JWT解密一直失败

Question

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;
import lombok.extern.slf4j.Slf4j;
import org.joda.time.DateTime;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
@Slf4j
public class JWT {

public static String generateToken(Map<String, Object> claims) {
    Date exp = DateTime.now().plusDays(1).toDate();
    return Jwts.builder()
            .claim("user_id", 1)
            .claim("username", "jack")
            .setExpiration(exp)
            .signWith(Keys.secretKeyFor(SignatureAlgorithm.HS256))
            .compact();
}
public static Claims getClaimsFromToken(String token) {
    Claims claims;
    try {
        claims = Jwts.parser()
                .setSigningKey(Keys.secretKeyFor(SignatureAlgorithm.HS256))
                .parseClaimsJws(token)
                .getBody();
    } catch (Exception e) {
        log.info("不能相信签名: {}", e);
        claims = null;
    }
    return claims;
}
public static void main(String[] args) {
    Map<String,Object> map = new HashMap<>();
    String token = JWT.generateToken(map);
    log.info("这个是加密出来的token: {}", token);
    Claims claims = getClaimsFromToken(token);
    log.info("这个是解密出来的claims: {}", claims);
}

}

在学习JWT的时候, 采用io.jsonwebtoken的类库去实现, 可总是验证失败

不知道为什么

Answer 1

楼主没有生成签名的时候和解密的时候key有问题，下边我测试过没有问题：

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.time.Instant;
import java.util.Date;

public class Test {
    
    static String secret = "ddddd";

    public static void main(String[] args) {
        Date exp = Date.from(Instant.ofEpochMilli(System.currentTimeMillis() + 100000));
        SecretKey key = new SecretKeySpec(secret.getBytes(), "AES");
        String token =  Jwts.builder()
                .claim("user_id", 1)
                .claim("username", "jack")
                .setExpiration(exp)
                .signWith(SignatureAlgorithm.HS256,key)
                .compact();
        System.out.println("这个是加密出来的token: {}"+ token);

        Claims claims;
        try {
            claims = Jwts.parser()
                    .setSigningKey(key)
                    .parseClaimsJws(token)
                    .getBody();
        } catch (Exception e) {
            System.out.println("不能相信签名: {}" +  e);
            claims = null;
        }
        System.out.println("这个是解密出来的claims: {}"+claims);
    }

}

最终打印：

这个是加密出来的token: {}eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VybmFtZSI6ImphY2siLCJleHAiOjE1NTQzNzgzNDJ9.Ot-rlTKsDomyLxL4nRel9NTZWk_r1PWS4MHPYn4Y6Nw
这个是解密出来的claims: {}{user_id=1, username=jack, exp=1554378342}

pom.xml中引用的jar

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>