前后端登录Token存储方案

1
@Override
2
public LoginResponse login(LoginRequest request) {
3
    LoginUser loginUser = authenticate(request);
4
    SysUserApi user = loginUser.getSysUser();
5
    Long userId = user.getId();
6

7
    // 1. 生成 Access Token
8
    Map<String, Object> accessClaims = new HashMap<>();
9
    accessClaims.put(SecurityConstants.USER_ID, userId);
10
    accessClaims.put(SecurityConstants.USER_NAME, user.getUserName());
11
    accessClaims.put(SecurityConstants.NICK_NAME, user.getNickName());
12
    accessClaims.put(SecurityConstants.TOKEN_TYPE, SecurityConstants.TOKEN_TYPE_ACCESS);
13
    String accessToken = JwtUtils.createToken(accessClaims);
14

15
    // 2. 生成 Refresh Token
16
    Map<String, Object> refreshClaims = new HashMap<>();
17
    refreshClaims.put(SecurityConstants.USER_ID, userId);
18
    refreshClaims.put(SecurityConstants.TOKEN_TYPE, SecurityConstants.TOKEN_TYPE_REFRESH);
19
    String refreshToken = JwtUtils.createToken(refreshClaims);
20

21
    // 3. 写入 Redis 白名单，限制最多 5 个设备
22
    String accessTokenKey = CacheConstants.CACHE_LOGIN_TOKEN + userId;
23
    String refreshTokenKey = CacheConstants.CACHE_LOGIN_REFRESH + userId;
24
    storeTokenWithLimit(accessTokenKey, accessToken,
25
            SecurityConstants.TOKEN_EXPIRE, TimeUnit.MINUTES, 5);
26
    storeTokenWithLimit(refreshTokenKey, refreshToken,
27
            SecurityConstants.REFRESH_TOKEN_EXPIRE, TimeUnit.DAYS, 5);
28

29
    // 4. 缓存角色权限
30
    cacheRolesAndPermissions(userId, loginUser);
31

32
    // 5. 通过 HttpOnly Cookie 下发
33
    response.addCookie(buildCookie(
34
            SecurityConstants.ACCESS_TOKEN_COOKIE, accessToken,
35
            SecurityConstants.TOKEN_EXPIRE * 60, true, true, "Lax"));
36
    response.addCookie(buildCookie(
37
            SecurityConstants.REFRESH_TOKEN_COOKIE, refreshToken,
38
            (int) SecurityConstants.REFRESH_TOKEN_EXPIRE * 24 * 60 * 60, true, true, "Lax"));
39

40
    // 6. 返回用户信息（不含 Token）
41
    return LoginResponse.builder()
42
            .userId(user.getId())
43
            .username(user.getUserName())
44
            .nickname(user.getNickName())
45
            .avatar(user.getAvatar())
46
            .expiresIn(SecurityConstants.TOKEN_EXPIRE * 60L)
47
            .build();
48
}

1
@Override
2
public RefreshResponse refreshAccessToken(String refreshToken) {
3
    // 1. 解析并校验 Token 类型
4
    Claims claims = JwtUtils.parseToken(refreshToken);
5
    String tokenType = claims.get(SecurityConstants.TOKEN_TYPE, String.class);
6
    if (!SecurityConstants.TOKEN_TYPE_REFRESH.equals(tokenType)) {
7
        throw new AuthException(ResultCode.TOKEN_INVALID);
8
    }
9

10
    Long userId = JwtUtils.getUserIdAsLong(refreshToken);
11

12
    // 2. 校验 Refresh Token 是否在白名单
13
    String refreshTokenKey = CacheConstants.CACHE_LOGIN_REFRESH + userId;
14
    Boolean isMember = redisService.isMemberOfSet(refreshTokenKey, refreshToken);
15
    if (Boolean.FALSE.equals(isMember)) {
16
        throw new AuthException(ResultCode.REFRESH_TOKEN_EXPIRED);
17
    }
18

19
    // 3. 生成新 Access Token
20
    Map<String, Object> accessClaims = new HashMap<>();
21
    accessClaims.put(SecurityConstants.USER_ID, userId);
22
    accessClaims.put(SecurityConstants.USER_NAME, claims.get(SecurityConstants.USER_NAME));
23
    accessClaims.put(SecurityConstants.NICK_NAME, claims.get(SecurityConstants.NICK_NAME));
24
    accessClaims.put(SecurityConstants.TOKEN_TYPE, SecurityConstants.TOKEN_TYPE_ACCESS);
25
    String newAccessToken = JwtUtils.createToken(accessClaims);
26

27
    // 4. 存储新 Access Token 并更新 TTL
28
    String accessTokenKey = CacheConstants.CACHE_LOGIN_TOKEN + userId;
29
    storeTokenWithLimit(accessTokenKey, newAccessToken,
30
            SecurityConstants.TOKEN_EXPIRE, TimeUnit.MINUTES, 5);
31

32
    // 5. 刷新 Refresh Token 与角色权限的过期时间
33
    redisService.expire(refreshTokenKey, SecurityConstants.REFRESH_TOKEN_EXPIRE, TimeUnit.DAYS);
34
    redisService.expire(CacheConstants.CACHE_LOGIN_ROLES + userId,
35
            SecurityConstants.REFRESH_TOKEN_EXPIRE, TimeUnit.DAYS);
36
    redisService.expire(CacheConstants.CACHE_LOGIN_PERMISSIONS + userId,
37
            SecurityConstants.REFRESH_TOKEN_EXPIRE, TimeUnit.DAYS);
38

39
    // 6. 通过 Cookie 下发新 Access Token
40
    response.addCookie(buildCookie(
41
            SecurityConstants.ACCESS_TOKEN_COOKIE, newAccessToken,
42
            SecurityConstants.TOKEN_EXPIRE * 60, true, true, "Lax"));
43

44
    return new RefreshResponse(SecurityConstants.TOKEN_EXPIRE * 60L);
45
}

1
private String getToken(ServerHttpRequest request) {
2
    // 1. 优先从 Authorization Header 获取（API 调用 / App 场景）
3
    String token = request.getHeaders().getFirst(SecurityConstants.AUTHORIZATION_HEADER);
4
    if (StringUtils.isNotEmpty(token) && token.startsWith(SecurityConstants.TOKEN_PREFIX)) {
5
        return token.replace(SecurityConstants.TOKEN_PREFIX, "");
6
    }
7

8
    // 2. 回退从 Cookie 获取（浏览器 / OAuth 回调场景）
9
    HttpCookie cookie = request.getCookies().getFirst(SecurityConstants.ACCESS_TOKEN_COOKIE);
10
    if (cookie != null && StringUtils.isNotEmpty(cookie.getValue())) {
11
        return cookie.getValue();
12
    }
13

14
    return null;
15
}

1
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
2
    ServerHttpRequest request = exchange.getRequest();
3
    String token = getToken(request);
4

5
    // 1. 验签
6
    Claims claims = JwtUtils.parseToken(token);
7

8
    // 2. 校验 token_type，防止 Refresh Token 被用于访问 API
9
    String tokenType = claims.get(SecurityConstants.TOKEN_TYPE, String.class);
10
    if (!SecurityConstants.TOKEN_TYPE_ACCESS.equals(tokenType)) {
11
        return unauthorizedResponse(exchange, ResultCode.TOKEN_INVALID);
12
    }
13

14
    // 3. 查 Redis 白名单
15
    String userId = claims.get(SecurityConstants.USER_ID).toString();
16
    String tokenKey = CacheConstants.CACHE_LOGIN_TOKEN + userId;
17
    Boolean isMember = redisService.isMemberOfSet(tokenKey, token);
18
    if (Boolean.FALSE.equals(isMember)) {
19
        return unauthorizedResponse(exchange, ResultCode.TOKEN_EXPIRED);
20
    }
21

22
    // 4. 注入用户信息到 Header
23
    ServerHttpRequest mutatedRequest = request.mutate()
24
            .header(SecurityConstants.USER_ID, userId)
25
            .header(SecurityConstants.USER_NAME, claims.get(SecurityConstants.USER_NAME, String.class))
26
            .header(SecurityConstants.ROLES_HEADER, getRolesFromRedis(userId))
27
            .build();
28

29
    return chain.filter(exchange.mutate().request(mutatedRequest).build());
30
}

1
import { defineStore } from "pinia";
2
import { ref, computed } from "vue";
3

4
export interface UserInfo {
5
  userId: number;
6
  username: string;
7
  nickname: string;
8
  avatar: string;
9
  roles: string[];
10
  permissions: string[];
11
}
12

13
export const useUserStore = defineStore("user", () => {
14
  const userId = ref<number | null>(null);
15
  const username = ref("");
16
  const nickname = ref("");
17
  const avatar = ref("");
18
  const roles = ref<string[]>([]);
19
  const permissions = ref<string[]>([]);
20

21
  const isLoggedIn = computed(() => userId.value !== null);
22
  const isAdmin = computed(() => roles.value.includes("admin"));
23

24
  function setUserInfo(info: UserInfo) {
25
    userId.value = info.userId;
26
    username.value = info.username;
27
    nickname.value = info.nickname;
28
    avatar.value = info.avatar;
29
    roles.value = info.roles ?? [];
30
    permissions.value = info.permissions ?? [];
31
  }
32

33
  function hasPermission(permission: string): boolean {
34
    if (isAdmin.value) return true;
35
    return permissions.value.includes(permission);
36
  }
37

38
  function clear() {
39
    userId.value = null;
40
    username.value = "";
41
    nickname.value = "";
42
    avatar.value = "";
43
    roles.value = [];
44
    permissions.value = [];
45
  }
46

47
  return {
48
    userId,
49
    username,
50
    nickname,
51
    avatar,
52
    roles,
53
    permissions,
54
    isLoggedIn,
55
    isAdmin,
56
    setUserInfo,
57
    hasPermission,
58
    clear,
59
  };
60
});

1
import axios, { type InternalAxiosRequestConfig } from "axios";
2
import { useUserStore } from "@/stores/user";
3

4
let isRefreshing = false;
5
let pendingRequests: Array<() => void> = [];
6

7
const api = axios.create({
8
  baseURL: "/api",
9
  withCredentials: true,
10
});
11

12
api.interceptors.response.use(
13
  (response) => response,
14
  async (error) => {
15
    const originalRequest = error.config as InternalAxiosRequestConfig & {
16
      _retry?: boolean;
17
    };
18

19
    if (error.response?.status !== 401 || originalRequest._retry) {
20
      return Promise.reject(error);
21
    }
22

23
    const errorCode = error.response.data?.code;
24
    const userStore = useUserStore();
25

26
    // Access Token 过期，尝试刷新
27
    if (errorCode === 10301) {
28
      if (!isRefreshing) {
29
        isRefreshing = true;
30
        try {
31
          await axios.post("/auth/refresh", null, { withCredentials: true });
32
          isRefreshing = false;
33
          pendingRequests.forEach((cb) => cb());
34
          pendingRequests = [];
35
          return api(originalRequest);
36
        } catch {
37
          isRefreshing = false;
38
          pendingRequests = [];
39
          userStore.clear();
40
          window.location.href = "/login";
41
          return Promise.reject(error);
42
        }
43
      }
44

45
      return new Promise<void>((resolve) => {
46
        pendingRequests.push(() => {
47
          resolve(api(originalRequest));
48
        });
49
      });
50
    }
51

52
    // Refresh Token 过期，强制重新登录
53
    if (errorCode === 10311) {
54
      userStore.clear();
55
      window.location.href = "/login";
56
    }
57

58
    return Promise.reject(error);
59
  }
60
);

1
server {
2
    listen 443 ssl http2;
3
    server_name api.zsk.com;
4

5
    location / {
6
        proxy_pass http://zsk-gateway;
7
        proxy_set_header Host $host;
8
        proxy_set_header X-Real-IP $remote_addr;
9
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
10
        proxy_set_header X-Forwarded-Proto $scheme;
11

12
        # 允许跨域携带 Cookie
13
        add_header Access-Control-Allow-Credentials "true" always;
14
        add_header Access-Control-Allow-Origin "https://www.zsk.com" always;
15
    }
16
}