spring boot shrio前后端分离，未登陆时shrio返回json数据，而不是重定向，自定义ajax，封装ajax

迈不过友情╰ 2022-03-29 13:08 246阅读 0赞

### spring boot shrio前后端分离，未登陆时shrio返回json数据，而不是重定向 ###

springboot shrio整合后，默认在未登录的情况下shrio会将请求重定向到登陆页面，但是我配置了nginx的https后，发起的请求是https，但是如果是未登录，shrio则会将请求重定向到登陆页面，这个时候出现问题，这个重定向的请求是http，前端js就会报错。

解决思路，配置shrio自定义拦截器，如果是未登录的 返回对ajax友好的json数据。

并且我们希望前端能根据返回的数据进行判断用户是否登录，所以这里要对ajax进行封装。

> 关键步骤：添加shrio自定义拦截器

package com.ning.config;
    
    import java.io.IOException;
    
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    
    import org.apache.shiro.web.filter.authc.UserFilter;
    
    import com.alibaba.fastjson.JSON;
    import com.ning.utils.R;
    public class MyFilter extends UserFilter{
    
    	@Override
    	protected void redirectToLogin(ServletRequest request, ServletResponse response) throws IOException {
    		response.setContentType("application/json; charset=utf-8");
    		response.getWriter().print(JSON.toJSON(R.error(403, "请登录")));
    	}
    	
    }

> 将拦截器添加到shrio配置类中

package com.ning.config;
    
    import java.util.LinkedHashMap;
    import java.util.Map;
    
    import javax.servlet.Filter;
    
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.session.mgt.SessionManager;
    import org.apache.shiro.spring.LifecycleBeanPostProcessor;
    import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
    import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    import com.ning.utils.UserRealm;
    
    /**
     * Shiro配置
     *
     */
    @Configuration
    public class ShiroConfig {
    
        @Bean(name = "sessionManager")
        public SessionManager sessionManager(){
            DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
            //设置session过期时间为1小时(单位：毫秒)，默认为30分钟
            sessionManager.setGlobalSessionTimeout(60 * 60 * 1000 * 24 * 7);
            sessionManager.setSessionValidationSchedulerEnabled(true);
            sessionManager.setSessionIdUrlRewritingEnabled(false);
            return sessionManager;
        }
    
        @Bean(name = "securityManager")
        public SecurityManager securityManager(UserRealm userRealm, SessionManager sessionManager) {
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            //Realm 主要是从realm中获取相应的身份信息
            securityManager.setRealm(userRealm);
            securityManager.setSessionManager(sessionManager);
    
            return securityManager;
        }
    
        //传统方式是使用web.xml配置的。在shiro中使用@Bean注解方式实现过滤器。
        @Bean("shiroFilter")
        public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
            ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
            shiroFilter.setSecurityManager(securityManager);
            Map<String,Filter> filters = shiroFilter.getFilters();
            filters.put("authc", new MyFilter());
            shiroFilter.setFilters(filters);
            //shiroFilter.setLoginUrl("/login.html");//默认访问的首页面
            //shiroFilter.setSuccessUrl("/index.html");
            //shiroFilter.setUnauthorizedUrl("/");
            
            //anon代表是匿名访问方式，比如index.html是匿名访问的即不区分用户、谁都可以访问。
            Map<String, String> filterMap = new LinkedHashMap<>();
            filterMap.put("/public/**", "anon");
            filterMap.put("/favicon.ico", "anon");
            filterMap.put("/public/plugins/**", "anon");
            filterMap.put("/public/plugins/UE/jsp/**", "anon");
            filterMap.put("/webjars/**", "anon");
            filterMap.put("/api/**", "anon");
            filterMap.put("/originInfo/**", "anon");
            filterMap.put("/app/app/checkVersion", "anon");//app检查版本
            filterMap.put("/app/app/getNewVersion", "anon");//app下载最新版本
            	
            //swagger配置
            filterMap.put("/swagger**", "anon");
            filterMap.put("/v2/api-docs", "anon");
            filterMap.put("/swagger-resources/configuration/ui", "anon");
    
            filterMap.put("/login.html", "anon");
            filterMap.put("/index.html", "anon");
            filterMap.put("/json", "anon");
            filterMap.put("/sys/login", "anon");
            filterMap.put("/captcha.jpg", "anon");//认证码
            filterMap.put("/upload/ckUploadImg", "anon");
            filterMap.put("/upload/**", "anon");
            filterMap.put("/upload/ck/**", "anon");
            
            //authc代表是必须认证访问的。/**代表是除上面配置以外的其它资源。
            filterMap.put("/**", "authc");
            shiroFilter.setFilterChainDefinitionMap(filterMap);
            return shiroFilter;
        }
    
        @Bean(name = "lifecycleBeanPostProcessor")
        public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
            return new LifecycleBeanPostProcessor();
        }
    
        @Bean
        public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
            DefaultAdvisorAutoProxyCreator proxyCreator = new DefaultAdvisorAutoProxyCreator();
            proxyCreator.setProxyTargetClass(true);
            return proxyCreator;
        }
    
        @Bean
        public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
            AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
            advisor.setSecurityManager(securityManager);
            return advisor;
        }
    
    }

请注意关键部分代码

Map<String,Filter> filters = shiroFilter.getFilters();
            filters.put("authc", new MyFilter());

这里filters.put("authc", new MyFilter());map添加的key值必须为authc，之前我自定义是无效的。

这样如果用户在未登录状态发起请求，就会返回我们自定义的json字符串。下面是自定义ajax:

对ajax的成功回调函数进行封装，也可以对请求参数进行封装。方便使用。