KMM中JWT Token跨平台实现疑问：iOS端Swift侧如何处理？

步骤1：Kotlin端actual函数实现 #

修改iOS端的Kotlin actual函数，直接调用Swift端的JWT生成逻辑：

actual fun getToken(): String {
    return JwtGenerator.generateToken()
}

步骤2：Swift端JWT生成实现 #

在iOS项目中创建JwtGenerator类，完成Header、Payload构建、HS256签名及JWT拼接的完整逻辑：

import Foundation

class JwtGenerator {
    static func generateToken() -> String {
        // 构建JWT Header，与Android端格式对齐
        let header: [String: Any] = [
            "typ": "JWT",
            "alg": "HS256"
        ]
        // 构建JWT Payload，字段完全匹配Android端定义
        let payload: [String: Any] = [
            "company": "ADO",
            "session_token": "",
            "api_token": "token"
        ]
        
        // 辅助函数：将字典转为URL安全的Base64字符串（JWT标准要求）
        func urlSafeBase64Encode(_ dict: [String: Any]) -> String? {
            guard let jsonData = try? JSONSerialization.data(withJSONObject: dict, options: []) else {
                return nil
            }
            return jsonData.base64EncodedString()
                .replacingOccurrences(of: "+", with: "-")
                .replacingOccurrences(of: "/", with: "_")
                .trimmingCharacters(in: CharacterSet(charactersIn: "="))
        }
        
        guard let encodedHeader = urlSafeBase64Encode(header),
              let encodedPayload = urlSafeBase64Encode(payload) else {
            return ""
        }
        
        // 拼接未签名的Header.Payload部分
        let unsignedToken = "\(encodedHeader).\(encodedPayload)"
        
        // 使用HS256算法生成签名
        guard let secretData = "something".data(using: .utf8),
              let unsignedTokenData = unsignedToken.data(using: .utf8) else {
            return ""
        }
        
        var digest = [UInt8](repeating: 0, count: Int(CC_SHA256_DIGEST_LENGTH))
        unsignedTokenData.withUnsafeBytes { dataBytes in
            secretData.withUnsafeBytes { keyBytes in
                CCHmac(CCHmacAlgorithm(kCCHmacAlgSHA256), keyBytes.baseAddress, secretData.count, dataBytes.baseAddress, unsignedTokenData.count, &digest)
            }
        }
        
        let encodedSignature = Data(digest).base64EncodedString()
            .replacingOccurrences(of: "+", with: "-")
            .replacingOccurrences(of: "/", with: "_")
            .trimmingCharacters(in: CharacterSet(charactersIn: "="))
        
        // 拼接完整JWT
        return "\(unsignedToken).\(encodedSignature)"
    }
}

关键注意点 #

• 签名密钥something必须与Android端完全一致，否则两端生成的Token签名会不匹配
• 必须使用URL安全的Base64编码，替换+为-、/为_并去掉末尾的=，这是JWT的强制标准
• 若不想手动实现HMAC逻辑，可使用第三方库（如SwiftJWT）简化开发，但需确认库的兼容性

内容的提问来源于stack exchange，提问作者Faraz Ahmed