1.搭建ssm
1.1创建Maven一个项目
1.2引入相关依赖
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.hmq</groupId>
<artifactId>shiro-ssm</artifactId>
<version>1.0-SNAPSHOT</version>
<packaging>war</packaging>
<dependencies>
<!--druid的依赖-->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.2.8</version>
</dependency>
<!--mysql驱动-->
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>8.0.31</version>
</dependency>
<!--spring的相关依赖-->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>5.2.15.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-jdbc</artifactId>
<version>5.2.15.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-tx</artifactId>
<version>5.2.15.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-aspects</artifactId>
<version>5.2.15.RELEASE</version>
</dependency>
<!--mybatis的依赖-->
<dependency>
<groupId>org.mybatis</groupId>
<artifactId>mybatis</artifactId>
<version>3.5.9</version>
</dependency>
<dependency>
<groupId>org.mybatis</groupId>
<artifactId>mybatis-spring</artifactId>
<version>2.0.7</version>
</dependency>
<!--lombok-->
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<version>1.18.28</version>
</dependency>
<!--jackson-->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.15.2</version>
</dependency>
<!--jsp servlet-->
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.1.0</version>
</dependency>
<!--druid依赖-->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.2.8</version>
</dependency>
</dependencies>
</project>
1.3spring配置文件
在配置数据源时,需要在pom文件中加入druid的依赖
<!--druid的依赖-->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.2.8</version>
</dependency>
在静态资源放行时,扫描不上,需要将mvc修改
映射文件所在的路径,也会报红,需要创建mapper的映射文件引入
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:tx="http://www.springframework.org/schema/tx"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context https://www.springframework.org/schema/context/spring-context.xsd http://www.alibaba.com/schema/stat http://www.alibaba.com/schema/stat.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd">
<!--1.包扫描-->
<context:component-scan base-package="com.hmq"/>
<!--2.注解驱动-->
<mvc:annotation-driven/>
<!--3.静态资源放行-->
<mvc:default-servlet-handler/>
<!--4.视图解析器-->
<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="prefix" value="/WEB-INF/views/"/>
<property name="suffix" value=".jsp"/>
</bean>
<!--数据源-->
<bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource">
<property name="username" value="root"/>
<property name="password" value="root"/>
<property name="driverClassName" value="com.mysql.cj.jdbc.Driver"/>
<property name="url" value="jdbc:mysql://localhost:3306/shiro?serverTimezone=Asia/Shanghai"/>
</bean>
<!--SqlSessionFactory 加载mybatis的配置-->
<bean id="sessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
<property name="dataSource" ref="dataSource"/>
<!--映射文件所在的路径-->
<property name="mapperLocations" value="classpath:mapper/*.xml"/>
</bean>
<!--设置dao接口的代理实现类-->
<bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
<property name="sqlSessionFactoryBeanName" value="sessionFactory"/>
<!--dao 接口所在的包-->
<property name="basePackage" value="com.hmq.dao"/>
</bean>
<!--事务管理-->
<bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
<property name="dataSource" ref="dataSource"/>
</bean>
<!--开启事务的注解驱动-->
<tx:annotation-driven/>
</beans>
2.ssm整合shiro---认证功能
2.1.创建数据库
SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;
-- ----------------------------
-- Table structure for permission
-- ----------------------------
DROP TABLE IF EXISTS `permission`;
CREATE TABLE `permission` (
`perid` int(0) NOT NULL AUTO_INCREMENT,
`pername` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
`percode` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
PRIMARY KEY (`perid`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 9 CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of permission
-- ----------------------------
INSERT INTO `permission` VALUES (1, '查询用户信息', 'user:query');
INSERT INTO `permission` VALUES (2, '修改用户', 'user:update');
INSERT INTO `permission` VALUES (3, '删除用户', 'user:delete');
INSERT INTO `permission` VALUES (4, '添加用户', 'user:insert');
INSERT INTO `permission` VALUES (5, '导出用户', 'user:export');
-- ----------------------------
-- Table structure for role
-- ----------------------------
DROP TABLE IF EXISTS `role`;
CREATE TABLE `role` (
`roleid` int(0) NOT NULL AUTO_INCREMENT,
`rolename` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
PRIMARY KEY (`roleid`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 3 CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of role
-- ----------------------------
INSERT INTO `role` VALUES (1, '仓管管理员');
INSERT INTO `role` VALUES (2, 'CEO');
INSERT INTO `role` VALUES (3, '保安');
-- ----------------------------
-- Table structure for role_permission
-- ----------------------------
DROP TABLE IF EXISTS `role_permission`;
CREATE TABLE `role_permission` (
`perid` int(0) NOT NULL,
`roleid` int(0) NOT NULL,
PRIMARY KEY (`perid`, `roleid`) USING BTREE
) ENGINE = InnoDB CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of role_permission
-- ----------------------------
INSERT INTO `role_permission` VALUES (1, 1);
INSERT INTO `role_permission` VALUES (1, 2);
INSERT INTO `role_permission` VALUES (1, 3);
INSERT INTO `role_permission` VALUES (2, 1);
INSERT INTO `role_permission` VALUES (2, 2);
INSERT INTO `role_permission` VALUES (3, 1);
INSERT INTO `role_permission` VALUES (3, 2);
INSERT INTO `role_permission` VALUES (4, 1);
INSERT INTO `role_permission` VALUES (5, 3);
-- ----------------------------
-- Table structure for user
-- ----------------------------
DROP TABLE IF EXISTS `user`;
CREATE TABLE `user` (
`userid` int(0) NOT NULL AUTO_INCREMENT,
`username` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
`userpwd` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
`sex` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
`address` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
`salt` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
PRIMARY KEY (`userid`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of user
-- ----------------------------
INSERT INTO `user` VALUES (1, 'zhangsan', '4b05a8716a430f71c6911d2e9149092f', '男', '武汉', '07f63bbf285e4719bfee1cc2bb81db33');
INSERT INTO `user` VALUES (2, 'lisi', '99cc11855b41ff3e5f7c0af3c5090a8c', '女', '北京', '2d7e37f019144764ac02aa7220929f93');
INSERT INTO `user` VALUES (3, 'wangwu', '6d70c027801af4dc892ab340d4bf73b6', '女', '成都', '99f6bf1b540145699e6e5c90480105b0');
-- ----------------------------
-- Table structure for user_role
-- ----------------------------
DROP TABLE IF EXISTS `user_role`;
CREATE TABLE `user_role` (
`userid` int(0) NOT NULL,
`roleid` int(0) NOT NULL,
PRIMARY KEY (`userid`, `roleid`) USING BTREE
) ENGINE = InnoDB CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
-- ----------------------------
-- Records of user_role
-- ----------------------------
INSERT INTO `user_role` VALUES (1, 1);
INSERT INTO `user_role` VALUES (2, 2);
INSERT INTO `user_role` VALUES (3, 3);
SET FOREIGN_KEY_CHECKS = 1;
2.2.导入ssm整合shiro依赖
<!--shiro-spring整合的依赖-->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.7.0</version>
</dependency>
2.3.在原有的基础上添加spring配置文件
添加login.xml文件,防止报红
<!--shiro和spring整合的配置--> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="myRealm"/> </bean> <bean id="myRealm" class="com.hmq.realm.MyRealm"> <property name="credentialsMatcher" ref="credentialsMatcher"/> </bean> <!--加密器--> <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> <property name="hashAlgorithmName" value="MD5"/> <property name="hashIterations" value="1024"/> </bean> <!--shiro过滤器 id:必须和web,xml里面的过滤器配置的名称对应--> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager"/> <!--未登录时跳转的路径--> <property name="loginUrl" value="/login.jsp"/> <!--过滤规则--> <property name="filterChainDefinitions"> <value> /login=name /**=authc </value> </property> </bean>
2.4.创建MyRealm文件,重写方法
package com.hmq.realm;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
public class MyRealm extends AuthorizingRealm {
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
return null;
}
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
return null;
}
}
2.5.在原有的基础上添加web.xml文件
<!--shiro的过滤器:必须和shiroFilterFactoryBean的id一致-->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
2.6.添加login.jsp文件内容
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
<title>登录界面</title>
</head>
<body>
<form action="/login" method="post">
账号:<input type="text" name="username"/><br>
密码:<input type="text" name="password"/><br>
<input type="submit" value="登录"/>
</form>
</body>
</html>
2.7.创建controller
package com.hmq.controller;
import com.hmq.vo.LoginVo;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
@Controller
public class LoginController {
@PostMapping("/login")
public String login(LoginVo loginVo){//@RequestBody接受的json对象参数 不加:表单数据以及地址栏传递的数据
//传递的数据校验
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(loginVo.getUsername(), loginVo.getPassword());
try{
subject.login(token);
return "success";//经过视图解析器 /WEB-INF/views/success.jsp
}catch (Exception e){
e.printStackTrace();
return "redirect:/login.jsp";
}
}
}
需要创建success.jsp文件
2.8.创建vo
package com.hmq.vo;
import lombok.Data;
@Data
public class LoginVo {
private String username;
private String password;
}
2.9.修改MyRealm
package com.hmq.realm;
import com.hmq.entity.User;
import com.hmq.service.UserService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
public class MyRealm extends AuthorizingRealm {
@Autowired
private UserService userService;
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
return null;
}
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
//1.获取登录账号
String username = authenticationToken.getPrincipal().toString();
//2.根据账号获取用户信息
User user = userService.selectByUsername(username);
if (user!=null){
ByteSource salt = ByteSource.Util.bytes(user.getSalt());
SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getUserpwd(),salt, this.getName());
return info;
}
return null;
}
}
2.10.创建user实体类
package com.hmq.entity;
import lombok.Data;
@Data
public class User {
private Integer userid;
private String username;
private String userpwd;
private String sex;
private String address;
private String salt;
}
2.11.创建service层
1)UserService层
package com.hmq.service;
import com.hmq.entity.User;
public interface UserService {
User selectByUsername(String username);
}
2)UserServiceImpl层
package com.hmq.service.impl;
import com.hmq.entity.User;
import com.hmq.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@Service
public class UserServiceImpl implements UserService {
@Autowired
private UserDao userDao;
public User selectByUsername(String username){
User user = userDao.findByUsername(username);
return user;
}
}
2.12.创建dao层
package com.hmq.dao;
import com.hmq.entity.User;
public interface UserDao {
User findByUsername(String username);
}
2.13.sql语句
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<!--namesapce的内容必须和对应的接口路径映射-->
<mapper namespace="com.hmq.dao.UserDao">
<select id="findByUsername" resultType="com.hmq.entity.User">
select * from user where username=#{username}
</select>
</mapper>
2.14.测试
出现加密问题
在web.xml添加配置解决
<!-- 移除shiro首次加载时路径中的 jsessionid --> <session-config> <!-- Disables URL-based sessions (no more 'jsessionid' in the URL using Tomcat) --> <tracking-mode>COOKIE</tracking-mode> </session-config>
3.ssm整合shiro ---授权
3.1修改myRealm
//授权
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
//获取当前登录者的账号
User user = (User) principalCollection.getPrimaryPrincipal();
//调用userService中的方法--根据id
List<String> permissions = userService.selectPermissionByUserid(user.getUserid());
if (permissions.size()!=0){
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
info.addStringPermissions(permissions);
return info;
}
return null;
}
3.2UserService和userServiceImpl
package com.hmq.service;
import com.hmq.entity.User;
import java.util.List;
public interface UserService {
List<String> selectPermissionByUserid(Integer userid);
}
package com.hmq.service.impl;
import com.hmq.dao.UserDao;
import com.hmq.entity.Permission;
import com.hmq.entity.User;
import com.hmq.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import java.util.List;
import java.util.stream.Collectors;
@Service
public class UserServiceImpl implements UserService {
@Autowired
private UserDao userDao;
public User selectByUsername(String username){
User user = userDao.findByUsername(username);
return user;
}
public List<String> selectPermissionByUserid(Integer userid) {
List<Permission> permissionList = userDao.findPermissionByUserid(userid);
List<String> collect = permissionList.stream().map(item ->item.getPercode()).collect(Collectors.toList());
return collect;
}
}
添加jdk版本的依赖,修改版本号
<properties> <java.version>8</java.version> </properties>
3.3.创建permission实体类
package com.hmq.entity;
import lombok.Data;
@Data
public class Permission {
private Integer perid;
private String pername;
private String percode;
}
3.4.userDao和sql映射
package com.hmq.dao;
import com.hmq.entity.Permission;
import com.hmq.entity.User;
import java.util.List;
public interface UserDao {
User findByUsername(String username);
List<Permission> findPermissionByUserid(Integer userid);
}
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<!--namesapce的内容必须和对应的接口路径映射-->
<mapper namespace="com.hmq.dao.UserDao">
<select id="findByUsername" resultType="com.hmq.entity.User">
select * from user where username=#{username}
</select>
<select id="findPermissionByUserid" resultType="com.hmq.entity.Permission">
select p.* from user_role ur join role_permission rp on ur.roleId=rp.releid
join permission p on rp.perid=p.perid where ur.userid=#{userId}
</select>
</mapper>
3.5.测试
报错,是因为这里没有修改,jdk版本问题
任何人登录都看到了所有的按钮权限---想不同人登录具有什么权限能够看懂神门按钮。
解决方案:在jsp中使用shiro标签库
我们虽然在浏览器看到相应的按钮---可是我可以同别的方式能访问后台对应的资源。 shiro提供了注解。---判断该是否具有该注解的权限---才会执行对应的资源方法
<%--
Created by IntelliJ IDEA.
User: DELL
Date: 2023/7/6
Time: 20:41
To change this template use File | Settings | File Templates.
--%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<html>
<head>
<title>Title</title>
</head>
<body>
欢迎来到我是大帅哥<br>
<shiro:hasPermission name="user:query"><a href="/user/query">查询用户</a><br></shiro:hasPermission>
<shiro:hasPermission name="user:update"><a href="/user/update">修改用户</a><br></shiro:hasPermission>
<shiro:hasPermission name="user:delete"><a href="/user/delete">删除用户</a><br></shiro:hasPermission>
<shiro:hasPermission name="user:insert"><a href="/user/insert">添加用户</a><br></shiro:hasPermission>
<shiro:hasPermission name="user:export"><a href="/user/export">导出用户</a><br></shiro:hasPermission>
</body>
</html>
测试:
package com.hmq.controller;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/user")
public class UserController {
@GetMapping("/query")
// @RequiresPermissions(value = {"user:query","user:delete"},logical = Logical.OR)
@RequiresPermissions(value = "user:query")
public String query(){
return "user:query------------------------";
}
@GetMapping("/update")
@RequiresPermissions(value = "user:update")
public String update(){
return "user:update------------------------";
}
@GetMapping("/delete")
@RequiresPermissions(value = "user:delete")
public String delete(){
return "user:delete------------------------";
}
@GetMapping("/insert")
@RequiresPermissions(value = "user:insert")
public String insert(){
return "user:insert------------------------";
}
@GetMapping("/export")
@RequiresPermissions(value = "user:export") //该注解不能别识别
public String export(){
return "user:export------------------------";
}
}
发现上面注解不生效-----spring没有开启该注解的驱动---spring配置文件加入如下内容
<!-- 启动Shrio的注解 shiro加在controller应该属于springmvc的配置 -->
<bean id="lifecycleBeanPostProcessor"
class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<bean
class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
depends-on="lifecycleBeanPostProcessor" />
<bean
class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />
</bean>
4.处理权限不足的异常
4.1.创建一个异常处理类
package com.hmq.handler;
import org.apache.shiro.authz.UnauthorizedException;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
@ControllerAdvice
public class MyHandler {//处理controller中出现的异常,该类注解必须能被spring扫描到
//捕获异常
@ExceptionHandler(value = UnauthorizedException.class)
public String unauthorizedException(UnauthorizedException e){
e.printStackTrace();
return "403";
}
}
4.2.创建403.jsp文件
5.ssm整合shiro前后端分离
1.前后分离---后台返回的都是json数据。
2.根据账号和密码登录后。
3.权限不足时
4.未登录
5.1.根据账号和密码录时
1)创建Result
package com.hmq.vo;
import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
@Data
@NoArgsConstructor
@AllArgsConstructor
public class Result {
private Integer code;
private String msg;
private Object data;
}
2)修改LoginController
package com.hmq.controller;
import com.hmq.vo.LoginVo;
import com.hmq.vo.Result;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class LoginController {
@PostMapping("/login")
@ResponseBody
public Result login(LoginVo loginVo){//@RequestBody接受的json对象参数 不加:表单数据以及地址栏传递的数据
//传递的数据校验
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(loginVo.getUsername(), loginVo.getPassword());
try{
subject.login(token);
//return "success";//经过视图解析器 /WEB-INF/views/success.jsp
return new Result(200,"登录成功",null);
}catch (Exception e){
e.printStackTrace();
//return "redirect:/login.jsp";
return new Result(500,"登录失败,账号或密码错误",null);
}
}
}
5.2权限不足时
修改权限不足的异常处理类
package com.hmq.handler;
import com.hmq.vo.Result;
import org.apache.shiro.authz.UnauthorizedException;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;
//处理controller中出现的异常,该类注解必须能被spring扫描到
@ControllerAdvice
public class MyHandler {
//捕获异常
@ExceptionHandler(value = UnauthorizedException.class)
@ResponseBody
public Result unauthorizedException(UnauthorizedException e){
e.printStackTrace();
//return "403";
return new Result(403,"权限不足",null);
}
}
在postman中运行测试
5.3未登录
1)未登录跳转到一个接口路径
在LoginController中,添加unlogin的跳转路径
@GetMapping("/unlogin") @ResponseBody public Result unlogin(){ return new Result(401,"请先登录",null); }
2)定义过滤器
(1)定义一个过滤器
package com.hmq.filter;
import com.alibaba.fastjson.JSON;
import com.hmq.vo.Result;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.PrintWriter;
public class LoginFilter extends FormAuthenticationFilter {
//未登录访问资源时,会触发该方法---默认内容是重定向到登录页面---重写改为返回json数据
@Override
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
//解决响应数据的中文乱码问题
response.setContentType("application/json;charset=utf-8");
PrintWriter writer = response.getWriter();
Result result = new Result(401, "快先登录", null);
//把java对象转换为json字符串----JSON
String jsonString = JSON.toJSONString(result);
//通过流,把jsonString配置给前端
writer.print(jsonString);
writer.flush();
writer.close();
return false;
}
}
(2)导入json依赖
<!--json依赖-->
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>fastjson</artifactId>
<version>1.2.62</version>
</dependency>
(3)修改spring配置文件
<!--引入自定义的过滤器-->
<property name="filters">
<map>
<entry key="authc" value-ref="myFilter"/>
</map>
</property>
</bean>
<bean id="myFilter" class="com.hmq.filter.LoginFilter">
</bean>
注意:调整版本号
6.shiro权限对象缓存到redis中
避免频繁的查询数据库
第三方帮助完成了shiro整合redis
6.1导入shiro整合redis依赖
<!--shiro和redis整合的依赖-->
<dependency>
<groupId>org.crazycake</groupId>
<artifactId>shiro-redis</artifactId>
<version>2.4.6</version>
</dependency>
6.2修改spring配置文件
<!--shiro和spring整合的配置-->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="myRealm"/>
<!--设置缓存管理器-->
<property name="cacheManager" ref="redisCacheManager"/>
</bean>
<!--redis缓存管理器-->
<bean id="redisCacheManager" class="org.crazycake.shiro.RedisCacheManager">
<!--缓存管理的地址redisManager-->
<property name="redisManager" ref="redisManager"/>
</bean>
<!--redis管理器-->
<bean id="redisManager" class="org.crazycake.shiro.RedisManager">
<property name="host" value="192.167.245.223"/>
<property name="database" value="1"/>
<property name="password" value="6379"/>
</bean>