006 签发的用户认证token超时刷新策略

• 参考文献：https://blog.csdn.net/sinat_25235033/article/details/80324006
• 文献缺点：用的是id，这样多个用户登录同一个账户就有问题，只要我知道你的用户id，其他人登录一下，这边就可以无限登录
  

1.登录时保存到redis

redisTemplate.opsForValue().set("jwt_session_"+token, JSONObject.toJSONString(map),120, TimeUnit.SECONDS);

public R login(UserEntity user, String smsCode,String loginType) throws Exception {
    R info = userService.getLoginUser(user.getUsername(),user.getTelPhone(), user.getPassword(), smsCode, loginType);
        UserEntity entity=new UserEntity();
    	entity = (UserEntity) info.get("entity");
    	String token=jwtTokenUtil.generateToken(new JWTInfo(entity.getId(), entity.getUsername(), entity.getRealname(),entity.getTelPhone(),entity.getIconImg(),entity.getOrgId(),entity.getClientId()));
    	Map<String, String> map = new HashMap<String,String>();
        map.put("id",entity.getId());
        map.put("account",entity.getUsername());
        map.put("realname",entity.getRealname());
        map.put("phone",entity.getTelPhone());
        map.put("headImg",entity.getIconImg());
        map.put("orgId",entity.getOrgId());
        map.put("clientId",entity.getClientId());
        map.put("token",token);
    	redisTemplate.opsForValue().set("jwt_session_"+token, JSONObject.toJSONString(map),120, TimeUnit.SECONDS);
    	return R.ok().put("token",token);
}

2.访问超时是刷新token

    /**
     * 获取token中的用户信息
     *
     * @param token
     * @param pubKeyPath
     * @return
     * @throws Exception
     */
    public  JWTInfo getInfoFromToken(String token) throws Exception {
    	System.out.println("验证token:"+token);
    	//1. 通过redis获取它实际的token
		Object json =redisTemplate.opsForValue().get("jwt_session_"+token);
		//2. redis就获取，没有就过期
		if(ObjectUtils.isEmpty(json)){
			throw new Exception("token已失效!");
		}
    	Algorithm algorithm = Algorithm.HMAC256("epf123");
    	JWTVerifier verifier = JWT.require(algorithm).withIssuer("ADMIN").build();
		//3. 再看redis里面的真实token是否过期
		Map maps = (Map)JSON.parse(json.toString());
		try{
			//4.没有过期就直接获取内容返回
			DecodedJWT jwt = verifier.verify(maps.get("token").toString());
			String subject = jwt.getSubject();
			List<String> audience = jwt.getAudience();
			Map<String, Claim> claims = jwt.getClaims();
			JWTInfo jwtInfo =new JWTInfo(claims.get("id").asString(), claims.get("account").asString(), claims.get("realname").asString(),claims.get("phone").asString() ,claims.get("headImg").asString() ,claims.get("orgId").asString(),claims.get("clientId").asString() );
			return jwtInfo;
		}catch(Exception e){
			try{
				//5. 过期就重新生成token,并保存到redis里面，刷新token
				JWTInfo jwtInfo=new JWTInfo(maps.get("id").toString(), maps.get("account").toString(), maps.get("realname").toString(),"","",maps.get("orgId").toString(),"");
				String refreshToken=jwtTokenUtil.generateToken(jwtInfo);
				//刷新旧的token
				maps.put("token",refreshToken);
				redisTemplate.opsForValue().set("jwt_session_"+token, JSONObject.toJSONString(maps),600, TimeUnit.SECONDS);
				return jwtInfo;
			}catch (Exception e2){
				e2.printStackTrace();
				return null;
			}

		}
    }