@PostMapping("/login")
public String login(HttpSession session, @RequestBody LoginRequest req) {
    User user = userService.verify(req.getUsername(), req.getPassword());
    if (user == null) {
        return "用户名或密码错误";
    }
    session.setAttribute("currentUser", user);  // 存入Session
    return "登录成功";
}

@GetMapping("/info")
public User info(HttpSession session) {
    return (User) session.getAttribute("currentUser");  // 从Session取
}

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "1001",
  "username": "zhangsan",
  "role": "ROLE_USER",
  "iat": 1660123400,
  "exp": 1660125200
}

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.UUID;

public class JwtIssueDemo {

    // 密钥，生产环境至少256位（32字节），从配置文件读取
    private static final String SECRET =
        "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2";

    // 有效期30分钟（毫秒）
    private static final long EXPIRE_MS = 30 * 60 * 1000;

    public static void main(String[] args) {
        // 1. 构建密钥对象
        SecretKey key = Keys.hmacShaKeyFor(SECRET.getBytes(StandardCharsets.UTF_8));

        // 2. 设置Payload中的字段
        Date now = new Date();
        Date expiration = new Date(now.getTime() + EXPIRE_MS);

        String jwt = Jwts.builder()
                // ---- 标准注册声明 ----
                .setId(UUID.randomUUID().toString())   // jti: Token唯一ID
                .setSubject("1001")                     // sub: 用户ID
                .setIssuer("mall-api")                  // iss: 签发者
                .setIssuedAt(now)                       // iat: 签发时间
                .setExpiration(expiration)              // exp: 过期时间

                // ---- 自定义私有声明 ----
                .claim("username", "zhangsan")          // 用户名
                .claim("role", "ROLE_USER")             // 角色

                // ---- 签名 ----
                .signWith(key)                         // HS256 签名

                .compact();  // 生成最终字符串

        System.out.println("生成的JWT:");
        System.out.println(jwt);
        System.out.println("长度: " + jwt.length() + " 字符");
    }
}

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;

public class JwtVerifyDemo {

    private static final String SECRET =
        "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2";

    public static void main(String[] args) {

        // 模拟从请求头中获取的Token
        String token = "eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiI4ZTk2ZjNhOC0xMjM0LTQ1NjctODkwMS1hYmNkZWYxMjM0NTYiLCJzdWIiOiIxMDAxIiwiaXNzIjoibWFsbC1hcGkiLCJpYXQiOjE2NjAxMjM0MDAsImV4cCI6MTY2MDEyNTIwMCwidXNlcm5hbWUiOiJ6aGFuZ3NhbiIsInJvbGUiOiJST0xFX1VTRVIifQ.P8qR2sT5vW7xYzA1bC3dE4fG6hIjK8lM9nO0pQrStUv";

        SecretKey key = Keys.hmacShaKeyFor(SECRET.getBytes(StandardCharsets.UTF_8));

        try {
            // 1. 解析并验证（签名 + 过期时间）
            Claims claims = Jwts.parserBuilder()
                    .setSigningKey(key)
                    .build()
                    .parseClaimsJws(token)
                    .getBody();

            // 2. 从 Payload 中读取字段
            String jti = claims.getId();                      // jti
            String userId = claims.getSubject();              // sub
            String issuer = claims.getIssuer();               // iss
            Date issuedAt = claims.getIssuedAt();             // iat
            Date expiration = claims.getExpiration();         // exp
            String username = claims.get("username", String.class);  // 自定义
            String role = claims.get("role", String.class);         // 自定义

            System.out.println("========== Token 解析成功 ==========");
            System.out.println("jti (Token ID)   : " + jti);
            System.out.println("sub (用户ID)      : " + userId);
            System.out.println("iss (签发者)      : " + issuer);
            System.out.println("iat (签发时间)     : " + issuedAt);
            System.out.println("exp (过期时间)     : " + expiration);
            System.out.println("username (用户名)  : " + username);
            System.out.println("role (角色)       : " + role);

            // 3. 计算剩余有效时间
            long remaining = expiration.getTime() - System.currentTimeMillis();
            System.out.println("剩余有效时间       : " + remaining / 1000 + " 秒");

        } catch (ExpiredJwtException e) {
            System.err.println("Token 已过期！过期时间: " + e.getClaims().getExpiration());
        } catch (JwtException e) {
            System.err.println("Token 无效！原因: " + e.getMessage());
        }
    }
}

public JwtVerifyResult verifyToken(String token) {
    try {
        Claims claims = Jwts.parserBuilder()
                .setSigningKey(key)
                .build()
                .parseClaimsJws(token)
                .getBody();
        return JwtVerifyResult.success(claims);

    } catch (ExpiredJwtException e) {
        return JwtVerifyResult.fail("Token已过期，请刷新或重新登录", 401);
    } catch (SignatureException e) {
        return JwtVerifyResult.fail("Token签名无效，可能被篡改", 401);
    } catch (MalformedJwtException e) {
        return JwtVerifyResult.fail("Token格式错误", 400);
    } catch (JwtException | IllegalArgumentException e) {
        return JwtVerifyResult.fail("Token无效", 401);
    }
}

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;

import javax.crypto.SecretKey;
import java.nio.charset.StandardCharsets;
import java.util.Date;
import java.util.UUID;

public class JwtDualTokenUtil {

    private final SecretKey key;
    private final long accessExpireMs;   // Access Token 过期（毫秒）
    private final long refreshExpireMs;  // Refresh Token 过期（毫秒）

    public JwtDualTokenUtil(String secret,
                            long accessExpireMinutes,
                            long refreshExpireMinutes) {
        this.key = Keys.hmacShaKeyFor(secret.getBytes(StandardCharsets.UTF_8));
        this.accessExpireMs = accessExpireMinutes * 60 * 1000;
        this.refreshExpireMs = refreshExpireMinutes * 60 * 1000;
    }

    /**
     * 生成 Access Token——有效期短，携带完整用户信息
     */
    public String createAccessToken(Long userId, String username, String role) {
        Date now = new Date();
        return Jwts.builder()
                .setId(UUID.randomUUID().toString())
                .setSubject(userId.toString())
                .claim("username", username)
                .claim("role", role)
                .claim("type", "access")           // 标记类型
                .setIssuedAt(now)
                .setExpiration(new Date(now.getTime() + accessExpireMs))
                .signWith(key)
                .compact();
    }

    /**
     * 生成 Refresh Token——有效期长，只携带必要信息
     */
    public String createRefreshToken(Long userId) {
        Date now = new Date();
        return Jwts.builder()
                .setId(UUID.randomUUID().toString())
                .setSubject(userId.toString())
                .claim("type", "refresh")          // 标记类型
                .setIssuedAt(now)
                .setExpiration(new Date(now.getTime() + refreshExpireMs))
                .signWith(key)
                .compact();
    }

    /**
     * 解析 Token（不对type做校验）
     */
    public Claims parseToken(String token) {
        return Jwts.parserBuilder()
                .setSigningKey(key)
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    /**
     * 判断是否为 Access Token
     */
    public boolean isAccessToken(Claims claims) {
        return "access".equals(claims.get("type", String.class));
    }

    /**
     * 判断是否为 Refresh Token
     */
    public boolean isRefreshToken(Claims claims) {
        return "refresh".equals(claims.get("type", String.class));
    }

    // ---- 便捷读取方法 ----
    public String getJti(Claims claims) {
        return claims.getId();
    }

    public Long getUserId(Claims claims) {
        return Long.valueOf(claims.getSubject());
    }

    public String getUsername(Claims claims) {
        return claims.get("username", String.class);
    }

    public String getRole(Claims claims) {
        return claims.get("role", String.class);
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final JwtDualTokenUtil jwtUtil;
    private final UserService userService;

    public AuthController(JwtDualTokenUtil jwtUtil, UserService userService) {
        this.jwtUtil = jwtUtil;
        this.userService = userService;
    }

    /**
     * 登录：返回 Access Token + Refresh Token
     */
    @PostMapping("/login")
    public ResponseEntity<LoginResponse> login(
            @Valid @RequestBody LoginRequest request) {

        // 1. 验证用户名密码
        User user = userService.verify(request.getUsername(), request.getPassword());
        if (user == null) {
            return ResponseEntity.status(401)
                    .body(LoginResponse.fail("用户名或密码错误"));
        }

        // 2. 生成双 Token
        String accessToken = jwtUtil.createAccessToken(
                user.getId(), user.getUsername(), user.getRole());
        String refreshToken = jwtUtil.createRefreshToken(user.getId());

        // 3. （可选）将 Refresh Token 存入 Redis，用于后续撤销
        // refreshTokenService.store(user.getId(), refreshToken);

        return ResponseEntity.ok(LoginResponse.builder()
                .accessToken(accessToken)
                .refreshToken(refreshToken)
                .tokenType("Bearer")
                .accessTokenExpire(30 * 60)      // 30分钟（秒）
                .refreshTokenExpire(7 * 24 * 3600) // 7天（秒）
                .build());
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    // ... 登录方法同上 ...

    /**
     * 刷新Token：用RefreshToken换取新的AccessToken + RefreshToken
     */
    @PostMapping("/refresh")
    public ResponseEntity<LoginResponse> refresh(
            @Valid @RequestBody RefreshRequest request) {

        String refreshToken = request.getRefreshToken();

        // 1. 解析 Refresh Token（验证签名 + 过期）
        Claims claims;
        try {
            claims = jwtUtil.parseToken(refreshToken);
        } catch (ExpiredJwtException e) {
            return ResponseEntity.status(401)
                    .body(LoginResponse.fail("Refresh Token已过期，请重新登录"));
        } catch (JwtException e) {
            return ResponseEntity.status(401)
                    .body(LoginResponse.fail("Refresh Token无效"));
        }

        // 2. 必须是Refresh Token类型（防止用Access Token来刷新）
        if (!jwtUtil.isRefreshToken(claims)) {
            return ResponseEntity.status(400)
                    .body(LoginResponse.fail("请使用Refresh Token刷新，不支持Access Token"));
        }

        // 3. （可选）检查RefreshToken是否在Redis白名单中
        // if (!refreshTokenService.isValid(jwtUtil.getJti(claims))) {
        //     return ResponseEntity.status(401)
        //             .body(LoginResponse.fail("Refresh Token已被撤销，请重新登录"));
        // }

        // 4. 从数据库查询用户最新信息（角色可能已变更）
        Long userId = jwtUtil.getUserId(claims);
        User user = userService.findById(userId);

        // 5. 签发新的双 Token
        String newAccessToken = jwtUtil.createAccessToken(
                user.getId(), user.getUsername(), user.getRole());
        String newRefreshToken = jwtUtil.createRefreshToken(user.getId());

        // 6. （可选）旧的 Refresh Token 失效，新的写入 Redis
        // refreshTokenService.replace(jwtUtil.getJti(claims), newRefreshToken);

        return ResponseEntity.ok(LoginResponse.builder()
                .accessToken(newAccessToken)
                .refreshToken(newRefreshToken)
                .tokenType("Bearer")
                .accessTokenExpire(30 * 60)
                .refreshTokenExpire(7 * 24 * 3600)
                .build());
    }
}

@Component
public class JwtInterceptor implements HandlerInterceptor {

    private final JwtDualTokenUtil jwtUtil;

    public JwtInterceptor(JwtDualTokenUtil jwtUtil) {
        this.jwtUtil = jwtUtil;
    }

    @Override
    public boolean preHandle(HttpServletRequest request,
                             HttpServletResponse response,
                             Object handler) throws Exception {

        // 1. 从请求头提取 Token
        String token = extractToken(request);
        if (token == null) {
            sendError(response, 401, "请先登录");
            return false;
        }

        // 2. 解析并验证
        Claims claims;
        try {
            claims = jwtUtil.parseToken(token);
        } catch (ExpiredJwtException e) {
            sendError(response, 401, "Token已过期，请刷新");
            return false;
        } catch (JwtException e) {
            sendError(response, 401, "Token无效");
            return false;
        }

        // 3. 必须是 Access Token
        if (!jwtUtil.isAccessToken(claims)) {
            sendError(response, 400, "请使用Access Token访问接口");
            return false;
        }

        // 4. 将用户信息存入 request 属性，Controller 可以直接读取
        request.setAttribute("userId", jwtUtil.getUserId(claims));
        request.setAttribute("username", jwtUtil.getUsername(claims));
        request.setAttribute("role", jwtUtil.getRole(claims));

        return true;
    }

    private String extractToken(HttpServletRequest request) {
        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            return header.substring(7);
        }
        return null;
    }

    private void sendError(HttpServletResponse response,
                           int status, String message) throws Exception {
        response.setContentType("application/json;charset=UTF-8");
        response.setStatus(status);
        response.getWriter().write(
            String.format("{\"code\":%d,\"message\":\"%s\"}", status, message));
    }
}

public class ApiClient {

    private String accessToken;
    private String refreshToken;

    private final JwtDualTokenUtil jwtUtil;
    private final RestTemplate restTemplate;

    /**
     * 发送带自动刷新的 GET 请求
     */
    public <T> T getWithAuth(String url, Class<T> responseType) {
        try {
            // 第一次尝试
            return doGet(url, responseType);
        } catch (TokenExpiredException e) {
            // Access Token 过期 → 刷新 → 重试
            boolean refreshed = refreshAccessToken();
            if (refreshed) {
                return doGet(url, responseType);  // 重试
            } else {
                throw new RuntimeException("Token刷新失败，请重新登录");
            }
        }
    }

    /**
     * 实际发送请求
     */
    private <T> T doGet(String url, Class<T> responseType) {
        HttpHeaders headers = new HttpHeaders();
        headers.set("Authorization", "Bearer " + accessToken);

        ResponseEntity<T> response = restTemplate.exchange(
                url, HttpMethod.GET,
                new HttpEntity<>(headers), responseType);

        if (response.getStatusCode() == HttpStatus.UNAUTHORIZED) {
            throw new TokenExpiredException();
        }
        return response.getBody();
    }

    /**
     * 使用 Refresh Token 获取新的 Access Token
     */
    private boolean refreshAccessToken() {
        try {
            HttpHeaders headers = new HttpHeaders();
            headers.setContentType(MediaType.APPLICATION_JSON);

            Map<String, String> body = Map.of("refreshToken", refreshToken);

            ResponseEntity<LoginResponse> response = restTemplate.exchange(
                    "/api/auth/refresh", HttpMethod.POST,
                    new HttpEntity<>(body, headers), LoginResponse.class);

            if (response.getStatusCode() == HttpStatus.OK) {
                LoginResponse resp = response.getBody();
                this.accessToken = resp.getAccessToken();
                this.refreshToken = resp.getRefreshToken();
                return true;
            }
        } catch (Exception e) {
            // Refresh Token 也过期了 → 需要重新登录
        }
        return false;
    }

    // 内部异常类
    private static class TokenExpiredException extends RuntimeException {}
}

// 服务端设置 Refresh Token Cookie
@PostMapping("/login")
public ResponseEntity<LoginResponse> login(...) {
    // ... 生成 Token ...

    // 将 Refresh Token 设入 HttpOnly Cookie
    ResponseCookie cookie = ResponseCookie.from("refreshToken", refreshToken)
            .httpOnly(true)           // JS 不可读
            .secure(true)             // 仅 HTTPS
            .sameSite("Strict")       // 防止 CSRF
            .path("/api/auth")        // 仅 /api/auth 路径下发送
            .maxAge(7 * 24 * 3600)   // 7天
            .build();

    return ResponseEntity.ok()
            .header(HttpHeaders.SET_COOKIE, cookie.toString())
            .body(response);  // Access Token 放在 Body 中返回
}