Shiro--用Session控制权限--使用/教程/实例

迈不过友情╰ 2022-09-11 10:23 136阅读 0赞

原文网址：[Shiro--用Session控制权限--使用/教程/实例\_IT利刃出鞘的博客-CSDN博客][Shiro--_Session_--_IT_-CSDN]

# 简介 #

**说明**

本文用实例展示Shiro的使用，通过Session控制权限。

1.  尽量使用原生的shiro配置，尽量少自定义配置。
2.  我自己自测通过，代码可用。

**使用形式**

1.  使用Shiro默认的session来管理权限。
2.  使用Shiro默认的缓存来放session。
    
    1.  用本地Map存session，重启即失效。
    2.  本地Map意味着只能单机，无法多个服务共享session。
3.  使用角色和资源权限两种方式。（注解的方式）
4.  使用Shiro默认的过滤器。
5.  使用Knife4j测试（Swagger的升级版）。
6.  使用shiro-spring-boot-web-starter:1.7.0

**技术栈**

1.  shiro-spring-boot-web-starter：1.7.0
2.  spring-boot-starter-parent：2.3.8.RELEASE
3.  mysql：8.0
4.  mybatis-plus-boot-starter：3.4.3.1（持久层框架）
5.  lombok（简化代码）
6.  knife4j-spring-boot-starter：3.0.3（接口文档（swagger的升级版））

**业务场景**

本文假设做一个商城系统。

**角色如下**

*  admin：有所有权限
    
     *  使用shiro通配符：\*:\*
 *  productManager：有product的所有权限
    
     *  product:add，product:delete，product:edit，product:view
     *  本处把这四个权限单独赋予productManager这个角色，实际项目里可以将product:\*这个权限赋予productManager这个角色。
 *  orderManager：有order的所有权限
    
     *  order:add，product:delete，product:edit，product:view
     *  本处把这四个权限单独赋予productManager这个角色，实际项目里可以将product:\*这个权限赋予productManager这个角色。

**用户密码及权限如下**

<table> 
 <tbody> 
 <tr> 
 <td> 用户 </td> 
 <td> 密码 </td> 
 <td> 角色 </td> 
 <td> 拥有的权限 </td> 
 </tr> 
 <tr> 
 <td> zhang3 </td> 
 <td> 12345 </td> 
 <td> admin </td> 
 <td> 所有权限。 </td> 
 </tr> 
 <tr> 
 <td> li4 </td> 
 <td> abcde </td> 
 <td> productManager </td> 
 <td> 产品的所有权限。 </td> 
 </tr> 
 </tbody> 
</table>

**本处为了测试功能，赋予以下特殊权限：**

*  验证shiro可单独通过角色来控制权限
    
     *  给编辑订单接口设置角色权限：
        
         *  @RequiresRoles(value = \{"admin,productManager"\}, logical = Logical.OR)
 *  验证shiro无法在一个接口上同时加@RequiresRoles和@RequiresPermissions
    
     *  给查看订单的接口设置角色权限与资源权限：
        
         *  @RequiresPermissions("order:view")  
            @RequiresRoles(value = \{"admin,productManager"\}, logical = Logical.OR)

# 代码 #

## 项目结构 ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70][]

## 表结构及数据 ##

为了简化代码，用户、角色、权限直接用SQL生成到数据库，实际开发中是要通过Controller去增删改的。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBASVTliKnliIPlh7rpnpg_size_20_color_FFFFFF_t_70_g_se_x_16][]

**business.sql**

DROP DATABASE IF EXISTS shiro;
    CREATE DATABASE shiro DEFAULT CHARACTER SET utf8;
    USE shiro;
    
    DROP TABLE IF EXISTS t_user;
    DROP TABLE IF EXISTS t_role;
    DROP TABLE IF EXISTS t_permission;
    DROP TABLE IF EXISTS t_user_role_mid;
    DROP TABLE IF EXISTS t_role_permission_mid;
    
    create table t_user (
      id bigint AUTO_INCREMENT,
      user_name VARCHAR(100),
      password VARCHAR(100),
      salt VARCHAR(100),
      PRIMARY KEY(id)
    ) charset=utf8 ENGINE=InnoDB;
    
    create table t_role (
      id bigint AUTO_INCREMENT,
      name VARCHAR(100),
      description VARCHAR(100),
      PRIMARY KEY(id)
    ) charset=utf8 ENGINE=InnoDB;
    
    create table t_permission (
      id bigint AUTO_INCREMENT,
      name VARCHAR(100),
      description VARCHAR(100),
      PRIMARY KEY(id)
    ) charset=utf8 ENGINE=InnoDB;
    
    create table t_user_role_mid (
      id bigint AUTO_INCREMENT,
      user_id bigint,
      role_id bigint,
      PRIMARY KEY(id)
    ) charset=utf8 ENGINE=InnoDB;
    
    create table t_role_permission_mid (
      id bigint AUTO_INCREMENT,
      role_id bigint,
      permission_id bigint,
      PRIMARY KEY(id)
    ) charset=utf8 ENGINE=InnoDB;
    
    -- 密码：12345
    INSERT INTO `t_user` VALUES (1,'zhang3','a7d59dfc5332749cb801f86a24f5f590','e5ykFiNwShfCXvBRPr3wXg==');
    -- 密码：abcde
    INSERT INTO `t_user` VALUES (2,'li4','43e28304197b9216e45ab1ce8dac831b','jPz19y7arvYIGhuUjsb6sQ==');
    INSERT INTO `t_role` VALUES (1,'admin','超级管理员');
    INSERT INTO `t_role` VALUES (2,'productManager','产品管理员');
    INSERT INTO `t_role` VALUES (3,'orderManager','订单管理员');
    INSERT INTO `t_permission` VALUES (1,'*:*','所有权限');
    INSERT INTO `t_permission` VALUES (2,'product:add','增加产品');
    INSERT INTO `t_permission` VALUES (3,'product:delete','删除产品');
    INSERT INTO `t_permission` VALUES (4,'product:edit','编辑产品');
    INSERT INTO `t_permission` VALUES (5,'product:view','查看产品');
    INSERT INTO `t_permission` VALUES (6,'order:add','增加订单');
    INSERT INTO `t_permission` VALUES (7,'order:delete','删除订单');
    INSERT INTO `t_permission` VALUES (8,'order:edit','编辑订单');
    INSERT INTO `t_permission` VALUES (9,'order:view','查看订单');
    INSERT INTO `t_user_role_mid` VALUES (1,2,2);
    INSERT INTO `t_user_role_mid` VALUES (2,1,1);
    INSERT INTO `t_role_permission_mid` VALUES (1,1,1);
    INSERT INTO `t_role_permission_mid` VALUES (2,2,2);
    INSERT INTO `t_role_permission_mid` VALUES (3,2,3);
    INSERT INTO `t_role_permission_mid` VALUES (4,2,4);
    INSERT INTO `t_role_permission_mid` VALUES (5,2,5);
    INSERT INTO `t_role_permission_mid` VALUES (6,3,6);
    INSERT INTO `t_role_permission_mid` VALUES (7,3,7);
    INSERT INTO `t_role_permission_mid` VALUES (8,3,8);
    INSERT INTO `t_role_permission_mid` VALUES (9,3,9);

## 配置及依赖 ##

**application.yml**

spring:
      datasource:
        driver-class-name: com.mysql.cj.jdbc.Driver
        url: jdbc:mysql://127.0.0.1:3306/shiro?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai
        username: root
        password: 222333
    
    # mybatis-plus打印SQL日志
    mybatis-plus:
      configuration:
        log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
    
    shiro:
      enabled: true       # 开启 shiro，默认为 true
      web:
        enabled: true     # 开启 shiro Web，默认为 true
      loginUrl: /login    # 登录地址，默认为"login.jsp"
      successUrl: /index  # 登录成功后跳转的地址，默认为"/"
      unauthorizedUrl: /unauthorized          # 未获授权默认跳转地址
      sessionManager:
        sessionIdCookieEnabled: true          # 是否允许通过 Cookie 实现会话跟踪，默认为 true。
        sessionIdUrlRewritingEnabled: false   # 是否将JSESSIONID放到url中，默认为 true。
      #  annotations:
      #    enabled: true    # 开启shiro的注解。比如：@RequiresRole。
      # 开启shiro注解一共有三种方式。
      #     1.引入spring aop依赖：org.springframework.boot:spring-boot-starter-aop
      #     2.在application.yml里边设置：shiro.annotations.enabled=true。
      #         对应：ShiroAnnotationProcessorAutoConfiguration.class
      #     3.提供一个AuthorizationAttributeSourceAdvisor这个bean
      #  强烈建议使用第1种，因为shiro自带的aop与spring aop只能用一个，如果用了shiro的aop，那么很多
      #  spring的注解就失效了。比如：@Async，@Cacheable

**pom.xml**

<?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 <modelVersion>4.0.0</modelVersion>
 <parent>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-parent</artifactId>
 <version>2.3.8.RELEASE</version>
 <relativePath/> 
 </parent>
 <groupId>com.example</groupId>
 <artifactId>shiro_1_origin</artifactId>
 <version>0.0.1-SNAPSHOT</version>
 <name>shiro_1_origin</name>
 <description>shiro_1_origin</description>
 <properties>
 <java.version>1.8</java.version>
 </properties>
 <dependencies>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
 </dependency>
 
 <dependency>
 <groupId>mysql</groupId>
 <artifactId>mysql-connector-java</artifactId>
 <scope>runtime</scope>
 </dependency>
 
 
 <dependency>
 <groupId>com.baomidou</groupId>
 <artifactId>mybatis-plus-boot-starter</artifactId>
 <version>3.4.3.1</version>
 </dependency>
 
 
 <dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-spring-boot-web-starter</artifactId>
 <version>1.7.1</version>
 </dependency>
 
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-aop</artifactId>
 </dependency>
 
 <dependency>
 <groupId>org.projectlombok</groupId>
 <artifactId>lombok</artifactId>
 <optional>true</optional>
 </dependency>
 
 <dependency>
 <groupId>com.github.xiaoymin</groupId>
 <artifactId>knife4j-spring-boot-starter</artifactId>
 <version>3.0.3</version>
 </dependency>
 
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-test</artifactId>
 <scope>test</scope>
 </dependency>
 </dependencies>
 
 <build>
 <plugins>
 <plugin>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-maven-plugin</artifactId>
 <configuration>
 <excludes>
 <exclude>
 <groupId>org.projectlombok</groupId>
 <artifactId>lombok</artifactId>
 </exclude>
 </excludes>
 </configuration>
 </plugin>
 </plugins>
 </build>
 
 </project>

## 配置类（config包） ##

**shiro配置**

**总配置**

package com.example.demo.config.shiro;
    
    import com.example.demo.common.constant.WhiteList;
    import com.example.demo.config.shiro.realm.DatabaseRealm;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.mgt.SessionsSecurityManager;
    import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
    import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
    import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    @Configuration
    public class ShiroConfig {
        @Bean
        public ShiroFilterChainDefinition shiroFilterChainDefinition() {
            DefaultShiroFilterChainDefinition chainDefinition = new DefaultShiroFilterChainDefinition();
    
            chainDefinition.addPathDefinition("/login", "anon");
    
            WhiteList.ALL.forEach(str -> {
                chainDefinition.addPathDefinition(str, "anon");
            });
    
            // all other paths require a logged in user
            chainDefinition.addPathDefinition("/**", "authc");
            return chainDefinition;
        }
    
        // 名字必须是securityManager
        @Bean(name = "securityManager")
        public SessionsSecurityManager securityManager() {
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            //设置realm.
            securityManager.setRealm(getDatabaseRealm());
            securityManager.setSessionManager(sessionManager());
            // securityManager.setCacheManager();  //支持缓存
            return securityManager;
        }
    
        // 名字必须是sessionManager
        @Bean(name = "sessionManager")
        public DefaultWebSessionManager sessionManager() {
            DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
            // 设置session过期时间（5分钟）。单位：ms，默认为30分钟。
            sessionManager.setGlobalSessionTimeout(300000L);
            return sessionManager;
        }
    
        @Bean
        public DatabaseRealm getDatabaseRealm() {
            DatabaseRealm myShiroRealm = new DatabaseRealm();
            myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
            return myShiroRealm;
        }
    
        /**
         * 凭证匹配器。密码校验交给Shiro的SimpleAuthenticationInfo进行处理。
         *  对应：DatabaseRealm#doGetAuthenticationInfo(AuthenticationToken)
         */
        @Bean
        public HashedCredentialsMatcher hashedCredentialsMatcher() {
            HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
    
            hashedCredentialsMatcher.setHashAlgorithmName("md5");//散列算法:这里使用MD5算法;
            hashedCredentialsMatcher.setHashIterations(2);//散列的次数，比如散列两次，相当于 md5(md5("xxx"));
            hashedCredentialsMatcher.setStoredCredentialsHexEncoded(true);
    
            return hashedCredentialsMatcher;
        }
    
        /**
         * setUsePrefix(true)用于解决一个奇怪的bug。如下：
         *  在引入spring aop的情况下，在@Controller注解的类的方法中加入@RequiresRole等
         *  shiro注解，会导致该方法无法映射请求，导致返回404。加入这项配置能解决这个bug。
         */
        @Bean
        public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator(){
            DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator=new DefaultAdvisorAutoProxyCreator();
            defaultAdvisorAutoProxyCreator.setUsePrefix(true);
            return defaultAdvisorAutoProxyCreator;
        }
    
        /**
         * 开启shiro 注解。比如：@RequiresRole
         * 本处不用此方法开启注解，使用引入spring aop依赖的方式。原因见：application.yml里的注释
         */
        /*@Bean
        public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(
                SecurityManager securityManager) {
            AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor =
                    new AuthorizationAttributeSourceAdvisor();
            authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
            return authorizationAttributeSourceAdvisor;
        }*/
    }

**Realm**

package com.example.demo.config.shiro.realm;
 
 import com.example.demo.business.rbac.permission.service.PermissionService;
 import com.example.demo.business.rbac.role.service.RoleService;
 import com.example.demo.business.rbac.user.entity.User;
 import com.example.demo.business.rbac.user.service.UserService;
 import com.example.demo.common.exception.BusinessException;
 import org.apache.shiro.authc.*;
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
 import org.apache.shiro.util.ByteSource;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Lazy;
 
 import java.util.Set;
 
 public class DatabaseRealm extends AuthorizingRealm {
 @Lazy
 @Autowired
 private UserService userService;
 
 @Lazy
 @Autowired
 private RoleService roleService;
 
 @Lazy
 @Autowired
 private PermissionService permissionService;
 
 // 登录认证
 @Override
 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
 throws AuthenticationException {
 // 获取账号密码
 UsernamePasswordToken t = (UsernamePasswordToken) token;
 String userName = token.getPrincipal().toString();
 // 获取数据库中的密码
 User user = userService.lambdaQuery().eq(User::getUserName, userName).one();
 if (user == null) {
 throw new BusinessException("用户不存在");
 }
 String passwordInDB = user.getPassword();
 String salt = user.getSalt();
 // 认证信息里存放账号密码, getName() 是当前Realm的继承方法,通常返回当前类名 :databaseRealm
 // 盐也放进去
 // 这样通过ShiroConfig里配置的 HashedCredentialsMatcher 进行自动校验
 SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
 userName, passwordInDB, ByteSource.Util.bytes(salt), getName());
 return authenticationInfo;
 }
 
 // 权限验证
 // 只有用到org.apache.shiro.web.filter.authz包里默认的过滤器才会走到这里。本项目里，实际不会走到这里。
 @Override
 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
 // 能进入到这里，表示账号已经通过认证了
 String userName = (String) principalCollection.getPrimaryPrincipal();
 // 通过service获取角色和权限
 Set<String> permissions = permissionService.getPermissionsByUserName(userName);
 Set<String> roles = roleService.getRolesByUserName(userName);
 
 // 授权对象
 SimpleAuthorizationInfo s = new SimpleAuthorizationInfo();
 // 把通过service获取到的角色和权限放进去
 s.setStringPermissions(permissions);
 s.setRoles(roles);
 return s;
 }
 }

**Knife4j配置（接口文档）**

package com.example.demo.config;
    
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import springfox.documentation.builders.ApiInfoBuilder;
    import springfox.documentation.builders.PathSelectors;
    import springfox.documentation.builders.RequestHandlerSelectors;
    import springfox.documentation.service.Contact;
    import springfox.documentation.spi.DocumentationType;
    import springfox.documentation.spring.web.plugins.Docket;
    import springfox.documentation.swagger2.annotations.EnableSwagger2;
     
    @Configuration
    @EnableSwagger2
    public class Knife4jConfig {
        @Bean(value = "defaultApi2")
        public Docket defaultApi2() {
            Docket docket=new Docket(DocumentationType.SWAGGER_2)
                    .apiInfo(new ApiInfoBuilder()
                            .title("我的标题")
                            .description("我的描述")
                            // .termsOfServiceUrl("http://www.xx.com/")
                            .contact(new Contact("daoren", "https://knife.blog.csdn.net", "xx@qq.com"))
                            .version("1.0")
                            .build())
                    //分组名称
                    .groupName("all")
                    .select()
                    //指定Controller扫描路径。可以不具体到controller，它会扫描指定路径下的所有
                    .apis(RequestHandlerSelectors.basePackage("com.example.demo"))
                    .paths(PathSelectors.any())
                    .build();
            return docket;
        }
    }

## 业务（business包） ##

**登录（login）**

**controller**

package com.example.demo.business.login.controller;
    
    import com.example.demo.business.login.entity.LoginRequest;
    import com.example.demo.business.login.entity.LoginVO;
    import com.example.demo.business.rbac.user.entity.User;
    import com.example.demo.business.rbac.user.service.UserService;
    import com.example.demo.common.exception.BusinessException;
    import io.swagger.annotations.Api;
    import io.swagger.annotations.ApiOperation;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.session.Session;
    import org.apache.shiro.subject.Subject;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RequestBody;
    import org.springframework.web.bind.annotation.RestController;
    
    @Api(tags = "登录")
    @RestController
    public class LoginController {
        @Autowired
        private UserService userService;
    
        @ApiOperation("登录")
        @PostMapping("login")
        public LoginVO login(@RequestBody LoginRequest loginRequest) {
            String userName = loginRequest.getUserName();
            String password = loginRequest.getPassword();
            UsernamePasswordToken token = new UsernamePasswordToken(userName, password);
    
            Subject subject = SecurityUtils.getSubject();
            try {
                subject.login(token);
                // 这个没用，不要打开。若打开，在使用shiro-redis时会序列化失败，因为这个subject是
                // WebDelegatingSubject类型，没实现serializable接口。若想往session里放东西，必须
                // 实现Serializable接口。
                // 当然，本项目没有用到shiro-redis进行序列化，只是提示一下。
                // Session session = subject.getSession();
                // session.setAttribute("subject", subject);
                return fillResult(userName);
            } catch (AuthenticationException e) {
                throw new BusinessException("身份验证失败");
            }
        }
    
        private LoginVO fillResult(String userName) {
            User user = userService.lambdaQuery()
                    .eq(User::getUserName, userName)
                    .one();
            LoginVO loginVO = new LoginVO();
            loginVO.setUserId(user.getId());
            loginVO.setUserName(user.getUserName());
            return loginVO;
        }
    }

**entity**

package com.example.demo.business.login.entity;
    
    import lombok.Data;
    
    @Data
    public class LoginRequest {
        private String userName;
        private String password;
    }

package com.example.demo.business.login.entity;
    
    import lombok.Data;
    
    @Data
    public class LoginVO {
        private Long userId;
        private String userName;
    }

**登录（logout）**

package com.example.demo.business.logout;
 
 import com.example.demo.common.entity.Result;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import org.apache.shiro.SecurityUtils;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 @Api(tags = "登出")
 @RestController
 public class LogoutController {
 
 @ApiOperation("登出")
 @PostMapping("logout")
 public Result<Object> logout() {
 SecurityUtils.getSubject().logout();
 return new Result();
 }
 }

**产品（product）**

controller

package com.example.demo.business.product;
 
 import com.example.demo.common.entity.Result;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 @Api(tags = "产品")
 @RestController
 @RequestMapping("product")
 public class ProductController {
 @RequiresPermissions("product:add")
 @ApiOperation(value="增加产品")
 @PostMapping("add")
 public Result add() {
 return new Result<>().message("product:add success");
 }
 
 @RequiresPermissions("product:delete")
 @ApiOperation(value="删除产品")
 @PostMapping("delete")
 public Result delete() {
 return new Result<>().message("product:delete success");
 }
 
 @RequiresPermissions("product:edit")
 @ApiOperation(value="编辑产品")
 @PostMapping("edit")
 public Result edit() {
 return new Result<>().message("product:edit success");
 }
 
 @RequiresPermissions("product:view")
 @ApiOperation(value="查看产品")
 @GetMapping("view")
 public Result view() {
 return new Result<>().message("product:view success");
 }
 }

**订单**

package com.example.demo.business.order;
 
 import com.example.demo.common.entity.Result;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
 import org.apache.shiro.authz.annotation.Logical;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.apache.shiro.authz.annotation.RequiresRoles;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 @Api(tags = "订单")
 @RestController
 @RequestMapping("order")
 public class OrderController {
 @RequiresPermissions("order:add")
 @ApiOperation(value="增加订单")
 @PostMapping("add")
 public Result add() {
 return new Result<>().message("order:add success");
 }
 
 @RequiresRoles(value = {"admin", "orderManager"}, logical = Logical.OR)
 @ApiOperation(value="删除订单")
 @PostMapping("delete")
 public Result delete() {
 return new Result<>().message("order:delete success");
 }
 
 // 管理员或者订单管理员有权限
 @RequiresRoles(value = {"admin", "productManager"}, logical = Logical.OR)
 @ApiOperation(value="编辑订单")
 @PostMapping("edit")
 public Result edit() {
 return new Result<>().message("order:edit success");
 }
 
 // 此时必须同时满足这两个注解的条件才允许访问
 @RequiresPermissions("order:view")
 @RequiresRoles(value = {"admin", "productManager"}, logical = Logical.OR)
 @ApiOperation(value="查看订单")
 @GetMapping("view")
 public Result view() {
 return new Result<>().message("order:view success");
 }
 }

**用户（user）**

service

package com.example.demo.business.rbac.user.service;
 
 import com.baomidou.mybatisplus.extension.service.IService;
 import com.example.demo.business.rbac.user.entity.User;
 
 public interface UserService extends IService<User> {
 
 }

package com.example.demo.business.rbac.user.service.impl;
 
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.example.demo.business.rbac.user.entity.User;
 import com.example.demo.business.rbac.user.mapper.UserMapper;
 import com.example.demo.business.rbac.user.service.UserService;
 import org.springframework.stereotype.Service;
 
 @Service
 public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService {
 
 }

mapper

package com.example.demo.business.rbac.user.mapper;
 
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.example.demo.business.rbac.user.entity.User;
 import org.springframework.stereotype.Repository;
 
 @Repository
 public interface UserMapper extends BaseMapper<User> {
 
 }

entity

package com.example.demo.business.rbac.user.entity;
    
    import com.baomidou.mybatisplus.annotation.IdType;
    import com.baomidou.mybatisplus.annotation.TableId;
    import com.baomidou.mybatisplus.annotation.TableName;
    import lombok.Data;
    import lombok.EqualsAndHashCode;
    
    @Data
    @EqualsAndHashCode(callSuper = false)
    @TableName("t_user")
    public class User {
        @TableId(value = "id", type = IdType.AUTO)
        private Long id;
    
        private String userName;
    
        private String password;
    
        private String salt;
    
    }

**角色（role）**

service

package com.example.demo.business.rbac.role.service;
 
 import com.baomidou.mybatisplus.extension.service.IService;
 import com.example.demo.business.rbac.role.entity.Role;
 
 import java.util.Set;
 
 public interface RoleService extends IService<Role> {
 Set<String> getRolesByUserName(String userName);
 }

package com.example.demo.business.rbac.role.service.impl;
 
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.example.demo.business.rbac.role.entity.Role;
 import com.example.demo.business.rbac.role.mapper.RoleMapper;
 import com.example.demo.business.rbac.role.service.RoleService;
 import org.springframework.stereotype.Service;
 
 import java.util.Set;
 
 @Service
 public class RoleServiceImpl extends ServiceImpl<RoleMapper, Role> implements RoleService {
 
 @Override
 public Set<String> getRolesByUserName(String userName) {
 return this.getBaseMapper().getRolesByUserName(userName);
 }
 }

**mapper**

package com.example.demo.business.rbac.role.mapper;
 
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.example.demo.business.rbac.role.entity.Role;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
 import org.springframework.stereotype.Repository;
 
 import java.util.Set;
 
 @Repository
 public interface RoleMapper extends BaseMapper<Role> {
 @Select("SELECT " +
 " t_role.`name` " +
 "FROM " +
 " t_user, " +
 " t_user_role_mid, " +
 " t_role " +
 "WHERE " +
 " t_user.`user_name` = #{userName} " +
 " AND t_user.id = t_user_role_mid.user_id " +
 " AND t_user_role_mid.role_id = t_role.id")
 Set<String> getRolesByUserName(@Param("userName")String userName);
 }

entity

package com.example.demo.business.rbac.role.entity;
    
    import com.baomidou.mybatisplus.annotation.IdType;
    import com.baomidou.mybatisplus.annotation.TableId;
    import com.baomidou.mybatisplus.annotation.TableName;
    import lombok.Data;
    import lombok.EqualsAndHashCode;
    
    @Data
    @EqualsAndHashCode(callSuper = false)
    @TableName("t_role")
    public class Role {
        @TableId(value = "id", type = IdType.AUTO)
        private Long id;
    
        private String name;
    
        private String description;
    
    }

**权限（permission）**

service

package com.example.demo.business.rbac.permission.service;
 
 import com.baomidou.mybatisplus.extension.service.IService;
 import com.example.demo.business.rbac.permission.entity.Permission;
 
 import java.util.List;
 import java.util.Set;
 
 public interface PermissionService extends IService<Permission> {
 Set<String> getPermissionsByUserName(String userName);
 }

package com.example.demo.business.rbac.permission.service.impl;
 
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import com.example.demo.business.rbac.permission.entity.Permission;
 import com.example.demo.business.rbac.permission.mapper.PermissionMapper;
 import com.example.demo.business.rbac.permission.service.PermissionService;
 import org.springframework.stereotype.Service;
 
 import java.util.List;
 import java.util.Set;
 
 @Service
 public class PermissionServiceImpl extends ServiceImpl<PermissionMapper, Permission> implements PermissionService {
 
 @Override
 public Set<String> getPermissionsByUserName(String userName) {
 return this.getBaseMapper().getPermissionsByUserName(userName);
 }
 }

mapper

package com.example.demo.business.rbac.permission.mapper;
 
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.example.demo.business.rbac.permission.entity.Permission;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
 import org.springframework.stereotype.Repository;
 
 import java.util.List;
 import java.util.Set;
 
 @Repository
 public interface PermissionMapper extends BaseMapper<Permission> {
 @Select("SELECT " +
 " t_permission.`name` " +
 "FROM " +
 " t_user, " +
 " t_user_role_mid, " +
 " t_role, " +
 " t_role_permission_mid, " +
 " t_permission " +
 "WHERE " +
 " t_user.`user_name` = #{userName} " +
 " AND t_user.id = t_user_role_mid.user_id " +
 " AND t_user_role_mid.role_id = t_role.id " +
 " AND t_role.id = t_role_permission_mid.role_id " +
 " AND t_role_permission_mid.permission_id = t_permission.id")
 Set<String> getPermissionsByUserName(@Param("userName") String userName);
 }

entity

package com.example.demo.business.rbac.permission.entity;
    
    import com.baomidou.mybatisplus.annotation.IdType;
    import com.baomidou.mybatisplus.annotation.TableId;
    import com.baomidou.mybatisplus.annotation.TableName;
    import lombok.Data;
    import lombok.EqualsAndHashCode;
    
    @Data
    @EqualsAndHashCode(callSuper = false)
    @TableName("t_permission")
    public class Permission {
        @TableId(value = "id", type = IdType.AUTO)
        private Long id;
    
        private String name;
    
        private String description;
    
    }

## 公共（common包） ##

**启动类**

当然，这个没在common包，但也算个公共的东西，放这来吧。

package com.example.demo;
    
    import org.mybatis.spring.annotation.MapperScan;
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    
    @SpringBootApplication
    @MapperScan("com.example.demo.**.mapper")
    public class ShiroApplication {
    
        public static void main(String[] args) {
            SpringApplication.run(ShiroApplication.class, args);
        }
    
    }

**全局异常处理**

package com.example.demo.common.advice;
 
 import com.example.demo.common.entity.Result;
 import com.example.demo.common.exception.BusinessException;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.core.annotation.Order;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 
 @Slf4j
 @Order(Ordered.LOWEST_PRECEDENCE - 1)
 @RestControllerAdvice
 public class GlobalExceptionAdvice {
 @ExceptionHandler(Exception.class)
 public Result<Object> handleException(Exception e) throws Exception {
 log.error(e.getMessage(), e);
 
 // 如果某个自定义异常有@ResponseStatus注解，就继续抛出
 if (AnnotationUtils.findAnnotation(e.getClass(), ResponseStatus.class) != null) {
 throw e;
 }
 
 // 实际项目中应该这样写，防止用户看到详细的异常信息
 // return new Result().failure().message.message("操作失败");
 return new Result<>().failure().message(e.getMessage());
 }
 
 @ExceptionHandler(BusinessException.class)
 public Result<Object> handleBusinessException(Exception e) throws Exception {
 log.error(e.getMessage(), e);
 
 // 如果某个自定义异常有@ResponseStatus注解，就继续抛出
 if (AnnotationUtils.findAnnotation(e.getClass(), ResponseStatus.class) != null) {
 throw e;
 }
 
 // 实际项目中应该这样写，防止用户看到详细的异常信息
 // return new Result<>().failure().message("操作失败");
 return new Result<>().failure().message(e.getMessage());
 }
 }

**全局响应处理**

package com.example.demo.common.advice;
 
 import com.example.demo.common.entity.Result;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.core.MethodParameter;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;
 import org.springframework.http.MediaType;
 import org.springframework.http.converter.HttpMessageConverter;
 import org.springframework.http.server.ServerHttpRequest;
 import org.springframework.http.server.ServerHttpResponse;
 import org.springframework.util.AntPathMatcher;
 import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;
 
 import java.util.Arrays;
 import java.util.List;
 
 @Slf4j
 @Order(Ordered.LOWEST_PRECEDENCE)
 @ControllerAdvice
 public class GlobalResponseBodyAdvice implements ResponseBodyAdvice<Object> {
 private List<String> KNIFE4J_URI = Arrays.asList(
 "/doc.html",
 "/swagger-resources",
 "/swagger-resources/configuration",
 "/v3/api-docs",
 "/v2/api-docs");
 @Override
 public boolean supports(MethodParameter returnType,
 Class<? extends HttpMessageConverter<?>> converterType) {
 // 若接口返回的类型本身就是ResultWrapper，则无需操作，返回false
 // return !returnType.getParameterType().equals(ResultWrapper.class);
 return true;
 }
 
 @Override
 @ResponseBody
 public Object beforeBodyWrite(Object body, MethodParameter returnType,
 MediaType selectedContentType,
 Class<? extends HttpMessageConverter<?>> selectedConverterType,
 ServerHttpRequest request, ServerHttpResponse response) {
 if (body instanceof String) {
 // 若返回值为String类型，需要包装为String类型返回。否则会报错
 try {
 ObjectMapper objectMapper = new ObjectMapper();
 Result<Object> result = new Result<>().data(body);
 return objectMapper.writeValueAsString(result);
 } catch (JsonProcessingException e) {
 throw new RuntimeException("序列化String错误");
 }
 } else if (body instanceof Result) {
 return body;
 } else if (isKnife4jUrl(request.getURI().getPath())) {
 // 如果是接口文档uri，直接跳过
 return body;
 }
 return new Result<>().data(body);
 }
 
 private boolean isKnife4jUrl(String uri) {
 AntPathMatcher pathMatcher = new AntPathMatcher();
 for (String s : KNIFE4J_URI) {
 if (pathMatcher.match(s, uri)) {
 return true;
 }
 }
 return false;
 }
 }

**常量**

白名单

package com.example.demo.common.constant;
 
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
 public interface WhiteList {
 List<String> KNIFE4J = Arrays.asList(
 "/doc.html",
 "/swagger-resources",
 "/swagger-resources/configuration",
 "/v3/api-docs",
 "/v2/api-docs",
 "/webjars/**");
 
 List<String> ALL = new ArrayList<>(KNIFE4J);
 }

响应数据的code

package com.example.demo.common.constant;
    
    public enum ResultCode {
        SUCCESS(1000, "访问成功"),
        SYSTEM_FAILURE(1001, "系统异常"),
        ;
    
        private final int code;
        private final String description;
    
        ResultCode(int code, String description) {
            this.code = code;
            this.description = description;
        }
    
        public int getCode() {
            return code;
        }
    
        public String getDescription() {
            return description;
        }
    }

**实体类**

封装响应结果

package com.example.demo.common.entity;
 
 import com.example.demo.common.constant.ResultCode;
 import lombok.Data;
 
 @Data
 public class Result<T> {
 private boolean success = true;
 
 private int code = ResultCode.SUCCESS.getCode();
 
 private String message;
 
 private T data;
 
 public Result() {
 }
 
 public Result(boolean success) {
 this.success = success;
 }
 
 public Result<T> success(boolean success) {
 Result<T> result = new Result<>(success);
 if (success) {
 result.code = ResultCode.SUCCESS.getCode();
 } else {
 result.code = ResultCode.SYSTEM_FAILURE.getCode();
 }
 return result;
 }
 
 public Result<T> success() {
 return success(true);
 }
 
 public Result<T> failure() {
 return success(false);
 }
 
 /**
 * @param code {@link ResultCode#getCode()}
 */
 public Result<T> code(int code) {
 this.code = code;
 return this;
 }
 
 public Result<T> message(String message) {
 this.message = message;
 return this;
 }
 
 public Result<T> data(T data) {
 this.data = data;
 return this;
 }
 }

**异常**

自定义异常（业务异常）

package com.example.demo.common.exception;
    
    public class BusinessException extends RuntimeException{
        public BusinessException() {
            super();
        }
    
        public BusinessException(String message) {
            super(message);
        }
    
        public BusinessException(String message, Throwable cause) {
            super(message, cause);
        }
    }

# 测试 #

## 测试超级管理员（admin） ##

启动项目，访问：[http://localhost:8080/doc.html][http_localhost_8080_doc.html]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 1][]

**1.测试登录**

1.  登录成功
2.  可以看到，会返回来一个JSESSIONID。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 2][]

**2.测试有资源权限的接口**

本处测试增加产品接口。

1.  成功访问。
2.  在请求时会传递cookie（JSSESSIONID）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 3][]

**3.测试登出**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 4][]

**4.再次访问接口**

1.  访问失败
2.  跳转到loginUrl指定的地址（本处是/login）
    
    1.  因为我们用的是默认过滤器，authc对应FormAuthenticationFilter，它里边有个逻辑：如果认证失败，则跳转到loginUrl对应的网址。
    2.  所以，要取消这个跳转，可以自己实现过滤器，不跳转到loginUrl即可。后边我会写一个shiro+jwt的博客，里边使用自定义过滤器，不跳转到loginUrl。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 5][]

## 测试产品管理员（productManager） ##

启动项目，访问：[http://localhost:8080/doc.html][http_localhost_8080_doc.html]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 6][]

**1.测试登录**

1.  登录成功
2.  可以看到，会返回来一个JSESSIONID。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 7][]

**2.测试有资源权限的接口**

本处测试增加产品接口。

1.  成功访问。
2.  在请求时会传递cookie（JSSESSIONID）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 8][]

**3.测试无资源权限的接口**

本处测试增加订单接口。

1.  访问失败。
2.  在请求时会传递cookie（JSSESSIONID）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 9][]

**4.测试有角色权限的接口**

本处测试编辑订单接口。

1.  访问成功。
2.  在请求时会传递cookie（JSSESSIONID）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 10][]

**4.测试无角色权限的接口**

本处测试删除订单接口。

1.  访问失败。
2.  在请求时会传递cookie（JSSESSIONID）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 11][]

## 重启服务再请求 ##

**1.登录**

登录成功

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 12][]

**2.重启服务器**

重启Idea启动的应用。

**3.访问有权限的接口**

本处访问产品增加接口。

1.  可以看到，访问失败。但我们本次访问是带着上次的JSESSIONID的。
2.  说明：重启后授权就没了，也就是说：SESSION是存在了内存中的。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 13][]

# 其他网址 #

**Shiro实例系列**

[Shiro--SpringBoot--Session--使用/用法/实例/示例\_IT利刃出鞘的博客-CSDN博客][Shiro--_Session_--_IT_-CSDN]（本文）  
[Shiro--SpringBoot--shiro-redis--使用/用法/实例/示例\_IT利刃出鞘的博客-CSDN博客][Shiro--SpringBoot--shiro-redis--_IT_-CSDN]  
[Shiro--SpringBoot--jwt--使用/用法/实例/示例\_IT利刃出鞘的博客-CSDN博客][Shiro--SpringBoot--jwt--_IT_-CSDN]

**参考网址**

[SpringBoot - 安全框架Shiro的整合与使用教程（附样例）][SpringBoot - _Shiro]  
[Spring Boot 整合 Shiro ，两种方式全总结！ - SegmentFault 思否][Spring Boot _ Shiro _ - SegmentFault]  
[springboot2 集成shiro-spring-boot-web-starter\_天行健-CSDN博客][springboot2 _shiro-spring-boot-web-starter_-CSDN]

[Shiro--_Session_--_IT_-CSDN]: https://knife.blog.csdn.net/article/details/120319145
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70]: /images/20220828/78a5e3da73d243a6a25dbbb20247a431.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBASVTliKnliIPlh7rpnpg_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220828/b8561428caf34213b0bf776c1304fde0.png
[http_localhost_8080_doc.html]: http://localhost:8080/doc.html
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 1]: /images/20220828/3df946e3d55746ddb39ec0923c87ec97.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 2]: /images/20220828/e0c397434f514669803b55182a18c4bd.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 3]: /images/20220828/0954bd9ef0fd47d88e7b1c913b05b1d5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 4]: /images/20220828/f00f2f34d5f94ce79fbc2db94f2de7fd.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 5]: /images/20220828/4caa8974632049909d082168c73f409d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 6]: /images/20220828/749d21e01e06453dadfad14388d1407d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 7]: /images/20220828/bc2d152e3c314197bf64886871052066.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 8]: /images/20220828/f5b063a7788745cb8c635695e492a903.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 9]: /images/20220828/d8c28d6c4d6442409439d552b0ee0ff9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 10]: /images/20220828/ebeccdbbce2f45e4921cda664ca4d4f9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 11]: /images/20220828/b4b7602f27224e9fb17823be317c0af6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 12]: /images/20220828/514b972edb434618864055f5dc172751.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaXlpbmcwY2FuZ2xhbmc_size_16_color_FFFFFF_t_70 13]: /images/20220828/475c03f0a03a4f32abd6e196a9f33027.png
[Shiro--SpringBoot--shiro-redis--_IT_-CSDN]: https://knife.blog.csdn.net/article/details/120319186
[Shiro--SpringBoot--jwt--_IT_-CSDN]: https://knife.blog.csdn.net/article/details/120319274
[SpringBoot - _Shiro]: https://www.hangge.com/blog/cache/detail_2684.html
[Spring Boot _ Shiro _ - SegmentFault]: https://segmentfault.com/a/1190000019440231
[springboot2 _shiro-spring-boot-web-starter_-CSDN]: https://blog.csdn.net/sirchenhua/article/details/100200498