1.环境
- spring boot 版本 2.1.9.RELEASE
- mybatis-plus 版本 3.2.0
<dependencies>
<!--shiro核心-->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<!--shiro与spring整合依赖-->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.10.2</version>
</dependency>
</dependencies>
个人学习总结,仅供参考
2.代码
- ShiroConfig shiro主配置类
import cn.hutool.core.collection.CollectionUtil;
import com.f4Blog.auth.interceptor.ShiroJwtFilter;
import com.f4Blog.auth.shiro.ShiroRealm;
import com.f4Blog.basic.util.SpringUtils;
import com.f4Blog.model.constant.LoginConstant;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
import org.apache.shiro.mgt.SessionStorageEvaluator;
import org.apache.shiro.session.mgt.DefaultSessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.mgt.DefaultWebSessionStorageEvaluator;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.beans.factory.config.MethodInvokingFactoryBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;
import org.springframework.web.filter.DelegatingFilterProxy;
import org.apache.shiro.mgt.DefaultSubjectDAO;
import javax.servlet.Filter;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
/**
* Shiro配置类
*/
@Configuration
//要求首先把上下文支持组件注册到spring
@DependsOn("springUtils")
public class ShiroConfig {
/**
* 创建shiro的过滤器工厂bean
* @return
*/
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("defaultWebSecurityManager")DefaultWebSecurityManager defaultWebSecurityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
//设置安全管理器
shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
return shiroFilterFactoryBean;
}
/**
* 禁用session功能
* @return
*/
@Bean
public DefaultSessionManager sessionManager() {
DefaultSessionManager manager = new DefaultSessionManager();
manager.setSessionValidationSchedulerEnabled(false);
return manager;
}
@Bean
public SessionStorageEvaluator sessionStorageEvaluator() {
DefaultSessionStorageEvaluator sessionStorageEvaluator = new DefaultWebSessionStorageEvaluator();
sessionStorageEvaluator.setSessionStorageEnabled(false);
return sessionStorageEvaluator;
}
@Bean
public DefaultSubjectDAO subjectDAO() {
DefaultSubjectDAO defaultSubjectDAO = new DefaultSubjectDAO();
defaultSubjectDAO.setSessionStorageEvaluator(sessionStorageEvaluator());
return defaultSubjectDAO;
}
/**
* 创建默认的 安全管理类
* @return
*/
@Bean("defaultWebSecurityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("shiroRealm") ShiroRealm shiroRealm){
DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
//关联Realm
securityManager.setRealm(shiroRealm);
securityManager.setSubjectDAO(subjectDAO());
securityManager.setSessionManager(sessionManager());
SecurityUtils.setSecurityManager(securityManager);
return securityManager;
}
/**
* 在方法中 注入 securityManager,进行代理控制
*/
@Bean
public MethodInvokingFactoryBean methodInvokingFactoryBean(DefaultWebSecurityManager securityManager) {
MethodInvokingFactoryBean bean = new MethodInvokingFactoryBean();
bean.setStaticMethod("org.apache.shiro.SecurityUtils.setSecurityManager");
bean.setArguments(securityManager);
return bean;
}
/**
* 缓存管理器 使用Ehcache实现
*/
// @Bean
// public CacheManager getCacheShiroManager(EhCacheManagerFactoryBean ehcache) {
// EhCacheManager ehCacheManager = new EhCacheManager();
// ehCacheManager.setCacheManager(ehcache.getObject());
// return ehCacheManager;
// }
/**
* Shiro生命周期处理器:
* 用于在实现了Initializable接口的Shiro bean初始化时调用Initializable接口回调(例如:UserRealm)
* 在实现了Destroyable接口的Shiro bean销毁时调用 Destroyable接口回调(例如:DefaultSecurityManager)
*/
@Bean
public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
return new LifecycleBeanPostProcessor();
}
/**
* 启用shrio授权注解拦截方式，AOP式方法级权限检查
*/
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor =
new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}
/**
* Shiro的过滤器链
*/
@Bean
public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {
//获取配置文件设置
String loginUrl=SpringUtils.getEnvironment().getProperty(LoginConstant.LOGIN_URL_KEY);
String successUrl=SpringUtils.getEnvironment().getProperty(LoginConstant.LOGIN_SUCCESS_URL_KEY);
String unauthorizedUrl=SpringUtils.getEnvironment().getProperty(LoginConstant.UNAUTHORIZED_URL_KEY);
String anonUrl=SpringUtils.getEnvironment().getProperty(LoginConstant.LOGIN_INTERCEPTOR_ANON_KEY,LoginConstant.LOGIN_INTERCEPTOR_ANON_DEFAULT);
String[] anonUrls=anonUrl.split(",");
//配置shiro过滤器工厂
ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
shiroFilter.setSecurityManager(securityManager);
/**
* 默认的登陆访问url
*/
shiroFilter.setLoginUrl(loginUrl);
/**
* 登陆成功后跳转的url
*/
shiroFilter.setSuccessUrl(successUrl);
/**
* 没有权限跳转的url
*/
shiroFilter.setUnauthorizedUrl(unauthorizedUrl);
//当运行一个Web应用程序时,Shiro将会创建一些有用的默认Filter实例,并自动地在[main]项中将它们置为可用自动地可用的默认的Filter实例是被DefaultFilter枚举类定义的,枚举的名称字段就是可供配置的名称
/**
* anon---------------org.apache.shiro.web.filter.authc.AnonymousFilter 没有参数，表示可以匿名使用。
* authc--------------org.apache.shiro.web.filter.authc.FormAuthenticationFilter 表示需要认证(登录)才能使用，没有参数
* authcBasic---------org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter 没有参数表示httpBasic认证
* logout-------------org.apache.shiro.web.filter.authc.LogoutFilter
* noSessionCreation--org.apache.shiro.web.filter.session.NoSessionCreationFilter
* perms--------------org.apache.shiro.web.filter.authz.PermissionAuthorizationFilter 参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/**=perms["user:add:*,user:modify:*"]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。
* port---------------org.apache.shiro.web.filter.authz.PortFilter port[8081],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString是你访问的url里的？后面的参数。
* rest---------------org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter 根据请求的方法，相当于/admins/user/**=perms[user:method] ,其中method为post，get，delete等。
* roles--------------org.apache.shiro.web.filter.authz.RolesAuthorizationFilter 参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/**=roles["admin,guest"],每个参数通过才算通过，相当于hasAllRoles()方法。
* ssl----------------org.apache.shiro.web.filter.authz.SslFilter 没有参数，表示安全的url请求，协议为https
* user---------------org.apache.shiro.web.filter.authz.UserFilter 没有参数表示必须存在用户，当登入操作时不做检查
*/
/**
* 通常可将这些过滤器分为两组
* anon,authc,authcBasic,user是第一组认证过滤器
* perms,port,rest,roles,ssl是第二组授权过滤器
* 注意user和authc不同：当应用开启了rememberMe时,用户下次访问时可以是一个user,但绝不会是authc,因为authc是需要重新认证的
* user表示用户不一定已通过认证,只要曾被Shiro记住过登录状态的用户就可以正常发起请求,比如rememberMe 说白了,以前的一个用户登录时开启了rememberMe,然后他关闭浏览器,下次再访问时他就是一个user,而不会authc
*
*
* 举几个例子
* /admin=authc,roles[admin] 表示用户必需已通过认证,并拥有admin角色才可以正常发起'/admin'请求
* /edit=authc,perms[admin:edit] 表示用户必需已通过认证,并拥有admin:edit权限才可以正常发起'/edit'请求
* /home=user 表示用户不一定需要已经通过认证,只需要曾经被Shiro记住过登录状态就可以正常发起'/home'请求
*/
/**
* 覆盖默认的user拦截器
*/
HashMap<String, Filter> myFilters = new HashMap<>();
myFilters.put("user", new ShiroJwtFilter());
shiroFilter.setFilters(myFilters);
/**
* 各默认过滤器常用如下(注意URL Pattern里用到的是两颗星,这样才能实现任意层次的全匹配)
* /admins/**=anon 无参,表示可匿名使用,可以理解为匿名用户或游客
* /admins/user/**=authc 无参,表示需认证才能使用
* /admins/user/**=authcBasic 无参,表示httpBasic认证
* /admins/user/**=ssl 无参,表示安全的URL请求,协议为https
* /admins/user/**=perms[user:add:*] 参数可写多个,多参时必须加上引号,且参数之间用逗号分割,如/admins/user/**=perms["user:add:*,user:modify:*"]。当有多个参数时必须每个参数都通过才算通过,相当于isPermitedAll()方法
* /admins/user/**=port[8081] 当请求的URL端口不是8081时,跳转到schemal://serverName:8081?queryString。其中schmal是协议http或https等,serverName是你访问的Host,8081是Port端口,queryString是你访问的URL里的?后面的参数
* /admins/user/**=rest[user] 根据请求的方法,相当于/admins/user/**=perms[user:method],其中method为post,get,delete等
* /admins/user/**=roles[admin] 参数可写多个,多个时必须加上引号,且参数之间用逗号分割,如：/admins/user/**=roles["admin,guest"]。当有多个参数时必须每个参数都通过才算通过,相当于hasAllRoles()方法
*
*/
//Shiro验证URL时,URL匹配成功便不再继续匹配查找(所以要注意配置文件中的URL顺序,尤其在使用通配符时)
//配置过滤链
Map<String, String> hashMap = new LinkedHashMap<>();
for (String nonePermissionRe : anonUrls) {
hashMap.put(nonePermissionRe, "anon");
}
hashMap.put("/**", "user");
shiroFilter.setFilterChainDefinitionMap(hashMap);
return shiroFilter;
}
//解决UnavailableSecurityManagerException
@Bean
public FilterRegistrationBean delegatingFilterProxy(){
FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
DelegatingFilterProxy proxy = new DelegatingFilterProxy();
proxy.setTargetFilterLifecycle(true);
proxy.setTargetBeanName("shiroFilter");
filterRegistrationBean.setFilter(proxy);
return filterRegistrationBean;
}
/**
* 创建Realm
* @return
*/
@Bean("shiroRealm")
public ShiroRealm getShiroRealm(){
return new ShiroRealm();
}
//自动创建代理类
@Bean
@ConditionalOnMissingBean
public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator();
daap.setProxyTargetClass(true);
return daap;
}
}
比较重要的代码一是禁用session,二是过滤器的设置
尝试了几种禁用session的方式,感觉这种比较合适些
/**
* 禁用session功能
* @return
*/
@Bean
public DefaultSessionManager sessionManager() {
DefaultSessionManager manager = new DefaultSessionManager();
manager.setSessionValidationSchedulerEnabled(false);
return manager;
}
@Bean
public SessionStorageEvaluator sessionStorageEvaluator() {
DefaultSessionStorageEvaluator sessionStorageEvaluator = new DefaultWebSessionStorageEvaluator();
sessionStorageEvaluator.setSessionStorageEnabled(false);
return sessionStorageEvaluator;
}
@Bean
public DefaultSubjectDAO subjectDAO() {
DefaultSubjectDAO defaultSubjectDAO = new DefaultSubjectDAO();
defaultSubjectDAO.setSessionStorageEvaluator(sessionStorageEvaluator());
return defaultSubjectDAO;
}
在ShiroConfig一般只配置一些通用的过滤约束,具体约束还是要通过注解设置.
处于多模块共用的考虑,过滤的url是从配置文件中获取的.类头的DependsOn注解是为此添加的.
//要求首先把上下文支持组件注册到spring
@DependsOn("springUtils")
- shiroRealm 处理认证与授权逻辑
import com.f4Blog.auth.jwt.ShiroJwtToken;
import com.f4Blog.auth.jwt.JwtUtil;
import com.f4Blog.auth.service.imip.UserAuthServiceImpl;
import com.f4Blog.auth.service.inter.UserAuthService;
import com.f4Blog.basic.util.ToolUtil;
import com.f4Blog.model.base.BaseUser;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.CredentialsException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
/**
* 自定义realm
*/
public class ShiroRealm extends AuthorizingRealm {
/**
* 使用jwt代替原生token
*
* @param token
* @return
*/
@Override
public boolean supports(AuthenticationToken token) {
return token instanceof ShiroJwtToken;
}
/**
* 执行授权逻辑
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
System.out.println("执行授权逻辑");
return null;
}
/**
* 执行登录认证逻辑
* @param authenticationToken
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
System.out.println("执行认证逻辑");
UserAuthService shiroFactory = UserAuthServiceImpl.me();
String token = (String)authenticationToken.getCredentials();
String username = JwtUtil.getUsername(token);
BaseUser user = shiroFactory.user(username);
ShiroUser shiroUser = shiroFactory.shiroUser(user);
if(user == null) {
throw new UnknownAccountException("账号不存在");
}
if(!JwtUtil.verify(token, user.getUsername(), user.getPassword())) {
throw new CredentialsException("用户名/密码错误");
}
SimpleAuthenticationInfo simpleAuthenticationInfo=new SimpleAuthenticationInfo(shiroUser, token,getName());
return simpleAuthenticationInfo;
}
}
认证的流程是
1.拿到传入的token
2.获取token的username,从数据库拿到用户对象
3.token与用户对象对比,验证token正确性
4.返回shiro授权对象.
需要注意的是,是不需要SimpleAuthenticationInfo进行认证效验的,效验逻辑是通过
if(user == null) {
throw new UnknownAccountException("账号不存在");
}
if(!JwtUtil.verify(token, user.getUsername(), user.getPassword())) {
throw new CredentialsException("用户名/密码错误");
}
实现的
网上查到的资料,一般都是返回的
new SimpleAuthenticationInfo(token, token,getName());
其目的是让shiro效验恒通过,但是会有一个问题,在其他地方去getCredentials()只能拿到token,拿不到当前登录对信息.
自己做了些修改, 第一个参数设置为创建出的shiroUser 登录对象.
采取jwt的验证,supports方法是必须重写的
/**
* 使用jwt代替原生token
*
* @param token
* @return
*/
@Override
public boolean supports(AuthenticationToken token) {
return token instanceof ShiroJwtToken;
}
ShiroJwtToken 代替shiro的token
import org.apache.shiro.authc.AuthenticationToken;
public class ShiroJwtToken implements AuthenticationToken {
private static final long serialVersionUID = 1L;
// 密钥
private String token;
public ShiroJwtToken(String token) {
this.token = token;
}
@Override
public Object getPrincipal() {
return token;
}
@Override
public Object getCredentials() {
return token;
}
}
JwtUtil 工具类,提供一些常用的token的操作方法
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.DecodedJWT;
import org.springframework.util.StringUtils;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Date;
public class JwtUtil {
//短 过期时间60分钟
private static final long SHORT_EXPIRE_TIME = 1000 * 60 * 60;
//长 过期时间7天
private static final long LONG_EXPIRE_TIME = 1000 * 60 * 60 * 24 * 7;
//刷新token的时间节点,token有效时间低于该时间将刷新token 15分钟
private static final long REFRESH_COUNT_DOWN = 1000 * 60 * 15;
/**
* 校验token是否正确
*
* @param token 密钥
* @param username 登录名
* @param password 密码
* @return
*/
public static boolean verify(String token, String username, String password) {
try {
Algorithm algorithm = Algorithm.HMAC256(password);
JWTVerifier verifier = JWT.require(algorithm).withClaim("username", username).build();
DecodedJWT jwt = verifier.verify(token);
return true;
} catch (Exception e) {
return false;
}
}
/**
* 获取用户名
*
* @param credentials
* @return
*/
public static String getUsername(String credentials) {
try {
DecodedJWT jwt = JWT.decode(credentials);
return jwt.getClaim("username").asString();
} catch (JWTDecodeException e) {
return null;
}
}
/**
* 生成签名
*
* @param username
* @param password
* @return
*/
public static String sign(String username, String password) {
// 指定过期时间
Date date = new Date(System.currentTimeMillis() + SHORT_EXPIRE_TIME);
Algorithm algorithm = Algorithm.HMAC256(password);
return JWT.create()
.withClaim("username", username)
.withExpiresAt(date)
.sign(algorithm);
}
/**
* token的剩余有效期,单位毫秒
* @param token
* @return
*/
public static Long getRemainingTime(String token) {
try{
DecodedJWT jwt = JWT.decode(token);
Long remainingTime=jwt.getExpiresAt().getTime()-System.currentTimeMillis();
return remainingTime;
}catch (Exception e){
return -1l;
}
}
/**
* 是否应刷新tonken
* @param token
* @return
*/
public static Boolean isRefreshToken(String token){
Long remainingTime=getRemainingTime(token);
return null!=remainingTime && remainingTime>0 && remainingTime<=REFRESH_COUNT_DOWN;
}
/**
* 在cookie和相应头设置token
* @param response
* @param token
*/
public static void cookieAndHeaderSetToken(HttpServletResponse response,String token){
Cookie cookie = new Cookie("token",token);
cookie.setPath( "/");
response.addCookie(cookie);
response.setHeader("token",token);
}
/**
* 在cookie和相应头 获取 token
* @param httpServletRequest
*/
public static String cookieAndHeaderGetToken(HttpServletRequest httpServletRequest){
//获取请求头的token
String token = httpServletRequest.getHeader("token");
if(!StringUtils.hasText(token)){
//请求头没有,尝试从cookie获取token
Cookie[] cookies=httpServletRequest.getCookies();
if(null!=cookies&&cookies.length!=0){
i:for(Cookie cookie:cookies){
if(cookie.getName().equalsIgnoreCase("token")){
token=cookie.getValue();
break i;
}
}
}
}
return token;
}
}
ShiroUser 实体类,用于记录当前登录对象信息
import java.io.Serializable;
import java.util.List;
public class ShiroUser implements Serializable {
private static final long serialVersionUID = 1L;
/**
* 用户主键ID
*/
private Long id;
/**
* 账号
*/
private String username;
/**
* 角色id 集合
*/
private List<Long> roleList;
/**
* 角色名称 集合
*/
private List<String> roleNames;
public Long getId() {
return id;
}
public void setId(Long id) {
this.id = id;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public List<Long> getRoleList() {
return roleList;
}
public void setRoleList(List<Long> roleList) {
this.roleList = roleList;
}
public List<String> getRoleNames() {
return roleNames;
}
public void setRoleNames(List<String> roleNames) {
this.roleNames = roleNames;
}
}
ShiroJwtFilter 过滤器,用于进行token的验证
import com.f4Blog.auth.jwt.JwtUtil;
import com.f4Blog.auth.jwt.ShiroJwtToken;
import com.f4Blog.auth.service.imip.UserAuthServiceImpl;
import com.f4Blog.auth.service.inter.UserAuthService;
import com.f4Blog.basic.reqres.utils.WebUtils;
import com.f4Blog.model.base.BaseUser;
import org.apache.shiro.ShiroException;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.AccessControlFilter;
import org.springframework.util.StringUtils;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* 进行用户的访问过滤
* 通过继承AccessControlFilter的进行实现
* https://www.cnblogs.com/CESC4/p/7599927.html
* 抽象方法功能:
* isAccessAllowed：表示是否允许访问；mappedValue就是[urls]配置中拦截器参数部分，如果允许访问返回true，否则false；
* onAccessDenied：表示当访问拒绝时是否已经处理了；如果返回true表示需要继续处理；如果返回false表示该拦截器实例已经处理了，将直接返回即可。
*
* 父类提供的方法:
* void setLoginUrl(String loginUrl) //身份验证时使用，默认/login.jsp
* String getLoginUrl()
* Subject getSubject(ServletRequest request, ServletResponse response) //获取Subject实例
* boolean isLoginRequest(ServletRequest request, ServletResponse response)//当前请求是否是登录请求
* void saveRequestAndRedirectToLogin(ServletRequest request, ServletResponse response) throws IOException //将当前请求保存起来并重定向到登录页面
* void saveRequest(ServletRequest request) //将请求保存起来，如登录成功后再重定向回该请求
* void redirectToLogin(ServletRequest request, ServletResponse response) //重定向到登录页面
*/
public class ShiroJwtFilter extends AccessControlFilter {
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
HttpServletResponse httpServletResponse = (HttpServletResponse)response;
if (isLoginRequest(request, response)) {
return true;
} else {
//获取请求头的token
String token = JwtUtil.cookieAndHeaderGetToken(httpServletRequest);
Subject subject = getSubject(request, response);
if(StringUtils.hasText(token)){
//使用token进行shiro认证
try {
subject.login(new ShiroJwtToken(token));
}catch (ShiroException e){
httpServletRequest.setAttribute("tips", "认证失效");
return false;
}
//判断是否应该刷新token
if(JwtUtil.isRefreshToken(token)){
try {
UserAuthService shiroFactory = UserAuthServiceImpl.me();
String username = JwtUtil.getUsername(token);
BaseUser user = shiroFactory.user(username);
String newToken = JwtUtil.sign(user.getUsername(), user.getPassword());
JwtUtil.cookieAndHeaderSetToken(WebUtils.getResponse(),newToken);
}catch (Exception e){
e.printStackTrace();
//日志 刷新token出错
}
}else{
//不刷新,将token重新放回响应头
httpServletResponse.setHeader("token",token);
}
}else{
return false;
}
return true;
}
}
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
HttpServletResponse httpServletResponse = (HttpServletResponse)response;
/**
* 如果是ajax请求则不进行跳转
*/
if (httpServletRequest.getHeader("x-requested-with") != null
&& httpServletRequest.getHeader("x-requested-with").equalsIgnoreCase("XMLHttpRequest")) {
return false;
} else {
httpServletResponse.sendRedirect(getLoginUrl());
// saveRequestAndRedirectToLogin(request, response);
}
return false;
}
}
过滤器主要做的事是拿token进行shiro登录,生成用户信息和刷新token.
我了解到的刷新token的方式有三种
1.token时效极短,每次请求都会重新生成token,下次请求需要拿着新token才能通过认证
2.在token即将失效时,刷新token
3.添加一个refresh_token,时效较长,来声明刷新token的权限,对于快失效或者已经失效的token,会效验refresh_token然后判断是否刷新token.
第一种安全性比较高,但是性能开销大.第三种比较繁琐没什么必要,我暂时采取的是第二种方式.
UserAuthServiceImpl 为shiro提供数据库操作
@Service
//要求首先把上下文支持组件注册到spring
@DependsOn("springUtils")
@Transactional(readOnly = true)
public class UserAuthServiceImpl implements UserAuthService {
@Autowired
private RoleDao roleDao;
@Autowired
private UserService userService;
/**
* 获取自身实例对象
* @return
*/
public static UserAuthService me() {
return SpringUtils.getBean(UserAuthService.class);
}
@Override
public BaseUser user(String account) {
BaseUser user = userService.getByUsername(account);
// 账号不存在
if (null == user) {
throw new CredentialsException();
}
// // 账号被冻结
// if (!user.getStatus().equals(ManagerStatus.OK.getCode())) {
// throw new LockedAccountException();
// }
return user;
}
@Override
public ShiroUser shiroUser(BaseUser user) {
ShiroUser shiroUser = createShiroUser(user);
//用户的角色id集合
List<Long> roleIds = roleDao.getRoleIdByUserId(user.getId());
//用户的角色名称集合
List<String> roleNames = roleDao.getRoleNameByUserId(user.getId());
shiroUser.setRoleList(roleIds);
shiroUser.setRoleNames(roleNames);
return shiroUser;
}
@Override
public SimpleAuthenticationInfo info(ShiroUser shiroUser, BaseUser user, String realmName) {
// 密码加盐处理
String salt = user.getSalt();
String credentials = user.getPassword();
ByteSource credentialsSalt = new Md5Hash(salt);
return new SimpleAuthenticationInfo(shiroUser, credentials, credentialsSalt, realmName);
}
/**
* 通过用户表的信息创建一个shiroUser对象
*/
public static ShiroUser createShiroUser(BaseUser user) {
ShiroUser shiroUser = new ShiroUser();
if (user == null) {
return shiroUser;
}
shiroUser.setId(user.getId());
shiroUser.setUsername(user.getUsername());
return shiroUser;
}
}
登录controller相关方法
@RequestMapping(value ="/login",method = RequestMethod.GET)
public String login(ModelAndView model) {
String token=JwtUtil.cookieAndHeaderGetToken(WebUtils.getRequest());
if(StringUtils.hasText(token)){
try{
SecurityUtils.getSubject().login(new ShiroJwtToken(token));
return REDIRECT+"pages/test/index";
} catch (ShiroException e){
}
}
return "/login";
}
@RequestMapping(value ="/login",method = RequestMethod.POST)
public String loginVail(Model model){
//验证是否已登录
String username= WebUtils.get("username");
String password=WebUtils.get("password");
BaseUser user = userService.getByUsername(username);
String md5_password=ShiroKit.md5(password ,user.getSalt());
String token = JwtUtil.sign(user.getUsername(), md5_password);
SecurityUtils.getSubject().login(new ShiroJwtToken(token));
JwtUtil.cookieAndHeaderSetToken(WebUtils.getResponse(),token);
model.addAttribute("token",token);
//登录成功，记录登录日志
return REDIRECT+"pages/test/index";
}
//退出
@RequestMapping("/logout")
public String logout() {
// SecurityUtils.getSubject().logout();
// 移除Cookie中的token
Cookie cookie = new Cookie("token","");
cookie.setValue(null);
cookie.setMaxAge(0);
cookie.setPath( "/");
WebUtils.getResponse().addCookie(cookie);
return REDIRECT+"/login";
}
一些辅助类
GlobalExceptionHandler 全局异常捕获
/**
* 全局的的异常拦截器（拦截所有的控制器）（带有@RequestMapping注解的方法上都会拦截）
*
*/
@ControllerAdvice
/**
*ControllerAdvice注解 用于对Controller进行“切面”环绕
* 其用法主要有三点：
* 结合方法型注解@ExceptionHandler，用于捕获Controller中抛出的指定类型的异常，从而达到不同类型的异常区别处理的目的；
* 结合方法型注解@InitBinder，用于request中自定义参数解析方式进行注册，从而达到自定义指定格式参数的目的；
* 结合方法型注解@ModelAttribute，表示其标注的方法将会在目标Controller方法执行之前执行。
*/
@Order(-1)
/**
*注解@Order的作用是定义Spring IOC容器中Bean的执行顺序的优先级，而不是定义Bean的加载顺序
* 默认是最低优先级,值越小优先级越高
*/
public class GlobalExceptionHandler {
private Logger log = LoggerFactory.getLogger(this.getClass());
/**
* 用户未登录异常
*/
@ExceptionHandler(AuthenticationException.class)
@ResponseStatus(HttpStatus.UNAUTHORIZED)
public String unAuth(AuthenticationException e) {
log.error("用户未登陆：", e);
return "/login";
}
/**
* 账号被冻结异常
*/
@ExceptionHandler(DisabledAccountException.class)
@ResponseStatus(HttpStatus.UNAUTHORIZED)
public String accountLocked(DisabledAccountException e, Model model) {
String username = getRequest().getParameter("username");
// LogManager.me().executeLog(LogTaskFactory.loginLog(username, "账号被冻结", getIp()));
model.addAttribute("tips", "账号被冻结");
return "/login";
}
/**
* 账号密码错误异常
*/
@ExceptionHandler(CredentialsException.class)
@ResponseStatus(HttpStatus.UNAUTHORIZED)
public String credentials(CredentialsException e, Model model) {
// String username = getRequest().getParameter("username");
// LogManager.me().executeLog(LogTaskFactory.loginLog(username, "账号密码错误", getIp()));
model.addAttribute("tips", "账号密码错误");
return "/login";
}
/**
* 验证码错误异常
*/
@ExceptionHandler(InvalidKaptchaException.class)
@ResponseStatus(HttpStatus.BAD_REQUEST)
public String credentials(InvalidKaptchaException e, Model model) {
String username = getRequest().getParameter("username");
// LogManager.me().executeLog(LogTaskFactory.loginLog(username, "验证码错误", getIp()));
model.addAttribute("tips", "验证码错误");
return "/login";
}
/**
* 无权访问该资源异常
*/
@ExceptionHandler(UndeclaredThrowableException.class)
@ResponseStatus(HttpStatus.UNAUTHORIZED)
@ResponseBody
public ErrorResponseData credentials(UndeclaredThrowableException e) {
getRequest().setAttribute("tip", "权限异常");
log.error("权限异常!", e);
return new ErrorResponseData(BaseExceptionEnum.NO_PERMITION.getCode(), BaseExceptionEnum.NO_PERMITION.getMessage());
}
/**
* 捕获数据绑定异常
* @param ex
* @return
*/
@ExceptionHandler(value={BindException.class, MethodArgumentNotValidException.class})
@ResponseBody
public ErrorResponseData bindExceptionHandler(Exception ex) {
ErrorResponseData res=new ErrorResponseData();
//出现参数不正确的异常,在返回值显示提示信息,具体错误消息进行记录和打印
//设置为参数错误
res.addEnumInfo(BaseExceptionEnum.PARA_ERROR);
List<FieldError> fieldErrors=null;
if(ex instanceof BindException){
fieldErrors=((BindException)ex).getBindingResult().getFieldErrors();
}else if(ex instanceof MethodArgumentNotValidException){
fieldErrors=((MethodArgumentNotValidException)ex).getBindingResult().getFieldErrors();
}else{
return res;
}
List<String> allError=new ArrayList<>();
//将第一个错误信息作为响应的错误信息
res.setMessage(fieldErrors.get(0).getDefaultMessage());
//记录其他错误信息
for (FieldError error:fieldErrors){
allError.add(error.getDefaultMessage());
}
res.setData(allError);
return res;
}
/**
* 捕获消息型的异常
* @param ex
* @return
*/
@ExceptionHandler(value={ServiceException.class})
@ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
@ResponseBody
public ErrorResponseData exceptionHandler(ServiceException ex) {
ErrorResponseData res=new ErrorResponseData();
res.addExceptionInfo(ex);
log.error("业务异常:", ex);
return res;
}
/**
* 捕获出错型的异常
* @param ex
* @return
*/
@ExceptionHandler(value={ErrorException.class})
@ResponseBody
public ErrorResponseData exceptionHandler(ErrorException ex) {
ErrorResponseData res=new ErrorResponseData();
//出现错误型异常,在返回值显示服务器异常,具体错误消息进行记录和打印
ex.printStackTrace();
log.error("系统执行出现异常:" + ex.getMessage());
return res;
}
/**
* 捕获其他异常
* @param ex
* @return
*/
@ExceptionHandler(value={Exception.class})
@ResponseStatus(HttpStatus.INTERNAL_SERVER_ERROR)
@ResponseBody
public ErrorResponseData exceptionHandler(Exception ex) {
ErrorResponseData res=new ErrorResponseData();
//不确定的异常,在返回值显示未知异常,具体错误消息进行记录和打印
res.addEnumInfo(BaseExceptionEnum.UNKNOWN_ERROR);
ex.printStackTrace();
this.log.error( "系统出现未知异常 :" + ex.getMessage());
return res;
}
}
3.后续需要考虑修改地方
1.token验证增加缓存
2.前端增加全局的设置token到header
3.实现一个类似[7天内免登录]的效果
4.增加错误页面
网友评论