# OAuth2 实现密码哈希与 Bearer  JWT 令牌验证

至此，我们已经编写了所有安全流，本章学习如何使用 <abbr title="JSON Web Tokens">JWT</abbr> 令牌（Token）和安全密码哈希（Hash）实现真正的安全机制。

本章的示例代码真正实现了在应用的数据库中保存哈希密码等功能。

接下来，我们紧接上一章，继续完善安全机制。

## JWT 简介

JWT 即**JSON 网络令牌**（JSON Web Tokens）。

JWT 是一种将 JSON 对象编码为没有空格，且难以理解的长字符串的标准。JWT 的内容如下所示：

```

                .singleton("singletonComponent", SingletonTestComponent.class)
                .prototype("closeableComponent", CloseableTestComponent.class);

        // Initialize factory with setter injection
        factory = new CrawlerPooledObjectFactory<>();
        factory.setCrawlerContainer(container);
        factory.setComponentName("testComponent");
    }

    /**

import org.apache.maven.model.Profile;
import org.apache.maven.model.building.ModelBuildingRequest;
import org.apache.maven.properties.internal.SystemProperties;
import org.eclipse.aether.RepositorySystemSession;

/**
 * DefaultProjectBuildingRequest
 *
 * @deprecated use {@code org.apache.maven.api.services.ProjectBuilder} instead
 */
@Deprecated(since = "4.0.0")

  }

  // setFuture and cancel() interact in more complicated ways than the other setters.
  public void testSetFutureCancelBash() {
    if (isWindows()) {
      return; // TODO: b/136041958 - Running very slowly on Windows CI.
    }
    int size = 50;
    CyclicBarrier barrier =
        new CyclicBarrier(
            2 // for the setter threads
                + size // for the listeners

                original.retryPolicy, original.context);
        retry.setAttemptNumber(attemptNumber);
        return retry;
    }

    private void setAttemptNumber(int attemptNumber) {
        // Package-private setter for attempt number
        try {
            java.lang.reflect.Field field = SmbOperationException.class.getDeclaredField("attemptNumber");
            field.setAccessible(true);
            field.set(this, attemptNumber);

		// A is 65, a is 97
		if v >= 'a' {
			b.WriteRune(v)
			continue
		}
		// v is capital letter here
		// disregard first letter
		// add underscore if last letter is capital letter
		// add underscore when previous letter is lowercase
		// add underscore when next letter is lowercase
		if (i != 0 || i == l-1) && ((i > 0 && rune(camel[i-1]) >= 'a') ||
			(i < l-1 && rune(camel[i+1]) >= 'a')) {

class HTTPBase(SecurityBase):
    type_: SecuritySchemeType = Field(default=SecuritySchemeType.http, alias="type")
    scheme: str


class HTTPBearer(HTTPBase):
    scheme: Literal["bearer"] = "bearer"
    bearerFormat: Optional[str] = None


class OAuthFlow(BaseModelWithConfig):
    refreshUrl: Optional[str] = None
    scopes: dict[str, str] = {}


class OAuthFlowImplicit(OAuthFlow):

share the same underlying TCP socket connection. Sharing a connection has substantial performance benefits: lower latency, higher throughput (due to [TCP slow start](https://www.igvita.com/2011/10/20/faster-web-vs-tcp-slow-start/)) and conserved battery. OkHttp uses a [ConnectionPool](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-connection-pool/) that automatically reuses HTTP/1.x connections and multiplexes HTTP/2 connections.

In OkHttp some fields of the address come from the URL...

Но тогда будут разрешены только некоторые виды взаимодействия, и всё, что связано с учётными данными, будет исключено: куки, HTTP-заголовки Authorization, как при использовании Bearer-токенов, и т.п.

Поэтому, чтобы всё работало корректно, лучше явно указывать список разрешённых источников.

## Использование `CORSMiddleware` { #use-corsmiddleware }

        // Add multiple headers
        request.header("Accept", "application/json").header("Content-Type", "application/json").header("Authorization", "Bearer token123")
                .header("X-Custom-Header", "custom-value");

        assertNotNull(request);
    }

    @Test
    public void testGzipSetsCompressionToGzip() {