Java 백엔드 기능 개발을 위한 보안 인증을 구현하는 방법은 무엇입니까?

import io.jsonwebtoken.Claims; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import java.util.Date; public class JwtUtils { private static final String SECRET_KEY = "your_secret_key"; private static final long EXPIRATION_TIME = 86400000; // 24小时 // 生成JWT令牌 public static String generateToken(String username, String roles) { Date expirationDate = new Date(System.currentTimeMillis() + EXPIRATION_TIME); return Jwts.builder() .setSubject(username) .claim("roles", roles) .setExpiration(expirationDate) .signWith(SignatureAlgorithm.HS512, SECRET_KEY) .compact(); } // 解析JWT令牌 public static Claims parseToken(String token) { return Jwts.parser() .setSigningKey(SECRET_KEY) .parseClaimsJws(token) .getBody(); } // 验证JWT令牌是否过期 public static boolean isTokenExpired(String token) { Claims claims = parseToken(token); Date expirationDate = claims.getExpiration(); return expirationDate.before(new Date()); } }

@RestController public class UserController { @Autowired private UserService userService; @PostMapping("/login") public String login(@RequestBody Map loginInfo) { String username = loginInfo.get("username"); String password = loginInfo.get("password"); // 验证用户名密码 boolean isValid = userService.validateLogin(username, password); if (!isValid) { return "用户名或密码错误"; } // 生成JWT令牌 String roles = userService.getUserRoles(username); String token = JwtUtils.generateToken(username, roles); return token; } @GetMapping("/userinfo") public String getUserInfo(@RequestHeader("Authorization") String token) { // 验证令牌是否过期 if (JwtUtils.isTokenExpired(token)) { return "令牌已过期"; } // 解析令牌，获取用户名和角色信息 Claims claims = JwtUtils.parseToken(token); String username = claims.getSubject(); String roles = (String) claims.get("roles"); // 根据用户名获取用户信息 UserInfo userInfo = userService.getUserInfoByUsername(username); // 返回用户信息和角色信息 return "用户名：" + userInfo.getUsername() + "，角色：" + roles; } }

import java.nio.charset.StandardCharsets; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; public class PasswordUtils { public static String encryptPassword(String password) { try { MessageDigest md = MessageDigest.getInstance("SHA-256"); byte[] hash = md.digest(password.getBytes(StandardCharsets.UTF_8)); StringBuilder hexString = new StringBuilder(); for (byte b : hash) { String hex = Integer.toHexString(0xff & b); if (hex.length() == 1) { hexString.append('0'); } hexString.append(hex); } return hexString.toString(); } catch (NoSuchAlgorithmException e) { throw new RuntimeException(e); } } }