[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"site-settings":3,"site-stats":4,"post-9":5},true,null,[6,27],{"locked":7,"post":8},false,{"id":9,"authorId":10,"categoryId":10,"tagId":10,"title":11,"tip":12,"coverUrl":13,"content":14,"videoUrl":4,"views":15,"likes":16,"isPublished":3,"isRecommended":7,"isPinned":7,"allowComment":3,"createdAt":17,"updatedAt":18,"deletedAt":4,"category":19,"tag":22,"author":24,"liked":7},9,1,"Spring Boot 集成 JWT 认证全流程","从登录签发到拦截校验，一套可落地的无状态认证方案","https:\u002F\u002Fimg.sanshijiu.cn\u002Fpost\u002Fcover_01.jpg","## 为什么选 JWT\n\n传统的 Session 方案在前后端分离架构下会遇到跨域与分布式共享问题，而 JWT 把用户信息签名后放进令牌本身，服务端无需存储会话，天然适合RESTful API。\n\n## 整体流程\n\n1. 用户提交账号密码\n2. 服务端校验通过后签发 access_token \u002F refresh_token\n3. 客户端后续请求携带 Authorization: Bearer \u003Ctoken>\n4. 网关或拦截器统一校验签名与过期时间\n\n## 核心代码\n\n```java\npublic String createToken(Account account) {\n    return Jwts.builder()\n        .setSubject(account.getUsername())\n        .claim(\"role\", account.getRole())\n        .setIssuedAt(new Date())\n        .setExpiration(new Date(System.currentTimeMillis() + EXPIRE))\n        .signWith(secretKey, SignatureAlgorithm.HS256)\n        .compact();\n}\n```\n\n## 几个实践建议\n\n- access_token 有效期控制在 2 小时内，配合 refresh_token 静默续期\n- 登出场景使用 Redis 黑名单兜底\n- 密钥务必走环境变量，不要硬编码\n\n## 小结\n\nJWT 不是银弹，但在中小型项目中它足够简单可靠。把签发、校验、续期三个环节封装成 starter，后续项目直接复用即可。",1318,31,"2026-06-30T17:00:00.000Z","2026-10-01T01:45:27.565Z",{"id":10,"name":20,"color":21},"后端",2,{"id":10,"name":23},"Spring Boot",{"id":10,"nickname":25,"avatarUrl":26},"叁拾玖","https:\u002F\u002Fimg.sanshijiu.cn\u002Favatar\u002F1\u002F1787397803188bebb136a.jpg",{"prev":28,"next":31},{"id":29,"title":30},27,"鼠标点击特效（24字核心主义价值观）",{"id":32,"title":33},10,"Node.js + Express 搭建 RESTful API 实战"]