Article

Spring Boot MVP

更新于：2026-07-15

典型 Spring Boot 后端 MVP（最小可行产品）项目

项目整体说明

特性	说明	注意事项
Spring Boot 版本	使用 Spring Boot 3.x + Java 17+	建议使用最新的 3.x 稳定版，确保兼容 Jakarta EE
数据库	默认使用 H2 内存数据库	可替换为 MySQL、PostgreSQL 等生产级数据库
消息队列	默认使用内存队列模拟	可替换为 RabbitMQ、Kafka、Redis Stream 等
认证方式	JWT 认证完整实现	支持无状态认证，适合微服务架构
OAuth2	相关代码已注释	添加依赖后取消注释即可一键启用
架构设计	项目结构清晰，模块解耦	便于扩展，所有组件均可通过 Profile 和条件注解灵活切换

项目结构与文件作用说明

包路径	文件名	主要作用
`config`	`DatabaseConfig.java`	数据库配置（支持 H2 / MySQL / PostgreSQL 切换）
`config`	`MessageQueueConfig.java`	消息队列配置（支持内存 / RabbitMQ / Kafka 切换）
`config`	`JwtConfig.java`	JWT 配置（密钥、过期时间等）
`config`	`SecurityConfig.java`	Spring Security 配置（含 JWT 过滤器，OAuth2 注释）
`controller`	`AuthController.java`	登录/注册接口
`controller`	`UserController.java`	用户信息接口（需认证）
`dto`	`LoginRequest.java`	登录请求 DTO
`dto`	`UserDto.java`	用户响应 DTO
`entity`	`User.java`	用户实体类（JPA）
`repository`	`UserRepository.java`	用户数据访问接口
`security`	`JwtAuthenticationFilter.java`	JWT 认证过滤器
`security`	`JwtUtil.java`	JWT 工具类（生成/验证 Token）
`service`	`AuthService.java`	认证服务（登录、注册）
`service`	`UserService.java`	用户业务逻辑
`resource`	`application.yml`	主配置文件（含 Profile 切换）

提示：所有组件均可通过 application-{profile}.yml 和条件注解灵活切换。

基础模板代码

所有代码均可直接运行，默认使用 H2 + 内存队列 + JWT。

1. `config/DatabaseConfig.java`

package com.example.demo.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;

// 可通过 spring.profiles.active 切换数据库
@Configuration
@Profile("h2") // 默认，根据 yml 中的 profiles 参数选择不同的配置
public class DatabaseConfig {
    // H2 无需额外配置，Spring Boot 自动处理
}

其他数据库如需启用，创建对应 Profile 类（如 @Profile("mysql")），并配置 DataSource。

2. `config/MessageQueueConfig.java`

package com.example.demo.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;

import java.util.concurrent.BlockingQueue;
import java.util.concurrent.LinkedBlockingQueue;

@Configuration
public class MessageQueueConfig {

    @Bean
    @Profile("!rabbit & !kafka") // 默认内存队列
    public BlockingQueue<String> inMemoryQueue() {
        return new LinkedBlockingQueue<>();
    }

    // 启用 RabbitMQ 时取消注释以下代码
    /*
    @Bean
    @Profile("rabbit")
    public RabbitTemplate rabbitTemplate(ConnectionFactory connectionFactory) {
        return new RabbitTemplate(connectionFactory);
    }
    */

    // 启用 Kafka 时取消注释
    /*
    @Bean
    @Profile("kafka")
    public KafkaTemplate<String, String> kafkaTemplate(ProducerFactory<String, String> pf) {
        return new KafkaTemplate<>(pf);
    }
    */
}

3. `config/JwtConfig.java`

package com.example.demo.config;

import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;

@Component
@ConfigurationProperties(prefix = "app.jwt")
public class JwtConfig {
    private String secret = "mySecretKey1234567890"; // 生产环境应使用强密钥
    private long expirationMs = 86400000; // 24 小时

    // getters/setters
    public String getSecret() { return secret; }
    public void setSecret(String secret) { this.secret = secret; }
    public long getExpirationMs() { return expirationMs; }
    public void setExpirationMs(long expirationMs) { this.expirationMs = expirationMs; }
}

4. `config/SecurityConfig.java`

package com.example.demo.config;

import com.example.demo.security.JwtAuthenticationFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthFilter;

    public SecurityConfig(JwtAuthenticationFilter jwtAuthFilter) {
        this.jwtAuthFilter = jwtAuthFilter;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/api/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

        // === OAuth2 支持（可选）===
        /*
        http.oauth2Login(oauth2 -> oauth2
            .userInfoEndpoint(userInfo -> userInfo
                .oidcUserService(customOidcUserService()) // 自定义用户服务
            )
        );
        */
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config)
            throws Exception {
        return config.getAuthenticationManager();
    }

    // OAuth2 自定义用户服务（可选）
    /*
    @Bean
    public OAuth2UserService<OidcUserRequest, OidcUser> customOidcUserService() {
        return new CustomOidcUserService(userService);
    }
    */
}

5. `security/JwtUtil.java`

package com.example.demo.security;

import com.example.demo.config.JwtConfig;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.io.Decoders;
import io.jsonwebtoken.security.Keys;
import org.springframework.stereotype.Component;

import java.security.Key;
import java.util.Date;
import java.util.function.Function;

@Component
public class JwtUtil {

    private final JwtConfig jwtConfig;

    public JwtUtil(JwtConfig jwtConfig) {
        this.jwtConfig = jwtConfig;
    }

    public String generateToken(String username) {
        return Jwts.builder()
                .setSubject(username)
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + jwtConfig.getExpirationMs()))
                .signWith(getSignInKey(), SignatureAlgorithm.HS256)
                .compact();
    }

    public boolean validateToken(String token, String username) {
        final String extractedUsername = extractUsername(token);
        return (extractedUsername.equals(username) && !isTokenExpired(token));
    }

    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

    private <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }

    private Claims extractAllClaims(String token) {
        return Jwts.parserBuilder()
                .setSigningKey(getSignInKey())
                .build()
                .parseClaimsJws(token)
                .getBody();
    }

    private Key getSignInKey() {
        byte[] keyBytes = Decoders.BASE64.decode(jwtConfig.getSecret());
        return Keys.hmacShaKeyFor(keyBytes);
    }

    private boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    private Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }
}

6. `security/JwtAuthenticationFilter.java`

package com.example.demo.security;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtUtil jwtUtil;
    private final UserDetailsService userDetailsService;

    public JwtAuthenticationFilter(JwtUtil jwtUtil, UserDetailsService userDetailsService) {
        this.jwtUtil = jwtUtil;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        final String authHeader = request.getHeader("Authorization");
        final String jwt;
        final String username;

        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }

        jwt = authHeader.substring(7);
        username = jwtUtil.extractUsername(jwt);

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
            if (jwtUtil.validateToken(jwt, userDetails.getUsername())) {
                UsernamePasswordAuthenticationToken authToken =
                        new UsernamePasswordAuthenticationToken(
                                userDetails, null, userDetails.getAuthorities());
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

7. `entity/User.java`

package com.example.demo.entity;

import jakarta.persistence.*;
import lombok.Data;

@Entity
@Table(name = "users")
@Data
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true)
    private String username;

    private String password; // 存储 BCrypt 加密后的密码
}

8. `repository/UserRepository.java`

package com.example.demo.repository;

import com.example.demo.entity.User;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.stereotype.Repository;

import java.util.Optional;

@Repository
public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
}

9. `service/UserService.java`

package com.example.demo.service;

import com.example.demo.entity.User;
import com.example.demo.repository.UserRepository;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class UserService implements UserDetailsService {

    private final UserRepository userRepository;

    public UserService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        return userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
    }

    public User save(User user) {
        return userRepository.save(user);
    }
}

10. `service/AuthService.java`

package com.example.demo.service;

import com.example.demo.dto.LoginRequest;
import com.example.demo.entity.User;
import com.example.demo.security.JwtUtil;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

@Service
public class AuthService {

    private final AuthenticationManager authenticationManager;
    private final JwtUtil jwtUtil;
    private final UserService userService;
    private final PasswordEncoder passwordEncoder;

    public AuthService(AuthenticationManager authenticationManager,
                       JwtUtil jwtUtil,
                       UserService userService,
                       PasswordEncoder passwordEncoder) {
        this.authenticationManager = authenticationManager;
        this.jwtUtil = jwtUtil;
        this.userService = userService;
        this.passwordEncoder = passwordEncoder;
    }

    public String login(LoginRequest request) {
        Authentication auth = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                        request.getUsername(), request.getPassword())
        );
        return jwtUtil.generateToken(auth.getName());
    }

    public void register(String username, String password) {
        User user = new User();
        user.setUsername(username);
        user.setPassword(passwordEncoder.encode(password));
        userService.save(user);
    }
}

11. `controller/AuthController.java`

package com.example.demo.controller;

import com.example.demo.dto.LoginRequest;
import com.example.demo.service.AuthService;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    private final AuthService authService;

    public AuthController(AuthService authService) {
        this.authService = authService;
    }

    @PostMapping("/login")
    public ResponseEntity<String> login(@RequestBody LoginRequest request) {
        String token = authService.login(request);
        return ResponseEntity.ok(token);
    }

    @PostMapping("/register")
    public ResponseEntity<Void> register(@RequestParam String username,
                                         @RequestParam String password) {
        authService.register(username, password);
        return ResponseEntity.ok().build();
    }
}

12. `controller/UserController.java`

package com.example.demo.controller;

import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/api/user")
public class UserController {

    @GetMapping("/me")
    public String getCurrentUser(Authentication auth) {
        return "Hello, " + auth.getName();
    }
}

13. `dto/LoginRequest.java`

package com.example.demo.dto;

import lombok.Data;

@Data
public class LoginRequest {
    private String username;
    private String password;
}

14. `dto/UserDto.java`

package com.example.demo.dto;

import lombok.Data;

@Data
public class UserDto {
    private Long id;
    private String username;
}

15. `resource/application.yml`

spring:
  profiles:
    active: h2 # 可改为 mysql, postgresql, rabbit, kafka 等
  jpa:
    hibernate:
      ddl-auto: create-drop
    show-sql: true
  datasource:
    url: jdbc:h2:mem:testdb
    driver-class-name: org.h2.Driver
    username: sa
    password: ''

app:
  jwt:
    secret: mySecretKey1234567890
    expiration-ms: 86400000

# 启用 MySQL 示例（在 application-mysql.yml 中）：
# spring:
#   datasource:
#     url: jdbc:mysql://localhost:3306/demo
#     username: root
#     password: root
#   jpa:
#     hibernate.ddl-auto: update

如何运行

1. 使用默认配置启动（H2 + JWT）

mvn spring-boot:run

2. 注册用户

curl -X POST http://localhost:8080/api/auth/register \
  -d "username=test" \
  -d "password=123456"

3. 登录获取 Token

curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "test", "password": "123456"}'

4. 访问受保护资源

curl -X GET http://localhost:8080/api/user/me \
  -H "Authorization: Bearer <token>"

扩展说明

扩展项	操作方式
切换数据库	修改 `spring.profiles.active=mysql` 并提供 `application-mysql.yml`
启用 RabbitMQ	添加 `spring-boot-starter-amqp` 依赖，激活 `rabbit` Profile
启用 Kafka	添加 `spring-kafka` 依赖，激活 `kafka` Profile
启用 OAuth2	取消 `SecurityConfig.java` 中的注释，并添加 `spring-boot-starter-oauth2-client` 依赖

Spring Boot MVP

典型 Spring Boot 后端 MVP（最小可行产品）项目

项目整体说明

项目结构与文件作用说明

基础模板代码

1. config/DatabaseConfig.java

2. config/MessageQueueConfig.java

3. config/JwtConfig.java

4. config/SecurityConfig.java

5. security/JwtUtil.java

6. security/JwtAuthenticationFilter.java

7. entity/User.java

8. repository/UserRepository.java

9. service/UserService.java

10. service/AuthService.java

11. controller/AuthController.java

12. controller/UserController.java

13. dto/LoginRequest.java

14. dto/UserDto.java

15. resource/application.yml

如何运行

1. 使用默认配置启动（H2 + JWT）

2. 注册用户

3. 登录获取 Token

4. 访问受保护资源

扩展说明

1. `config/DatabaseConfig.java`

2. `config/MessageQueueConfig.java`

3. `config/JwtConfig.java`

4. `config/SecurityConfig.java`

5. `security/JwtUtil.java`

6. `security/JwtAuthenticationFilter.java`

7. `entity/User.java`

8. `repository/UserRepository.java`

9. `service/UserService.java`

10. `service/AuthService.java`

11. `controller/AuthController.java`

12. `controller/UserController.java`

13. `dto/LoginRequest.java`

14. `dto/UserDto.java`

15. `resource/application.yml`