使用jwt进行身份验证如何验证http请求

Question

我正在使用spring Boot编写web应用程序。它是基于jwt认证的，我有模型用户，老师，学生，课程。师生扩展用户

@Entity
public class User {
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;
   private String username;
   @ManyToMany(fetch = FetchType.LAZY)
   @JoinTable(name = "user_roles",
            joinColumns = @JoinColumn(name = "user_id"),
            inverseJoinColumns = @JoinColumn(name = "role_id"))
   private Set<Role> roles = new HashSet<>();
   // Other fields and getters setters
}

@Entity
public class Course {
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;   
   @ManyToOne
   @JoinColumn(name = "teacher_id", nullable = false)
   private Teacher teacher;

   @ManyToMany(mappedBy = "enrolledCourses")
   private Set<Student> students;
   // Other fields and getters setters
}

@Entity
public class Teacher extends User{
   @OneToMany(mappedBy = "teacher")
   private Set<Course> courses;
   // Other fields and getters setters
}


@Entity
public class Student extends User{
   @ManyToMany
   @JoinTable(
        name = "course_student",
        joinColumns = @JoinColumn(name = "student_id"),
        inverseJoinColumns = @JoinColumn(name = "course_id"))
   private Set<Course> enrolledCourses;
   // Other fields and getters setters
}

而且我也有课程Api，我实现了post,put,delete,update和这些方法必须只有那些用户谁是教师可用。我的课程Api如下所示

@RestController
@RequestMapping("/teachers")
@PreAuthorize("hasRole('TEACHER')")
public class TeacherCourseController {

   @GetMapping("/{teacherId}/courses")
   public Set<Course> getCourse(@PathVariable("teacherId") Teacher teacher){
    // code
   }
   @PostMapping("/{teacherId}/courses")
   public Course createCourse(
        @PathVariable("teacherId") Long teacherId,
        @ModelAttribute CourseDto courseDto){
   // code
   }
   @PutMapping("/{teacherId}/courses/{courseId}")
   @JsonView(Views.IdName.class)
   public Course updateCourse(
        @ModelAttribute CourseDto courseDto,
        @PathVariable("courseId") Course courseFromDb){
    // code
   }
   @DeleteMapping("/{teacherId}/courses/{courseId}")
   public void getCourse(@PathVariable("courseId") Course course) throws IOException {
    // code
   }
}

我的api url变得更糟，看起来像http://localhost:8080/teachers/{teacherId}/courses/{courseId}我如何检查是老师请求他的课程，而不是其他老师。谢谢

Answer 1

为什么不让课程成为顶级资源呢？您将有一个类似/courses{courseId}的路径。在handler方法中，您检查来自对请求进行身份验证的JWT令牌的sub声明。如果声明与授课教师的教师id不匹配，则返回403禁止响应。

尽管课程是由老师教授的，但它们应该是自己的顶级资源，因为学生可能会列出它们并注册。