关于Token在Android中实现用户登录的使用

原理

在安卓中实现用户登录一般都是用Token，而目前最流行的就是用jwt先讲一下实现的原理：第一步：用户第一次登录，客户端向服务端发送用户和密码，服务端验证用户密码是否正确，如果不正确返回客户端一个消息（用户名错误或者密码错误），如果正确，服务端生成一个Token，并且缓存起来（可以用Redis或者存放数据库）。第二步：客户端接收服务端发送的Token和登陆成功的标识，并且把Token也保存起来，并跳转到登录成功后的页面。第三步：登陆成功后有其他向服务端请求数据的请求，一律在请求头部携带客户端保存的Token，服务端验证这些请求携带的Token是否过期或者不对，正常就返回正常的数据，失败就返回验证Token失败的信息，客服端接收失败的信息提示用户重新登陆，并跳转到登录页。

流程图

前台

第一步：用户第一次登录，客户端向服务端发送用户和密码，

try{
            String loginurl = getString(R.string.url2) + "login";

                //自己写的工具类
            YyHttpRequestOrGetDataFromNet yyHttpRequestOrGetDataFromNet = new YyHttpRequestOrGetDataFromNet();
//以下采用的是将accountid和credential放到JsonObject对象中，
// 因为后台/login设置的参数是一个user对象
                JSONObject jsonParam = new JSONObject();
                jsonParam.put("credential", password);
                jsonParam.put("accountid", accountid);
//                System.out.println("token："+yyHttpRequestOrGetDataFromNet.doPost(loginurl,jsonParam));
//把第一次登录服务器生成的Token存在本地

// json格式化
                jsonLoginningInfo = yyHttpRequestOrGetDataFromNet.doPost(loginurl,jsonParam);
                Gson gson = new Gson();
                jsonRootBean = gson.fromJson(jsonLoginningInfo,new TypeToken<JsonRootBean>(){}.getType());
//token 存储

                YySharedPrefUtility.setParam(LoginActivity.this,YySharedPrefUtility.Token,
                        jsonRootBean.getContent().getToken());
                System.out.println("tokrn:"+jsonRootBean.getContent().getToken());
                System.out.println("tokrn:"+jsonRootBean.getMsg());


            }
            catch (Exception e){ e.printStackTrace();}

            //密码正确：服务端返回1
            if (jsonRootBean.getStatus()==0&&jsonRootBean.getMsg().equals("loginSuccess")) {
                Toast.makeText(this, "登陆成功", Toast.LENGTH_SHORT).show();
                YySharedPrefUtility.setParam(LoginActivity.this,
                        YySharedPrefUtility.ACCOUNTID, accountid);//用户名存起来
                startActivity(new Intent(getApplicationContext(), MainActivity.class));//登录成功跳转首页

            }
            //用户名不存在或密码错误：服务端返回-1
            else {
                Toast.makeText(this, "用户名不存在或密码不正确", Toast.LENGTH_SHORT).show();
            }

这是我改动的工具类

post请求：

public String doPost(String url, JSONObject jsonParam) throws Exception {

        /* Translate parameter map to parameter date string */

        System.out.println("POST parameter : " + jsonParam.toString());
//以下两行代码非常有用，是网络连接一个严格的格式
        //原文博客见https://blog.csdn.net/yuan882696yan/article/details/38419219
        StrictMode.ThreadPolicy policy=new StrictMode.ThreadPolicy.Builder().permitAll().build();
        StrictMode.setThreadPolicy(policy);
    //创建URL连接
        URL localURL = new URL(url);

        URLConnection connection = this.openConnection(localURL);
        HttpURLConnection httpURLConnection = (HttpURLConnection) connection;
        httpURLConnection.setDoOutput(true);
        httpURLConnection.setRequestMethod("POST");//请求方法为Post
        httpURLConnection.setRequestProperty("Accept-Charset", charset);
        httpURLConnection.setRequestProperty("Content-Type", "application/json");
        httpURLConnection.setUseCaches(false);//post不能设置缓存


        OutputStream outputStream = null;
        OutputStreamWriter outputStreamWriter = null;
        InputStream inputStream = null;
        InputStreamReader inputStreamReader = null;
        BufferedReader reader = null;
        StringBuffer resultBuffer = new StringBuffer();
        String tempLine = null;

        try {
            outputStream = httpURLConnection.getOutputStream();
            outputStreamWriter = new OutputStreamWriter(outputStream);
            //这个地方最关键，将登录传过来的账户和密码
            outputStreamWriter.write(jsonParam.toString());
            outputStreamWriter.flush();
           //判断请求是否成功
            if (httpURLConnection.getResponseCode() >= 300) {
                throw new Exception("HTTP Request is not success, Response code is " + httpURLConnection.getResponseCode());
            }
            //接收响应流
            inputStream = httpURLConnection.getInputStream();
            inputStreamReader = new InputStreamReader(inputStream);
            reader = new BufferedReader(inputStreamReader);

            while ((tempLine = reader.readLine()) != null) {
                resultBuffer.append(tempLine);
            }

        } finally {

            if (outputStreamWriter != null) {
                outputStreamWriter.close();
            }

            if (outputStream != null) {
                outputStream.close();
            }

            if (reader != null) {
                reader.close();
            }

            if (inputStreamReader != null) {
                inputStreamReader.close();
            }

            if (inputStream != null) {
                inputStream.close();
            }

        }

        return resultBuffer.toString();//返回数据
    }

get请求：

//获取JSON数据流数据
    public static String doGetJsonStringFromThread(final String u,final String token) {
        Thread newThread;
        newThread = new Thread(new Runnable() {

            @Override
            public void run() {

                //创建url对象
                URL url = null;
                try {
                    //实例化url
                    url = new URL(u);
                    //获取HttpURLConnection
                    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
                    //设置get请求
                    connection.setRequestMethod("GET");
                    //设置超时时间
                    connection.setConnectTimeout(5 * 1000);
                    //设置编码
                    connection.setRequestProperty("contentType", "utf-8");
                    //注意，最重要的地方，通过setRequestProperty把Token放到请求头
                    connection.setRequestProperty("token",token);
                    //连接
                    connection.connect();
                    //获取连接响应码
                    int code = connection.getResponseCode();

                    //响应失败
                    if (code >= 300) {
                        throw new Exception("HTTP Request is not success, Response code is " + code);
                    }
                    //如果连接上
                    if (code == 200) {

//                        h.sendEmptyMessage(2);
                        //获取数据
                        InputStream inputStream = connection.getInputStream();
                        BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(inputStream));
                        String line;

                        StringBuffer buffer = new StringBuffer();
                        while ((line = bufferedReader.readLine()) != null) {
                            buffer.append(line);

                        }
                        //获取json
                        jsonBuffer = buffer.toString();
                        //关闭is
                        inputStream.close();
                    }
                    //关闭连接
                    connection.disconnect();

                } catch (Exception e) {
                    e.printStackTrace();
                }
            }
        });
        newThread.start(); //启动线程
        try {
            //join方法：让主线程等待子线程运行结束后再继续运行
            newThread.join();
        } catch (InterruptedException e) {
            e.printStackTrace();
        }
        return jsonBuffer;
    }

后台

1.拦截器:客户端每像服务端发送请求都要在这里接受一下验证，如果Token失效或者是伪造的Token都会验证出来返回客户端错误的信息

public class JWTInterceptor implements HandlerInterceptor{
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws IOException{
		// TODO Auto-generated method stub
	
   	 String token = request.getHeader("token");

    	try{
        	JWTUtils.verify(token);
       	 return true;
   	 }catch (Exception e){
    		JsonRootBean sJsonBaseObject=new JsonRootBean(); 
    		sJsonBaseObject.setMsg("令牌验证失败");
    		sJsonBaseObject.setStatus(-1);
        	ObjectMapper objectMapper = new ObjectMapper();
       	    String result = objectMapper.writerWithDefaultPrettyPrinter().writeValueAsString(sJsonBaseObject);
        	response.setContentType("application/json;charset=UTF-8");
        	response.getWriter().println(result);

        	return false;
    	}
	}
}

2.jwt工具类

public class JWTUtils {
     token密钥(自定义),最好在网上在线生成一个随机字符串，我这里是瞎打的
    //这个密钥一定不能泄露
	private static final String SING = "!@#$%%^&&*####%%%$%";
    //生成Token
	public static String getToken(Map<String,String> map){
    	Calendar instance = Calendar.getInstance();
    	instance.add(Calendar.HOUR,5);
    	JWTCreator.Builder builder = JWT.create();
    	map.forEach((k,v)->{
        	builder.withClaim(k,v);
    	});
    	String token = builder.withExpiresAt(instance.getTime())
            	.sign(Algorithm.HMAC256(SING));

    	return token;
	}
//根据密钥生成JWT效验器
	public static void verify(String token){//解析Token
    	JWT.require(Algorithm.HMAC256(SING)).build().verify(token);
	}
//效验TOKEN
	public static DecodedJWT getTokenInfo(String token){
    	return JWT.require(Algorithm.HMAC256(SING)).build().verify(token);
	}
	}

3.spring.mvc 写在标签的最外面,因为客户端要通过/login来获取Token，所以不能被拦截

<!-- 配置拦截器,验证Token -->
  <mvc:interceptors>
		<mvc:interceptor>
			<!-- 拦截所有/目录下面的页面 -->
			<mvc:mapping path="/**"/>
			<!-- mvc:exclude-mapping是另外一种拦截，它可以在你后来的测试中对某个页面进行不拦截 -->
			<mvc:exclude-mapping path="/login" />
			<bean class="com.yunyou.DBI.interceptor.JWTInterceptor"></bean>			
		</mvc:interceptor>
	</mvc:interceptors>

4.controller层

其他等等服务层，实体类就没必要给出来了，这里给了一个控制层

@Controller
public class UserLoginningInfoController {
	@Autowired
	private UserLoginningInfoService uService;
@RequestMapping(value="login",method=RequestMethod.POST)
	@ResponseBody
	public JsonRootBean login(@RequestBody v_U_userLoginning_info user) {
		System.out.println("user"+user.getAccountid()+" "+user.getCredential());
		JsonRootBean uJsonBaseObject = new JsonRootBean();
		v_U_userLoginning_info us = uService.findUserByPassword(
				user.getAccountid(), user.getCredential());
		if(us==null) {
			uJsonBaseObject.setMsg("loginError");
			uJsonBaseObject.setStatus(-1);
			return uJsonBaseObject;
		}
		HashMap<String,String> payload = new HashMap<String,String>();
		payload.put("accountid", us.getAccountid());
		String token = JWTUtils.getToken(payload);
		LoginToken loginToken = new LoginToken();
		loginToken.setToken(token);
		uJsonBaseObject.setContent(loginToken);
		uJsonBaseObject.setMsg("loginSuccess");
		return uJsonBaseObject;
	}

最后就可以啦