Shiro会话管理2

Shiro会话管理2

1.1 session的增删改查操作通过自定义的RedisCacheManager来操作

spring-shiro.xml

<!-- 系统默认SessionManager -->
    <bean class="com.shiro.session.DefaultWebSessionManager" id="sessionManager">
        <property name="sessionDAO" ref="redisSessionDao"></property>
    </bean>

    <bean class="com.shiro.session.RedisSessionDao" id="redisSessionDao"></bean>

在securityManager中配置sessionManager

<!-- 创建SecurityManager对象 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="realm" />
    <property name="sessionManager" ref="sessionManager" />
</bean>

解决每次获取session都从redis中读取

package com.shiro.session;

import org.apache.shiro.session.Session;
import org.apache.shiro.session.UnknownSessionException;
import org.apache.shiro.session.mgt.SessionKey;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.session.mgt.WebSessionKey;

import javax.servlet.ServletRequest;
import java.io.Serializable;

/**
 * 解决每次获取session都从redis中读取
 *
 * SessionKey里面存储着request对象,
 * 可以把session放到request对象里面,这样就没必要每次获取session都从redis里面读取了
 * 改变后读取session的顺序:sessionId->request->session
 */
public class CustomSessionManager extends DefaultWebSessionManager {

    @Override
    protected Session retrieveSession(SessionKey sessionKey) throws UnknownSessionException {
        //获取到sessionId
        Serializable sessionId = getSessionId(sessionKey);
        //获取request
        ServletRequest request = null;
        if (sessionKey instanceof WebSessionKey) {
            request = ((WebSessionKey) sessionKey).getServletRequest();
        }
        //若request不为空，并且sessionID不为空，则从request中获取session
        if (request != null && sessionId != null) {
            Session session = (Session) request.getAttribute(sessionId.toString());
            //获取到的session不为空，则返回
            if (session != null) {
                return session;
            }
        }

        //否则从redisSessionDao中获取session
        Session session = super.retrieveSession(sessionKey);
        //若获取的session不为空，则设值到request的作用域中
        if (request != null && sessionId != null) {
            request.setAttribute(sessionId.toString(), session);
        }

        return session;
    }
}

spring-shiro.xml

<!-- 自定义SessionManager -->
    <bean class="com.shiro.session.CustomSessionManager" id="sessionManager">
        <property name="sessionDAO" ref="redisSessionDao"></property>
    </bean>

    <bean class="com.shiro.session.RedisSessionDao" id="redisSessionDao"></bean>