scala – 使用Play 2 Framework进行基于令牌的身份验证

如果您在说“基于令牌”时引用JWT,您可能需要查看 this example在Play2中实现HTTP基本身份验证,以及 this answer：如何在Scala后端实现JWT.好的部分是您既不需要cookie,也不需要经过身份验证的用户的缓存.

为方便起见,包括第一个链接的内容：

def Secured[A](username: String,password: String)(action: Action[A]) = Action(action.parser) { request =>
  request.headers.get("Authorization").flatMap { authorization =>
    authorization.split(" ").drop(1).headOption.filter { encoded =>
      new String(org.apache.commons.codec.binary.Base64.decodeBase64(encoded.getBytes)).split(":").toList match {
        case u :: p :: Nil if u == username && password == p => true
        case _ => false
      }
    }.map(_ => action(request))
  }.getOrElse {
    Unauthorized.withHeaders("WWW-Authenticate" -> """Basic realm="Secured"""")
  }
}

使用方法如下：

def myAction = Secured("admin","1234secret") {
  Action { request =>
    Ok
  }
}