Java バックエンド機能開発のセキュリティ認証を実装するにはどうすればよいですか?

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

import java.util.Date;

public class JwtUtils {
    private static final String SECRET_KEY = "your_secret_key";
    private static final long EXPIRATION_TIME = 86400000; // 24小时

    // 生成JWT令牌
    public static String generateToken(String username, String roles) {
        Date expirationDate = new Date(System.currentTimeMillis() + EXPIRATION_TIME);
        return Jwts.builder()
                .setSubject(username)
                .claim("roles", roles)
                .setExpiration(expirationDate)
                .signWith(SignatureAlgorithm.HS512, SECRET_KEY)
                .compact();
    }

    // 解析JWT令牌
    public static Claims parseToken(String token) {
        return Jwts.parser()
                .setSigningKey(SECRET_KEY)
                .parseClaimsJws(token)
                .getBody();
    }
    
    // 验证JWT令牌是否过期
    public static boolean isTokenExpired(String token) {
        Claims claims = parseToken(token);
        Date expirationDate = claims.getExpiration();
        return expirationDate.before(new Date());
    }
}

@RestController
public class UserController {
    @Autowired
    private UserService userService;

    @PostMapping("/login")
    public String login(@RequestBody Map<String, String> loginInfo) {
        String username = loginInfo.get("username");
        String password = loginInfo.get("password");

        // 验证用户名密码
        boolean isValid = userService.validateLogin(username, password);
        if (!isValid) {
            return "用户名或密码错误";
        }

        // 生成JWT令牌
        String roles = userService.getUserRoles(username);
        String token = JwtUtils.generateToken(username, roles);

        return token;
    }

    @GetMapping("/userinfo")
    public String getUserInfo(@RequestHeader("Authorization") String token) {
        // 验证令牌是否过期
        if (JwtUtils.isTokenExpired(token)) {
            return "令牌已过期";
        }

        // 解析令牌，获取用户名和角色信息
        Claims claims = JwtUtils.parseToken(token);
        String username = claims.getSubject();
        String roles = (String) claims.get("roles");

        // 根据用户名获取用户信息
        UserInfo userInfo = userService.getUserInfoByUsername(username);

        // 返回用户信息和角色信息
        return "用户名：" + userInfo.getUsername() + "，角色：" + roles;
    }
}

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class PasswordUtils {
    public static String encryptPassword(String password) {
        try {
            MessageDigest md = MessageDigest.getInstance("SHA-256");
            byte[] hash = md.digest(password.getBytes(StandardCharsets.UTF_8));
            StringBuilder hexString = new StringBuilder();
            for (byte b : hash) {
                String hex = Integer.toHexString(0xff & b);
                if (hex.length() == 1) {
                    hexString.append('0');
                }
                hexString.append(hex);
            }
            return hexString.toString();
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        }
    }
}