spring boot shiro 采坑指南

旧城等待， 2022-05-26 13:57 201阅读 0赞

遇到的一个问题：ShiroFilterFactoryBean 配置完成后，该filter不起作用。

原因：在项目中还定义了一个别的DotDOFilter(该Filter的作用是把Url中xxx.do结尾Url修改成xxx)，  
在这个DotDOFilter中使用了request.getRequestDispatcher(uri).forward(request, response);

在这个DotDOFilter之后的ShiroFilter就不起作用了。

注意：Filter可以指定DispatcherType的类型，详见https://blog.csdn.net/xiaokang123456kao/article/details/72885171

处理方式：把ShiroFilter放在Filter前面即可.

@Bean  
public FilterRegistrationBean securityFilterChain(AbstractShiroFilter securityFilter) \{  
FilterRegistrationBean registration = new FilterRegistrationBean(securityFilter);  
registration.setOrder(Integer.MAX\_VALUE-1);//排在DotDOFilter的前面  
registration.setName("shiroFilter");  
//registration.setDispatcherTypes(DispatcherType.REQUEST,DispatcherType.FORWARD);  
registration.setDispatcherTypes(DispatcherType.REQUEST);  
return registration;

查看Filter顺序的方法：

![20180503190511198][]

参考：

1）filter中的dispatcher标签解析 https://blog.csdn.net/xiaokang123456kao/article/details/72885171

2）Shiro和AJAX完美整合 https://blog.csdn.net/wu560130911/article/details/11819761

3）springboot(十四)：springboot整合shiro-登录认证和权限管理 https://blog.csdn.net/ityouknow/article/details/73836159

4）Springboot与shiro整合遇到的坑 https://zhuanlan.zhihu.com/p/29161098

代码：

1）ShiroConfig.java

package com.alf.test.platform.config;
    
    import com.alf.test.platform.shiro.*;
    import org.apache.shiro.session.mgt.SessionManager;
    import org.apache.shiro.spring.LifecycleBeanPostProcessor;
    import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.apache.shiro.web.servlet.AbstractShiroFilter;
    import org.apache.shiro.web.servlet.SimpleCookie;
    import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
    import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
    import org.springframework.boot.web.servlet.FilterRegistrationBean;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.apache.shiro.mgt.SecurityManager;
    import org.springframework.context.annotation.DependsOn;
    
    import javax.servlet.DispatcherType;
    import javax.servlet.Filter;
    import java.util.HashMap;
    import java.util.LinkedHashMap;
    import java.util.Map;
    
    @Configuration
    public class ShiroConfig {
        /**
         * 配置Url过滤器
         * @param securityManager
         * @return
         */
        @Bean
        public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
            System.out.println("ShiroConfiguration.shirFilter()");
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    
            Map<String, Filter> filters = shiroFilterFactoryBean.getFilters();//获取filters
            filters.put("authc", new CustomFormAuthenticationFilter());//注入自定义的FormAuthenticationFilter
            filters.put("logout", new CustomLogoutFilter());//注入自定义的LogoutFilter
    
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            //拦截器.
            Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
            // 配置不会被拦截的链接 顺序判断
            //filterChainDefinitionMap.put("/abctest/test1", "myFilter1");
            filterChainDefinitionMap.put("/static/**", "anon");
    
            filterChainDefinitionMap.put("/swagger-ui.html", "anon");
            filterChainDefinitionMap.put("/swagger-resources", "anon");
            filterChainDefinitionMap.put("/v2/api-docs", "anon");
            filterChainDefinitionMap.put("/webjars/springfox-swagger-ui/**", "anon");
    
    //        filterChainDefinitionMap.put("/login", "anon");
    //        filterChainDefinitionMap.put("/logout", "anon");
            //配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
            filterChainDefinitionMap.put("/logout", "logout");
            filterChainDefinitionMap.put("/logout.do", "logout");
            //:这是一个坑呢，一不小心代码就不好使了;
            //
           // filterChainDefinitionMap.put("/**", "myFilter1,authc");
            filterChainDefinitionMap.put("/**", "authc");
            shiroFilterFactoryBean.setLoginUrl("/login");
            // 登录成功后要跳转的链接
            //shiroFilterFactoryBean.setSuccessUrl("/index");
    
            //未授权界面;
            shiroFilterFactoryBean.setUnauthorizedUrl("/403");
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    //        Map<String, Filter> map = new HashMap<>();
    //        map.put("myFilter1", new MyOncePerRequestFilter());
    //        shiroFilterFactoryBean.setFilters(map);
            return shiroFilterFactoryBean;
        }
    
        @Bean
        public FilterRegistrationBean securityFilterChain(AbstractShiroFilter securityFilter) {
            FilterRegistrationBean registration = new FilterRegistrationBean(securityFilter);
            registration.setOrder(Integer.MAX_VALUE-1);//排在ZHandleDotDOFilter的前面
            registration.setName("shiroFilter");
            //registration.setDispatcherTypes(DispatcherType.REQUEST,DispatcherType.FORWARD);
            registration.setDispatcherTypes(DispatcherType.REQUEST);
            return registration;
        }
    
        /**
         * Shiro生命周期处理器
         * @return
         */
        @Bean
        public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
            return new LifecycleBeanPostProcessor();
        }
        /**
         * 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
         * 配置以下两个bean(DefaultAdvisorAutoProxyCreator(可选)和AuthorizationAttributeSourceAdvisor)即可实现此功能
         * @return
         */
        @Bean
        @DependsOn({"lifecycleBeanPostProcessor"})
        public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
            DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
            advisorAutoProxyCreator.setProxyTargetClass(true);
            return advisorAutoProxyCreator;
        }
        @Bean
        public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(){
            AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
            authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
            return authorizationAttributeSourceAdvisor;
        }
    
        /**
         * 注入Realm
         * @return
         */
        @Bean
        public QdasShiroRealm qdasShiroRealm(){
            QdasShiroRealm qdasShiroRealm = new QdasShiroRealm();
            return qdasShiroRealm;
        }
    
    
        @Bean
        public SecurityManager securityManager(){
            DefaultWebSecurityManager securityManager =  new DefaultWebSecurityManager();
            securityManager.setRealm(qdasShiroRealm());
           securityManager.setSessionManager(configWebSessionManager());
            //securityManager.setCacheManager();
            return securityManager;
        }
    
        @Bean
        public SessionManager configWebSessionManager(){
            DefaultWebSessionManager manager = new DefaultWebSessionManager();
            //manager.setCacheManager(cacheManager);// 加入缓存管理器
            //manager.setSessionDAO(sessionDao);// 设置SessionDao
            manager.setDeleteInvalidSessions(true);// 删除过期的session
            manager.setGlobalSessionTimeout(1800000);// 设置全局session超时时间
            manager.setSessionValidationSchedulerEnabled(true);// 是否定时检查session
            manager.setSessionIdCookie(simpleCookie());
            return manager;
        }
    
        /**
         * 注入cookie模板
         * @return
         */
        @Bean
        public SimpleCookie simpleCookie(){
            SimpleCookie simpleCookie = new SimpleCookie("sid-shrio");
            simpleCookie.setMaxAge(-1);
            simpleCookie.setHttpOnly(true);
            return simpleCookie;
        }
    }

2）CustomFormAuthenticationFilter.java

package com.alf.test.platform.shiro;
    
    import com.alibaba.fastjson.JSONObject;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.subject.Subject;
    import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
    import org.apache.shiro.web.util.WebUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.servlet.ServletException;
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpSession;
    import java.io.BufferedReader;
    import java.io.IOException;
    import java.io.InputStreamReader;
    import java.io.OutputStream;
    
    /**
     * 自定义FormAuthenticationFilter：
     * 1 修改用户名和密码的获取方式，使用sid
     * 2 定义了登陆的Url
     * 3 修改了登陆成功和失败的处理方式
     */
    public class CustomFormAuthenticationFilter extends FormAuthenticationFilter {
    
        private static final Logger logger = LoggerFactory.getLogger(CustomFormAuthenticationFilter.class);
    
        public CustomFormAuthenticationFilter(){
            super();
        }
    
        @Override
        protected String getUsername(ServletRequest request) {
            try {
                JSONObject jsonObject = getJsonObject(request);
                return jsonObject.getString("sid");
            } catch (IOException e) {
                e.printStackTrace();
            }
    
            return super.getUsername(request);
        }
    
        public static JSONObject getJsonObject(ServletRequest request) throws IOException{
            String resultStr = "";
            String readLine;
            StringBuffer sb = new StringBuffer();
            BufferedReader responseReader = null;
            OutputStream outputStream = null;
            try {
                responseReader = new BufferedReader(new InputStreamReader(request.getInputStream(), "UTF-8"));
                while ((readLine = responseReader.readLine()) != null) {
                    sb.append(readLine).append("\n");
                }
                //responseReader.close();
                resultStr = sb.toString();
            } catch (Exception e) {
                e.printStackTrace();
            } finally {
                if (outputStream != null) {
                    //outputStream.close();
                }
            }
            return JSONObject.parseObject(resultStr);
        }
    
        protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
            // 在这里进行验证码的校验
            HttpServletRequest httpServletRequest = (HttpServletRequest) request;
            HttpSession session = httpServletRequest.getSession();
    
            return super.onAccessDenied(request, response);
        }
    
        /**
         * 目前项目中登陆URL为:/login.do, /login
         * @param request
         * @param response
         * @return
         */
        @Override
        protected boolean isLoginRequest(ServletRequest request, ServletResponse response) {
            String requestURI = getPathWithinApplication(request);
            if ("/login.do".equals(requestURI) || "/login".equals(requestURI)){
                return true;
            }
            return false;
        }
    
        /**
         * 目前使用XXXsid登陆, 不需要密码
         * @param request
         * @return
         */
        @Override
        protected String getPassword(ServletRequest request) {
            return "";
        }
    
        /**
         * 登陆成功, 直接执行接下来的流程
         * @param token
         * @param subject
         * @param request
         * @param response
         * @return
         * @throws Exception
         */
        protected boolean onLoginSuccess(AuthenticationToken token, Subject subject,
                                         ServletRequest request, ServletResponse response) throws Exception {
            logger.info("登陆成功!");
            return true;
        }
    
        /**
         * 重写该方法, 使用Dispatcher, 转发到指定controller
         * @param request
         * @param response
         * @throws IOException
         */
        protected void saveRequestAndRedirectToLogin(ServletRequest request, ServletResponse response) throws IOException {
            try {
                request.getRequestDispatcher("/noLogin").forward(request, response);
            } catch (ServletException e) {
                e.printStackTrace();
            }
        }
    }

3）CustomLogoutFilter.java

package com.alf.test.platform.shiro;
    
    import org.apache.shiro.session.SessionException;
    import org.apache.shiro.subject.Subject;
    import org.apache.shiro.web.filter.authc.LogoutFilter;
    import org.apache.shiro.web.util.WebUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    import java.util.Locale;
    
    public class CustomLogoutFilter extends LogoutFilter {
        private static final Logger logger = LoggerFactory.getLogger(CustomLogoutFilter.class);
        @Override
        protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
    
            Subject subject = getSubject(request, response);
    
            // Check if POST only logout is enabled
            if (isPostOnlyLogout()) {
    
                // check if the current request's method is a POST, if not redirect
                if (!WebUtils.toHttp(request).getMethod().toUpperCase(Locale.ENGLISH).equals("POST")) {
                    return onLogoutRequestNotAPost(request, response);
                }
            }
    
            //String redirectUrl = getRedirectUrl(request, response, subject);
            //try/catch added for SHIRO-298:
    //        try {
    //            subject.logout();
    //        } catch (SessionException ise) {
    //            logger.debug("Encountered session exception during logout.  This can generally safely be ignored.", ise);
    //        }
            //issueRedirect(request, response, redirectUrl);
            return true;
        }
    
        @Override
        public void afterCompletion(ServletRequest request, ServletResponse response, Exception exception) throws Exception {
            Subject subject = getSubject(request, response);
            try {
                subject.logout();
            } catch (SessionException ise) {
                logger.debug("Encountered session exception during logout.  This can generally safely be ignored.", ise);
            }
        }
    }

4）DotDOFilter.java

package com.alf.test.config;
    
    import org.springframework.context.annotation.Configuration;
    import org.springframework.core.annotation.Order;
    import org.springframework.web.filter.RequestContextFilter;
    
    import javax.servlet.FilterChain;
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebFilter;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /**
     * 处理aaa.do访问aaa的问题
     */
    @Configuration
    @WebFilter(urlPatterns = "/")
    public class DotDOFilter extends RequestContextFilter {
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
            String uri = request.getRequestURI();
            if (uri.endsWith(".do")) {
                uri = uri.substring(0, uri.length() - 3);
                request.getRequestDispatcher(uri).forward(request, response);
            } else {
                super.doFilterInternal(request, response, filterChain);
            }
        }
    }

[20180503190511198]: /images/20220526/29a5e5d2202d4215bd668b7e2986d3bb.png