一、认证方案对比

二、核心系统实现

1. JWT服务封装

// app/service/JwtService.php
namespace appservice;

use FirebaseJWTJWT;
use FirebaseJWTKey;

class JwtService
{
    private $key;
    private $alg = 'HS256';
    
    public function __construct()
    {
        $this->key = env('JWT_SECRET');
    }
    
    public function encode(array $payload): string
    {
        $payload['iat'] = time();
        $payload['exp'] = time() + 7200; // 2小时过期
        return JWT::encode($payload, $this->key, $this->alg);
    }
    
    public function decode(string $token): array
    {
        try {
            return (array)JWT::decode($token, new Key($this->key, $this->alg));
        } catch (Exception $e) {
            throw new Exception('Token验证失败');
        }
    }
}

2. 认证中间件

// app/middleware/JwtAuth.php
namespace appmiddleware;

use appserviceJwtService;

class JwtAuth
{
    public function handle($request, Closure $next)
    {
        $token = $request->header('Authorization');
        if (!$token) {
            return json(['code' => 401, 'msg' => 'Token缺失']);
        }
        
        try {
            $payload = (new JwtService())->decode(
                str_replace('Bearer ', '', $token)
            );
            $request->user = $payload;
        } catch (Exception $e) {
            return json(['code' => 403, 'msg' => $e->getMessage()]);
        }
        
        return $next($request);
    }
}

3. 路由权限控制

// app/controller/ApiController.php
namespace appcontroller;

use thinkfacadeDb;

class ApiController
{
    protected $noAuth = []; // 无需认证的方法
    
    protected function initialize()
    {
        $action = request()->action();
        if (!in_array($action, $this->noAuth)) {
            $this->checkPermission();
        }
    }
    
    protected function checkPermission()
    {
        $user = request()->user;
        $path = request()->pathinfo();
        
        $permission = Db::name('permissions')
            ->where('role_id', $user['role_id'])
            ->where('api_path', $path)
            ->find();
            
        if (!$permission) {
            return json(['code' => 403, 'msg' => '无权访问']);
        }
    }
}

三、高级功能扩展

1. Token自动刷新

// 响应拦截器
public function jwtRefresh($response)
{
    $token = request()->header('Authorization');
    $payload = (new JwtService())->decode($token);
    
    if ($payload['exp'] - time() encode([
            'user_id' => $payload['user_id'],
            'role_id' => $payload['role_id']
        ]);
        $response->header(['New-Token' => $newToken]);
    }
    
    return $response;
}

2. 接口限流控制

// app/middleware/RateLimit.php
class RateLimit
{
    public function handle($request, Closure $next)
    {
        $key = 'api_rate:' . $request->ip();
        $redis = thinkfacadeRedis::instance();
        
        $count = $redis->incr($key);
        if ($count === 1) {
            $redis->expire($key, 60);
        }
        
        if ($count > 100) { // 每分钟100次
            return json(['code' => 429, 'msg' => '请求过于频繁']);
        }
        
        return $next($request);
    }
}

四、安全防护方案

• HTTPS强制：全站启用HTTPS传输
• 密钥轮换：定期更换JWT签名密钥
• 黑名单机制：失效Token立即加入黑名单
• 日志审计：完整记录API访问日志

性能测试数据

测试环境：4核8G云服务器
并发请求：5000次/秒
认证耗时：平均8ms
内存占用：45MB
QPS：3200+