如何为JWT Token设置Authorization请求头（Spring Security）

一、给响应头添加Bearer前缀 #

在你的AuthController的createAuthenticationToken方法里，设置Authorization响应头时，需要补充Bearer 前缀：

修改原代码中设置响应头的行：

response.setHeader("Authorization" ,jwt);

改为：

response.setHeader("Authorization", "Bearer " + jwt);

这样返回的响应头就符合标准的JWT认证格式了，同时你也可以同步修改AuthenticationResponse的返回值（如果前端需要从响应体获取带前缀的Token）。

二、添加JWT认证过滤器 #

当前配置缺少JWT请求验证逻辑，需要新增一个过滤器来解析请求头中的Token并完成认证：

package com.example.jwtspringsecurity.filter;

import com.example.jwtspringsecurity.service.jwt.UserDetailsServiceImpl;
import com.example.jwtspringsecurity.util.JwtUtil;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Autowired
    private JwtUtil jwtUtil;

    @Autowired
    private UserDetailsServiceImpl userDetailsService;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        // 从请求头提取Authorization信息
        String authHeader = request.getHeader("Authorization");
        String token = null;
        String username = null;

        // 解析Bearer格式的Token
        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            token = authHeader.substring(7);
            username = jwtUtil.extractUsername(token);
        }

        // Token有效且当前未完成认证时，设置认证上下文
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            if (jwtUtil.validateToken(token, userDetails)) {
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails,
                        null,
                        userDetails.getAuthorities()
                );
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

三、更新SecurityFilterChain配置 #

在AppConfig中注入JWT过滤器，并将其添加到Spring Security的过滤链中，确保在用户名密码认证过滤器前执行：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity, JwtAuthenticationFilter jwtAuthFilter) throws Exception {
    return httpSecurity.csrf().disable()
            .authorizeHttpRequests()
            .requestMatchers("/register", "/auth").permitAll()
            .anyRequest().authenticated()
            .and()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            // 插入JWT认证过滤器
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
            .build();
}

四、流程说明 #

1. 用户调用/auth接口完成认证后，后端返回的Authorization响应头会携带Bearer <token>格式的内容。
2. 后续访问/api/**等需要认证的接口时，前端需在请求头中携带Authorization: Bearer <token>。
3. JWT过滤器会自动解析、验证Token，验证通过后将用户信息存入SecurityContext，完成认证流程。

内容的提问来源于stack exchange，提问作者gzhe1056