在 RESTful API 中存储身份验证令牌的位置？

Question

我想保护 REST URL。为此，我决定使用基于令牌的身份验证。在那，我如何创建具有过期时间的令牌以及我可以将它存储在哪里以供以后验证令牌检查？

提前致谢。

This is my security.xml
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:sec="http://www.springframework.org/schema/security"
             xmlns:context="http://www.springframework.org/schema/context"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                                 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">
    <beans:import resource="applicationContext.xml"/>
    <http pattern="/jaxrs/employess/**" create-session="stateless"  entry-point-ref="myAuthenticationEntryPoint">
        <intercept-url pattern='/jaxrs/employess/**' /> 
            <custom-filter position="PRE_AUTH_FILTER" ref="myAuthenticationFilter" />
    </http>
    <beans:bean id="myAuthenticationEntryPoint" class="restservice.security.MyAuthenticationEntryPoint"/>
    <global-method-security secured-annotations="enabled" />
    <beans:bean id="myAuthenticationFilter" class="restservice.security.MyAuthenticationFilter">
        <beans:property name="authenticationManager" ref="authenticationManager"/>
    </beans:bean>
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="myAuthenticationProvider"/>
    </authentication-manager>
    <!--<beans:bean id="restTemplate" class="org.springframework.web.client.RestTemplate"/>-->
    <beans:bean id="restTemplate" class="org.springframework.web.client.RestTemplate">
        <!--  <beans:property name="errorHandler" ref="customErrorHandler" /> -->
    </beans:bean>
    <beans:bean id="myAuthenticationProvider" class="restservice.security.MyAuthenticationProvider" >
        <beans:property name="restTemplate" ref="restTemplate"/>
    </beans:bean>
  <!--   <beans:bean id="customErrorHandler" class="com.AuthenticationResponseErrorHandler"/> -->
</beans:beans>*

Answer 1

您不应该将它存储在任何地方，因为这意味着在服务器上存储一些会话状态。

相反，令牌本身应该是一个签名的编码字符串，其中包含识别用户所需的信息。您通过检查签名来验证其真实性。如果您需要使其过期，只需在签名之前为其附加时间戳并根据当前时间计算令牌年龄。