SAST-ReadTrack项目练习

@Override
@Transactional
public boolean updateReadProgress(Long bookId, Integer currentPage, Long userId) {
    if (currentPage == null  currentPage < 0) {
        throw new RuntimeException("页数不合法，请重试");
    }

    Book book = new Book();
    book.setId(bookId);
    book.setUserId(userId);
    book.setCurrentPage(currentPage);

    return bookMapper.updateReadProgress(book) > 0;
}

package com.sast.sastreadtrack.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    // 配置访问权限和禁用默认登录页
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf().disable()  // 关闭CSRF保护，前后端分离或者Postman测试可以关闭
                .authorizeRequests()
                .antMatchers("/api/user/login", "/api/user/register").permitAll() // 登录注册接口放行
                .anyRequest().authenticated() // 其他接口需要认证
                .and()
                .httpBasic().disable(); // 禁用默认Spring Security弹窗登录
        return http.build();
    }

    // 提供 BCrypt 密码加密器
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

<!-- JWT: JSON Web Token，用于鉴权 -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

package com.sast.sastreadtrack.util;

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;

import java.security.Key;
import java.util.Date;

public class JwtUtil {

    // 建议使用安全随机生成的密钥，演示用简单字符串（长度至少 32）
    private static final String SECRET_KEY = "sastreadtrack-secret-key-2025-super-safe";

    // Token 有效时间（毫秒）——例如 1 天
    private static final long EXPIRATION_TIME = 24 * 60 * 60 * 1000;

    private static Key getSigningKey() {
        return Keys.hmacShaKeyFor(SECRET_KEY.getBytes());
    }

    /** 生成 JWT Token */
    public static String generateToken(Long userId, String username) {
        return Jwts.builder()
                .setSubject(username)
                .claim("userId", userId)
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME))
                .signWith(getSigningKey(), SignatureAlgorithm.HS256)
                .compact();
    }

    /** 验证 Token 是否有效 */
    public static boolean validateToken(String token) {
        try {
            Jwts.parserBuilder()
                    .setSigningKey(getSigningKey())
                    .build()
                    .parseClaimsJws(token);
            return true;
        } catch (JwtException e) {
            return false; // 过期、伪造等都属于无效
        }
    }

    /** 从 Token 中获取用户ID */
    public static Long getUserIdFromToken(String token) {
        Claims claims = Jwts.parserBuilder()
                .setSigningKey(getSigningKey())
                .build()
                .parseClaimsJws(token)
                .getBody();
        return claims.get("userId", Long.class);
    }

    /** 从 Token 中获取用户名 */
    public static String getUsernameFromToken(String token) {
        Claims claims = Jwts.parserBuilder()
                .setSigningKey(getSigningKey())
                .build()
                .parseClaimsJws(token)
                .getBody();
        return claims.getSubject();
    }
}

header.payload.signature

package com.sast.sastreadtrack.filter;

import com.sast.sastreadtrack.util.JwtUtil;
import io.jsonwebtoken.JwtException;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@Component
public class JwtFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        String authHeader = httpRequest.getHeader("Authorization");

        // 登录接口不拦截
        String path = httpRequest.getRequestURI();
        if (path.startsWith("/api/user/login")  path.startsWith("/api/user/register")) {
            chain.doFilter(request, response);
            return;
        }

        if (authHeader == null  !authHeader.startsWith("Bearer ")) {
            httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            httpResponse.getWriter().write("缺少或无效的 Token");
            return;
        }

        String token = authHeader.substring(7);
        try {
            if (!JwtUtil.validateToken(token)) {
                httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                httpResponse.getWriter().write("Token 无效或已过期");
                return;
            }
            // ✅ 验证通过，放行
            chain.doFilter(request, response);

        } catch (JwtException e) {
            httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            httpResponse.getWriter().write("Token 校验失败");
        }
    }
}

private Long getUserIdFromToken(String authHeader) {
        if (authHeader == null  !authHeader.startsWith("Bearer ")) {
            throw new RuntimeException("缺少或无效的 Token");
        }
        String token = authHeader.substring(7);
        return JwtUtil.getUserIdFromToken(token);
    }