OAuth2.0与JWT安全实战：认证授权的正确打开方式

@Configuration
@EnableAuthorizationServer
public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
    
    @Autowired
    private AuthenticationManager authenticationManager;
    
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Bean
    public JwtTokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }
    
    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        // 生产环境使用RSA密钥对
        KeyPair keyPair = new KeyStoreKeyFactory(
            new ClassPathResource("keystore.jks"),
            "password".toCharArray()
        ).getKeyPair("jwt");
        converter.setKeyPair(keyPair);
        return converter;
    }
    
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
        endpoints
            .tokenStore(tokenStore())
            .accessTokenConverter(accessTokenConverter())
            .authenticationManager(authenticationManager)
            .userDetailsService(userDetailsService)
            // Token增强器
            .tokenEnhancer(tokenEnhancerChain());
    }
    
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients.inMemory()
            .withClient("web-app")
            .secret(passwordEncoder.encode("secret"))
            .authorizedGrantTypes("authorization_code", "refresh_token")
            .scopes("read", "write")
            .redirectUris("https://web.example.com/callback")
            .accessTokenValiditySeconds(3600)  // 1小时
            .refreshTokenValiditySeconds(86400); // 24小时
    }
    
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) {
        security
            .tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()")
            .allowFormAuthenticationForClients();
    }
    
    @Bean
    public TokenEnhancerChain tokenEnhancerChain() {
        TokenEnhancerChain chain = new TokenEnhancerChain();
        chain.setTokenEnhancers(Arrays.asList(
            customTokenEnhancer(),
            accessTokenConverter()
        ));
        return chain;
    }
    
    @Bean
    public TokenEnhancer customTokenEnhancer() {
        return (accessToken, authentication) -> {
            Map<String, Object> additionalInfo = new HashMap<>();
            CustomUserDetails user = (CustomUserDetails) authentication.getPrincipal();
            additionalInfo.put("user_id", user.getId());
            additionalInfo.put("roles", user.getRoles());
            ((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(additionalInfo);
            return accessToken;
        };
    }
}

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    
    @Value("${security.oauth2.resource.jwt.key-uri}")
    private String keyUri;
    
    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }
    
    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        // 从授权服务器获取公钥
        RestTemplate restTemplate = new RestTemplate();
        Map<String, String> key = restTemplate.getForObject(keyUri, Map.class);
        converter.setVerifierKey(key.get("value"));
        return converter;
    }
    
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources
            .resourceId("api")
            .tokenStore(tokenStore())
            .stateless(true);
    }
    
    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .antMatchers("/api/public/**").permitAll()
            .antMatchers("/api/admin/**").hasRole("ADMIN")
            .antMatchers("/api/**").authenticated()
            .and()
            .exceptionHandling()
            .authenticationEntryPoint((request, response, authException) -> {
                response.setContentType("application/json");
                response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                response.getWriter().write("{\"error\":\"unauthorized\"}");
            });
    }
}

package jwt

import (
    "crypto/rsa"
    "time"
    
    "github.com/golang-jwt/jwt/v5"
)

type Claims struct {
    UserID   string   `json:"user_id"`
    Username string   `json:"username"`
    Roles    []string `json:"roles"`
    jwt.RegisteredClaims
}

type JWTManager struct {
    privateKey *rsa.PrivateKey
    publicKey  *rsa.PublicKey
    issuer     string
    audience   string
}

func NewJWTManager(privateKey *rsa.PrivateKey, publicKey *rsa.PublicKey) *JWTManager {
    return &JWTManager{
        privateKey: privateKey,
        publicKey:  publicKey,
        issuer:     "auth.example.com",
        audience:   "api.example.com",
    }
}

// 生成Access Token
func (m *JWTManager) GenerateAccessToken(userID, username string, roles []string) (string, error) {
    now := time.Now()
    claims := Claims{
        UserID:   userID,
        Username: username,
        Roles:    roles,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(now.Add(1 * time.Hour)),
            IssuedAt:  jwt.NewNumericDate(now),
            NotBefore: jwt.NewNumericDate(now),
            Issuer:    m.issuer,
            Subject:   userID,
            Audience:  jwt.ClaimStrings{m.audience},
            ID:        generateUUID(),
        },
    }
    
    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
    return token.SignedString(m.privateKey)
}

// 生成Refresh Token
func (m *JWTManager) GenerateRefreshToken(userID string) (string, error) {
    now := time.Now()
    claims := jwt.RegisteredClaims{
        ExpiresAt: jwt.NewNumericDate(now.Add(30 * 24 * time.Hour)), // 30天
        IssuedAt:  jwt.NewNumericDate(now),
        Issuer:    m.issuer,
        Subject:   userID,
        ID:        generateUUID(),
    }
    
    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
    return token.SignedString(m.privateKey)
}

// 验证Token
func (m *JWTManager) ValidateToken(tokenString string) (*Claims, error) {
    token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
        // 验证算法
        if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
        }
        return m.publicKey, nil
    }, jwt.WithIssuer(m.issuer), jwt.WithAudience(m.audience))
    
    if err != nil {
        return nil, err
    }
    
    if claims, ok := token.Claims.(*Claims); ok && token.Valid {
        return claims, nil
    }
    
    return nil, jwt.ErrTokenInvalidClaims
}

package middleware

import (
    "context"
    "net/http"
    "strings"
)

type contextKey string

const UserContextKey contextKey = "user"

type User struct {
    ID       string
    Username string
    Roles    []string
}

func JWTAuthMiddleware(jwtManager *jwt.JWTManager) func(http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            // 提取Token
            authHeader := r.Header.Get("Authorization")
            if authHeader == "" {
                http.Error(w, "missing authorization header", http.StatusUnauthorized)
                return
            }
            
            parts := strings.SplitN(authHeader, " ", 2)
            if len(parts) != 2 || parts[0] != "Bearer" {
                http.Error(w, "invalid authorization header format", http.StatusUnauthorized)
                return
            }
            
            tokenString := parts[1]
            
            // 验证Token
            claims, err := jwtManager.ValidateToken(tokenString)
            if err != nil {
                http.Error(w, "invalid token", http.StatusUnauthorized)
                return
            }
            
            // 将用户信息存入上下文
            user := &User{
                ID:       claims.UserID,
                Username: claims.Username,
                Roles:    claims.Roles,
            }
            ctx := context.WithValue(r.Context(), UserContextKey, user)
            
            next.ServeHTTP(w, r.WithContext(ctx))
        })
    }
}

// 权限检查中间件
func RequireRole(roles ...string) func(http.Handler) http.Handler {
    roleSet := make(map[string]bool)
    for _, role := range roles {
        roleSet[role] = true
    }
    
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            user, ok := r.Context().Value(UserContextKey).(*User)
            if !ok {
                http.Error(w, "unauthorized", http.StatusUnauthorized)
                return
            }
            
            // 检查用户是否有任一角色
            for _, userRole := range user.Roles {
                if roleSet[userRole] {
                    next.ServeHTTP(w, r)
                    return
                }
            }
            
            http.Error(w, "forbidden", http.StatusForbidden)
        })
    }
}

// 使用示例
func main() {
    mux := http.NewServeMux()
    
    // 公开接口
    mux.HandleFunc("/api/public", handlePublic)
    
    // 需要认证的接口
    protected := http.NewServeMux()
    protected.HandleFunc("/api/profile", handleProfile)
    
    // 需要管理员权限的接口
    admin := http.NewServeMux()
    admin.HandleFunc("/api/admin/users", handleAdminUsers)
    
    // 应用中间件
    handler := JWTAuthMiddleware(jwtManager)(protected)
    adminHandler := RequireRole("ADMIN")(JWTAuthMiddleware(jwtManager)(admin))
    
    // 路由
    mux.Handle("/api/", handler)
    mux.Handle("/api/admin/", adminHandler)
    
    http.ListenAndServe(":8080", mux)
}

package token

import (
    "context"
    "time"
)

type TokenService struct {
    jwtManager *JWTManager
    tokenStore TokenStore  // Redis或数据库
}

type RefreshTokenData struct {
    Token     string
    UserID    string
    ExpiresAt time.Time
    Revoked   bool
    Family    string  // Token家族ID
}

// 刷新Token（带轮换）
func (s *TokenService) RefreshToken(ctx context.Context, refreshToken string) (string, string, error) {
    // 验证Refresh Token
    claims, err := s.jwtManager.ValidateRefreshToken(refreshToken)
    if err != nil {
        return "", "", err
    }
    
    // 从存储中获取Token数据
    tokenData, err := s.tokenStore.GetRefreshToken(ctx, refreshToken)
    if err != nil {
        return "", "", err
    }
    
    // 检查是否被撤销
    if tokenData.Revoked {
        // Token重用检测：撤销整个家族
        s.tokenStore.RevokeTokenFamily(ctx, tokenData.Family)
        return "", "", errors.New("token reuse detected")
    }
    
    // 撤销旧的Refresh Token
    s.tokenStore.RevokeRefreshToken(ctx, refreshToken)
    
    // 生成新的Access Token
    accessToken, err := s.jwtManager.GenerateAccessToken(
        tokenData.UserID,
        // ... 其他参数
    )
    if err != nil {
        return "", "", err
    }
    
    // 生成新的Refresh Token（同一家族）
    newRefreshToken, err := s.jwtManager.GenerateRefreshToken(tokenData.UserID)
    if err != nil {
        return "", "", err
    }
    
    // 存储新的Refresh Token
    s.tokenStore.SaveRefreshToken(ctx, &RefreshTokenData{
        Token:     newRefreshToken,
        UserID:    tokenData.UserID,
        ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
        Family:    tokenData.Family,  // 保持同一家族
    })
    
    return accessToken, newRefreshToken, nil
}

// 撤销所有Token（用户登出）
func (s *TokenService) RevokeAllTokens(ctx context.Context, userID string) error {
    return s.tokenStore.RevokeAllUserTokens(ctx, userID)
}

// 前端Token存储对比
/*
┌─────────────────────────────────────────┐
│ localStorage：                          │
│   优点：持久化，页面刷新不丢失          │
│   缺点：XSS攻击可读取                   │
│   适用：Refresh Token（配合HttpOnly）   │
│                                         │
│ sessionStorage：                        │
│   优点：标签页关闭自动清除              │
│   缺点：XSS攻击可读取                   │
│   适用：短期Token                       │
│                                         │
│ HttpOnly Cookie（推荐）：               │
│   优点：JavaScript无法访问，防XSS       │
│   缺点：CSRF风险（需配合SameSite）      │
│   适用：Access Token + Refresh Token    │
│                                         │
│ 内存（变量）：                          │
│   优点：最安全                          │
│   缺点：页面刷新丢失                    │
│   适用：Access Token（配合自动刷新）    │
└─────────────────────────────────────────┘
*/

// 推荐方案：HttpOnly Cookie
// 后端设置Cookie
http.SetCookie(w, &http.Cookie{
    Name:     "access_token",
    Value:    accessToken,
    Path:     "/",
    HttpOnly: true,  // JavaScript无法访问
    Secure:   true,  // 仅HTTPS
    SameSite: http.SameSiteStrictMode,  // 防CSRF
    MaxAge:   3600,
})

// 前端请求自动携带Cookie
fetch('/api/profile', {
    credentials: 'include'  // 携带Cookie
});