微服务鉴权中心设计：JWT 双令牌、Spring Security 与 Nacos 动态路由

客户端 → Gateway（鉴权过滤器 + 动态路由）→ 账户/商品/订单服务
                ↓ 白名单放行
        鉴权中心（签发 / 刷新 / 注销）

public TokenPair issue(User user) {
    long now = System.currentTimeMillis();
    String access = Jwts.builder()
            .setSubject(String.valueOf(user.getId()))
            .claim("roles", user.getRoles())
            .setIssuedAt(new Date(now))
            .setExpiration(new Date(now + accessTtl))
            .signWith(key, SignatureAlgorithm.HS256)
            .compact();

    // refresh token 只存 ID 映射，不携带角色等业务声明
    String refresh = UUID.randomUUID().toString().replace("-", "");
    redis.setex("refresh:" + refresh, refreshTtl, String.valueOf(user.getId()));
    redis.setex("user_token:" + user.getId(), refreshTtl, refresh); // 单点登录约束
    return new TokenPair(access, refresh);
}

public void logout(String accessJti, long remainingTtl) {
    // 黑名单存活时间 = token 剩余有效期，到期自动清理
    redis.setex("blacklist:" + accessJti, remainingTtl, "1");
}

// 网关过滤器里验签之后查黑名单
if (redis.exists("blacklist:" + jti)) {
    return unauthorized("token 已注销");
}

@Component
public class AuthFilter implements GlobalFilter, Ordered {
    private static final List<String> WHITE_LIST = List.of(
            "/auth/login", "/auth/refresh", "/actuator/health");

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String path = exchange.getRequest().getURI().getPath();
        if (isWhite(path)) return chain.filter(exchange);

        String token = resolveToken(exchange.getRequest());
        if (token == null) return reject(exchange, "缺少凭证");

        Claims claims = jwtUtil.parse(token);          // 验签 + 过期校验
        if (jwtUtil.isBlacklisted(claims.getId()))     // 黑名单
            return reject(exchange, "token 已注销");

        // 剥离外部伪造的身份头，写入网关裁决过的身份
        ServerHttpRequest mutated = exchange.getRequest().mutate()
                .headers(h -> { h.remove("X-User-Id"); h.remove("X-User-Roles"); })
                .header("X-User-Id", claims.getSubject())
                .header("X-User-Roles", claims.get("roles", String.class))
                .build();
        return chain.filter(exchange.mutate().request(mutated).build());
    }
}

public class GatewayTokenFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest req,
                                    HttpServletResponse res,
                                    FilterChain chain) throws Exception {
        String userId = req.getHeader("X-User-Id");
        if (userId != null) {
            List<SimpleGrantedAuthority> authorities = Arrays.stream(
                            req.getHeader("X-User-Roles").split(","))
                    .map(SimpleGrantedAuthority::new).toList();
            var auth = new UsernamePasswordAuthenticationToken(userId, null, authorities);
            SecurityContextHolder.getContext().setAuthentication(auth);
        }
        chain.doFilter(req, res);
    }
}

@Component
public class NacosRouteRepository implements RouteDefinitionRepository {

    private final Map<String, RouteDefinition> routes = new ConcurrentHashMap<>();

    @NacosConfigListener(dataId = "gateway-routes.json")
    public void onRouteChange(String config) {
        List<RouteDefinition> defs = JSON.parseArray(config, RouteDefinition.class);
        routes.clear();
        defs.forEach(d -> routes.put(d.getId(), d));
        // 触发网关刷新路由
        applicationEventPublisher.publishEvent(new RefreshRoutesEvent(this));
    }

    @Override
    public Flux<RouteDefinition> getRouteDefinitions() {
        return Flux.fromIterable(routes.values());
    }
}