  It's certified , Release 
            filterChain.doFilter(request, response);
        } else if (StringUtils.isNotBlank(authToken) && redisTemplate.hasKey(authToken)) {
           //  Non white list , need  token  authentication 
            //  To authorize 
            // redis  It stores the permission information set of the user , Such as ： role 、 menu 、 Function and other permission information 
            TokenInfo tokenInfo = (TokenInfo) redisTemplate.opsForValue().get(authToken);
            assert tokenInfo != null;
            boolean empower = tokenInfo.getEmpowers() != null && tokenInfo.getEmpowers().size() > 0 && tokenInfo.getEmpowers().stream().anyMatch((requestURI)::equals);
            //  Certification and authorization will pass 
            if (empower){
                //  Refresh  token  The expiration time of 
                redisTemplate.expire(token,tokenOvertime,TimeUnit.SECONDS);
                filterChain.doFilter(request, response);
            }else {
                //  If it is certified but there is no authorized information 
                resolver.resolveException(request, response, null,new Err(Status.ILLEGAL_REQUEST.getStatus(),Status.ILLEGAL_REQUEST.getError()));
            }
        } else {
            //  There is no match for  redis  Inside  key,key  Namely  authToken; In these request businesses, the request is directly rejected and an exception is thrown , Record relevant information 
            resolver.resolveException(request, response, null, StringUtils.isBlank(authToken) ? new Err(" In the request header  auth-token  Information cannot be empty ！") : new Err(Status.NOT_LOGIN.getStatus(), Status.NOT_LOGIN.getError()));
        }
    }
}

summary

The general idea is as follows , The details can be changed according to the project information .