rememberMe

最新推荐文章于 2022-10-06 15:52:08 发布

chengxiesuan0485

最新推荐文章于 2022-10-06 15:52:08 发布

阅读量219

点赞数

文章标签： java 测试 web.xml

原文链接：https://my.oschina.net/u/4116658/blog/3044576

版权

session

shiro提供的session不依赖web容器，可以直接使用，如果是在web环境下，session中的数据和httpsession中的数据是通的。Shiro中的session可以出现在任何地方，例如service、dao等，不需要从controller中传递session参数，用户保存在session中的数据可以在HTTP session中获取，保存在httpsession中的数据也可以从session中获取。

session常用方法

在这里插入图片描述

实现登录成功后保存登录信息到session中

创建FormAuthenticationFilter的子类重写onLoginSuccess方法

package com.sxt.filter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
/**
 * 自定义的FormAuthenticationFilter过滤器
 * @author xieS
 *
 */
public class MyFormAuthenticationFilter extends FormAuthenticationFilter{

	/**
	 * 当登录成功的时候执行的方法
	 */
	@Override
	protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request,
			ServletResponse response) throws Exception {
		// 向session中保存信息
		Session session = subject.getSession();
		session.setAttribute("msg", "登录成功了。。。");
		return super.onLoginSuccess(token, subject, request, response);
	}
}

配置文件中配置(applicationContext-shiro.xml)

<!-- 配置自定义的表单过滤器 -->
<bean id="customFormAuthenticationFilter" class="com.dpb.filter.CustomFormAuthenticationFilter">
		<!-- 可以修改表单接收的参数名称 -->
		<property name="usernameParam" value="username" />
		<property name="passwordParam" value="password" />
	</bean>

	<!-- 注册ShiroFilterFactoryBean 注意id必须和web.xml中注册的targetBeanName的值一致 -->
	<bean class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"
		id="shiro">
		<!-- 注册SecurityManager -->
		<property name="securityManager" ref="securityManager" />
		<!-- 登录地址 如果用户请求的的地址是 login.do 那么会对该地址认证 -->
		<property name="loginUrl" value="/login.do" />
		<!-- 登录成功的跳转地址 -->
		<property name="successUrl" value="/jsp/success.jsp" />
		<!-- 访问未授权的页面跳转的地址 -->
		<property name="unauthorizedUrl" value="/jsp/refuse.jsp" />

		<property name="filters">
			<map>
				<entry key="authc" value-ref="customFormAuthenticationFilter"/>
			</map>
		</property>
		<!-- 设置 过滤器链 -->
		<property name="filterChainDefinitions">
			<value>
			<!--加载顺序从上往下。
 					authc需要认证
 					anon可以匿名访问的资源
 				 -->
				/login.do=authc
				/login.jsp=anon
				/logout=logout
				/**=user
			</value>
		</property>
	</bean>

注意:必须配置为 user级别，authc级别的rememberMe没有效果在这里插入图片描述

测试

在这里插入图片描述　到此就可以测试了。登录的时候勾选记住密码关闭浏览器，再访问user级别的请求就直接可以访问了。但是因为此时并没有真正的认证，所以此时的session并不能使用，这时我们可以实现一个过滤器。来拦截rememberMe功能的请求即可

remember me

　Shiro提供了记住我（RememberMe）的功能，比如访问如淘宝等一些网站时，关闭了浏览器下次再打开时还是能记住你是谁，下次访问时无需再登录即可访问，基本流程如下：

首先在登录页面选中RememberMe然后登录成功；如果是浏览器登录，一般会把RememberMe的Cookie写到客户端并保存下来；
关闭浏览器再重新打开；会发现浏览器还是记住你的；
访问一般的网页服务器端还是知道你是谁，且能正常访问；

在这里插入图片描述　注意：如果我们在认证的AuthenticationInfo info = new SimpleAuthenticationInfo(user, pwd, credentialsSalt, “myrealm”); 保存的是自定义的对象，那么该对象必须实现Serializable接口，因为该对象要被持久化到cookie中！！！

登录表单中添加记住我复选框

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
	<h1>${msg}</h1>
	<form action="/login.do" method="post">
		账号：<input type="text" name="username" value="zhangsan"><br>
		密码：<input type="password" name="password" value="123456"><br>
		<input type="checkbox" name="rememberMe"/>记住密码<br/>
		<input type="submit" value="登录">
	</form>
</body>
</html>

jsp页面

==error.jsp==

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
<h1>登录失败</h1>
</body>
</html>

==home.jsp==

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<!-- 引入shiro标签 -->
<%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
	<h1>shiro权限标签：</h1>
	<h2>
		当前登录用户：<shiro:principal property="username"></shiro:principal>
	</h2>
	<!-- 只有没登录才能看到 -->
	<shiro:guest>
    	<label>您当前是游客，</label><a href="/login.jsp" >请登录</a>
	</shiro:guest>
	<!-- 只有验证通过才能看到 -->
	<shiro:authenticated>
    	<label>用户身份验证已通过 </label>
	</shiro:authenticated>
	<ul>
		<!-- 需要有query权限 -->
		<shiro:hasPermission name="query">
			<li><a href="#">用户管理-查看</a></li>
		</shiro:hasPermission>
		<shiro:hasPermission name="insert">
			<li><a href="#">用户管理-添加</a></li>
		</shiro:hasPermission>
		<shiro:hasPermission name="delete">
			<li><a href="#">用户管理-删除</a></li>
		</shiro:hasPermission>
		<!-- 登录就可以访问 -->
		<shiro:authenticated>
			<li><a href="#">用户管理-更新</a></li>
		</shiro:authenticated>
	</ul>
</body>
</html>

==refuse.jsp==

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
	<h1>不好意思，没有权限，请联系管理员：xxxxxx</h1>
</body>
</html>

==success.jsp==

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
<h1>登录成功！！！</h1>
</body>
</html>

pojo

在这里插入图片描述

mapper

在这里插入图片描述

service

在这里插入图片描述

controller

==UserController==

package com.sxt.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.session.Session;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class UserController {

	@RequiresPermissions("query") //需要一个query权限
	@RequestMapping("/query")
	@ResponseBody
	public String query(){
		Session session = SecurityUtils.getSubject().getSession();
		System.out.println(session.getAttribute("msg"));
		return "query------"+session.getAttribute("msg");
	}
	
	@RequiresPermissions("insert")
	@RequestMapping("/insert")
	@ResponseBody
	public String insert(){
		Session session = SecurityUtils.getSubject().getSession();
		System.out.println("------>"+session.getAttribute("msg"));
		return "insert------";
	}
	
	@RequiresPermissions("delete")
	@RequestMapping("/delete")
	@ResponseBody
	public String delete(){
		return "delete------";
	}
	
	@RequestMapping("/update")
	@ResponseBody
	public String update(){
		return "update------";
	}	
}

==LoginController==

package com.sxt.controller;

import javax.servlet.http.HttpServletRequest;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class LoginController {
	
	/**
	 * 设定登录失败跳转的资源以及获取失败的信息
	 * 
	 * @param model
	 * @param request
	 * @return
	 */
	@RequestMapping("/login.do")
	public String login(Model model, HttpServletRequest request) {
		Object ex = request.getAttribute(FormAuthenticationFilter.DEFAULT_ERROR_KEY_ATTRIBUTE_NAME);
		if (ex != null) {
			System.out.println(ex.toString() + "----------");
		}
		if (UnknownAccountException.class.getName().equals(ex)) {
			System.out.println("----账号不正确----->");
			model.addAttribute("msg", "账号不正确");
		} else if (IncorrectCredentialsException.class.getName().equals(ex)) {
			System.out.println("----密码不正确----->");
			model.addAttribute("msg", "密码不正确");
		} else {
			System.out.println("----其他错误----->");
			model.addAttribute("msg", "其他错误");
		}
		return "/login.jsp";
	}

}

realm

==SecurityRealm==

package com.sxt.realm;

import java.util.List;
import javax.annotation.Resource;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.SimpleByteSource;
import com.sxt.pojo.User;
import com.sxt.service.UserService;

public class SecurityRealm extends AuthorizingRealm {
	@Resource
	private UserService userService;

	/**
	 * 认证的方法
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		UsernamePasswordToken t = (UsernamePasswordToken) token;
		// 获取登录的账号
		String username = t.getUsername();
		List<User> list = userService.login(username);
		if (list == null || list.size() !=1) {
			return null;
		}
		User user = list.get(0);
		// 身份信息（keys账号也可以是对象） 密码 realmName（自定义）
		return new SimpleAuthenticationInfo(user
				, user.getPassword()
				, new SimpleByteSource(user.getSalt())
				, "sxt");
	}
	/**
	 * 授权的方法
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		System.out.println("授权操作。。。");
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		info.addStringPermission("query");
		info.addStringPermission("insert");
		return info;
	}

	/**
	 * 清空缓存
	 * 	能够使授权能够立马生效
	 */
	public void clean(){
		PrincipalCollection principal = 
				SecurityUtils.getSubject().getPreviousPrincipals();
		super.clearCache(principal);
	}
}

filter

==MyFormAuthenticationFilter==

package com.sxt.filter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
/**
 * 自定义的FormAuthenticationFilter过滤器
 * @author xieS
 *
 */
public class MyFormAuthenticationFilter extends FormAuthenticationFilter{

	/**
	 * 当登录成功的时候执行的方法
	 */
	@Override
	protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request,
			ServletResponse response) throws Exception {
		// 向session中保存信息
		Session session = subject.getSession();
		session.setAttribute("msg", "登录成功了。。。");
		return super.onLoginSuccess(token, subject, request, response);
	}
}

==RememberFormAuthenticationFilter==

package com.sxt.filter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;

public class RememberFormAuthenticationFilter extends FormAuthenticationFilter{

	@Override
	protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
		Subject subject = getSubject(request, response);
		Session session = subject.getSession();
		// 记住密码，没有登录isAuthenticated()肯定为false
		if(!subject.isAuthenticated()
				&&subject.isRemembered()
				&&session.getAttribute("msg")==null){
			System.out.println("记住的用户是:"+subject.getPrincipal());
			session.setAttribute("msg", "remember中保存的信息");
		}
		return subject.isAuthenticated()||subject.isRemembered();
	}
}

applicationContext

==applicationContext-base.xml==

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
	xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd
		http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.3.xsd
		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.3.xsd">
	
	<!-- 关联数据属性文件 -->
	<context:property-placeholder location="classpath:db.properties"/>
	<!-- 开启扫描 -->
	<context:component-scan base-package="com.sxt.service.impl"/>

	<!-- 配置数据源 -->
	<bean class="com.mchange.v2.c3p0.ComboPooledDataSource" id="dataSource" >
		<property name="driverClass" value="${driver}"></property>
		<property name="jdbcUrl" value="${url}"></property>
		<property name="user" value="${names}"></property>
		<property name="password" value="${password}"></property>
	</bean>
	<!-- 整合mybatis -->
	<bean class="org.mybatis.spring.SqlSessionFactoryBean" id="sqlSessionFactoryBean" >
		<!-- 关联数据源 -->
		<property name="dataSource" ref="dataSource"/>
		<!-- 关联mybatis的配置文件 -->
		<property name="configLocation" value="classpath:mybatis-config.xml"/>
		<!-- 添加别名设置 -->
		<property name="typeAliasesPackage" value="com.sxt.pojo"/>
	</bean>
	<!-- 配置扫描的路径 -->
	<bean class="org.mybatis.spring.mapper.MapperScannerConfigurer" >
		<property name="basePackage" value="com.sxt.mapper"/>
	</bean>
</beans>

==applicationContext-shiro.xml==

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
	xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd
		http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.3.xsd
		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.3.xsd">
	
	<!-- 配置凭证匹配器 -->
	<bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
		<!-- 指定散列算法和迭代次数 -->
		<property name="hashAlgorithmName" value="md5"/>
		<property name="hashIterations" value="1024"/>
	</bean>
	
	<!-- 配置自定义的Realm -->
	<bean class="com.sxt.realm.SecurityRealm" id="securityRealm">
		<!-- 配置对应的匹配器 -->
		<property name="credentialsMatcher" ref="credentialsMatcher"/>
	</bean>
	
	<!-- remenberMe配置 -->
	<bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
		<constructor-arg value="rememberMe" />
		<property name="httpOnly" value="true" /> 
		<!-- 默认记住7天（单位：秒） -->
		<property name="maxAge" value="604800" />
	</bean> 
	<!-- rememberMe管理器 -->
	<bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
		<property name="cipherKey" value="#{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}" />
		<property name="cookie" ref="rememberMeCookie" />
	</bean> 
	
	<!-- 配置缓存管理器 -->
 	<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
 		<!-- 注入属性文件 -->
 		<property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml"/>
 	</bean>
	
	<!-- 配置SecurityManager -->
	<bean class="org.apache.shiro.web.mgt.DefaultWebSecurityManager" id="securityManager">
 		<!-- 关联配置自定义Realm -->
 		<property name="realm" ref="securityRealm"/>
 		<!-- 关联缓存管理器 -->
 		<property name="cacheManager" ref="cacheManager"></property>
 		 <property name="rememberMeManager" ref="rememberMeManager"></property>
 	</bean>
 	
 	<!-- 注册自定义的过滤器 -->
 	<bean class="com.sxt.filter.MyFormAuthenticationFilter" id="myFormAuthenticationFilter">
 		<property name="usernameParam" value="username"/>
 		<property name="passwordParam" value="password"/>
 	</bean> 
 	
 	<bean class="com.sxt.filter.RememberFormAuthenticationFilter" id="rememberFormAuthenticationFilter">
 	
 	</bean>
 	
 	<!-- 注册ShiroFilterFactoryBean id必须要和web.xml文件中的targetName一致 -->
 	<bean id="shiro" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 		<!-- 注册SecurityManager -->
 		<property name="securityManager" ref="securityManager"/>
 		<!-- 登录地址 如果用户请求的的地址是 login.do 那么会对该地址认证-->
 		<property name="loginUrl" value="/login.do"/>
 		<!-- 登录成功的跳转地址 -->
 		<property name="successUrl" value="/success.jsp"/>
 		<!-- 访问未授权的页面跳转的地址 -->
 		<property name="unauthorizedUrl" value="/refuse.jsp"/>
 		<!-- 配置自定义的过滤器 -->
 		<property name="filters">
 			<map>
 				<entry key="authc" value-ref="myFormAuthenticationFilter"/>
 				<entry key="remember" value-ref="rememberFormAuthenticationFilter"></entry>
 			</map>
 		</property>
 		<!-- 设置 过滤器链 -->
 		<property name="filterChainDefinitions">
 			<value>
 				<!--加载顺序从上往下。
 					authc需要认证
 					anon可以匿名访问的资源
 				 -->
 				/login.do=authc
				/login.jsp=anon
				/query=authc
				/**=remember,user
 			</value>
 		</property>
 	</bean>

</beans>

shiro-ehcache.xml

<?xml version="1.0" encoding="UTF-8"?>
<ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:noNamespaceSchemaLocation="../config/ehcache.xsd">
	<!--diskStore：缓存数据持久化的目录 地址  -->
	<diskStore path="C:\tools\ehcache" />
	<!--   
	eternal：缓存中对象是否为永久的，如果是，超时设置将被忽略，对象从不过期。  
	maxElementsInMemory：缓存中允许创建的最大对象数  
	overflowToDisk：内存不足时，是否启用磁盘缓存。  
	timeToIdleSeconds：缓存数据的钝化时间，也就是在一个元素消亡之前，  两次访问时间的最大时间间隔值，这只能在元素不是永久驻留时有效，如果该值是 0 就意味着元素可以停顿无穷长的时间。  
	timeToLiveSeconds：缓存数据的生存时间，也就是一个元素从构建到消亡的最大时间间隔值，这只能在元素不是永久驻留时有效，如果该值是0就意味着元素可以停顿无穷长的时间。  
	memoryStoreEvictionPolicy：缓存满了之后的淘汰算法。  
	diskPersistent:设定在虚拟机重启时是否进行磁盘存储，默认为false
	diskExpiryThreadIntervalSeconds: 属性可以设置该线程执行的间隔时间(默认是120秒，不能太小
	1 FIFO，先进先出  
	2 LFU，最少被使用，缓存的元素有一个hit属性，hit值最小的将会被清出缓存。  
	3 LRU，最近最少使用的，缓存的元素有一个时间戳，当缓存容量满了，而又需要腾出地方来缓存新的元素的时候，那么现有缓存元素中时间戳离当前时间最远的元素将被清出缓存。  
	--> 
	<defaultCache 
		maxElementsInMemory="1000" 
		maxElementsOnDisk="10000000"
		eternal="false" 
		overflowToDisk="false" 
		diskPersistent="false"
		timeToIdleSeconds="120"
		timeToLiveSeconds="120" 
		diskExpiryThreadIntervalSeconds="120"
		memoryStoreEvictionPolicy="LRU">
	</defaultCache>
</ehcache>

springmvc.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:mvc="http://www.springframework.org/schema/mvc"
	xmlns:aop="http://www.springframework.org/schema/aop"
	xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd
		http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.3.xsd">
	
	<!-- 开启扫描 -->
	<context:component-scan base-package="com.sxt.controller" use-default-filters="false">
		<context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
	</context:component-scan>
	
	<!-- 开启SpringMVC注解的方式 -->
	<mvc:annotation-driven >
		<!-- <mvc:message-converters>
			<bean class="com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter"></bean>
		</mvc:message-converters> -->
	</mvc:annotation-driven>
	
	<!-- 开启Shiro注解 -->
	<aop:config proxy-target-class="true"></aop:config>
	<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
		<property name="securityManager" ref="securityManager"/>
	</bean>
	
	<!-- shiro为集成springMvc 拦截异常 -->
	<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
		<!-- 什么异常对应什么页面 -->
		<property name="exceptionMappings">
			<props>
				<!-- 这里你可以根据需要定义N多个错误异常转发 -->
				<prop key="org.apache.shiro.authz.UnauthorizedException">redirect:/refuse.jsp</prop>
				<prop key="org.apache.shiro.authz.UnauthenticatedException">redirect:/login.jsp</prop>
				<prop key="java.lang.IllegalArgumentException">redirect:/error.jsp</prop> 
					<!-- 参数错误(bizError.jsp) -->
				<prop key="java.lang.Exception">redirect:/error.jsp</prop> <!-- 其他错误为'未定义错误'(unknowError.jsp) -->
			</props>
		</property>
	</bean>
	
</beans>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://java.sun.com/xml/ns/javaee"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
	id="WebApp_ID" version="3.0">
	<display-name>test</display-name>
	<!-- 这里配置Spring配置文件的位置，param-name是固定的， param-value是文件位置 这个配置可以省略，如果省略， 系统默认去/WEB-INF/目录下查找applicationContext.xml作为Spring的配置文件 -->
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath:applicationContext-*.xml</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	<servlet>
		<servlet-name>springmvc</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>classpath:springmvc.xml</param-value>
		</init-param>
	</servlet>
	<servlet-mapping>
		<servlet-name>springmvc</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
	<filter>
		<filter-name>encoding</filter-name>
		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
		<init-param>
			<param-name>forceRequestEncoding</param-name>
			<param-value>true</param-value>
		</init-param>
		<init-param>
			<param-name>forceResponseEncoding</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>encoding</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<!-- shiro过虑器，DelegatingFilterProxy通过代理模式将spring容器中的bean和filter关联起来 -->
	<filter>
		<filter-name>shiroFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
		<!-- 设置true由servlet容器控制filter的生命周期 -->
		<init-param>
			<param-name>targetFilterLifecycle</param-name>
			<param-value>true</param-value>
		</init-param>
		<!-- 设置spring容器filter的bean id，如果不设置则找与filter-name一致的bean -->
		<init-param>
			<param-name>targetBeanName</param-name>
			<!-- 这个值随便叫什么，但是在后面要用到的地方必须保持一致 -->
			<param-value>shiro</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>shiroFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<!-- 防止资源文件被spring MVC拦截 -->
	<servlet-mapping>
		<servlet-name>default</servlet-name>
		<url-pattern>*.jpg</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>default</servlet-name>
		<url-pattern>*.js</url-pattern>
	</servlet-mapping>
	<servlet-mapping>
		<servlet-name>default</servlet-name>
		<url-pattern>*.css</url-pattern>
	</servlet-mapping>
</web-app>

pom.xml

在这里插入图片描述

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<groupId>com.sxt</groupId>
	<artifactId>shiro-11-ssm-rememberme</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<packaging>war</packaging>

	<dependencies>
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-orm</artifactId>
			<version>4.3.21.RELEASE</version>
		</dependency>
  	<dependency>
  		<groupId>org.springframework</groupId>
  		<artifactId>spring-webmvc</artifactId>
  		<version>4.3.21.RELEASE</version>
  	</dependency>
  	<dependency>
  		<groupId>org.aspectj</groupId>
  		<artifactId>aspectjweaver</artifactId>
  		<version>1.8.9</version>
  	</dependency>
  	<dependency>
  		<groupId>org.mybatis</groupId>
  		<artifactId>mybatis</artifactId>
  		<version>3.4.5</version>
  	</dependency>
  	<dependency>
  		<groupId>org.mybatis</groupId>
  		<artifactId>mybatis-spring</artifactId>
  		<version>1.3.2</version>
  	</dependency>
  	<dependency>
  		<groupId>mysql</groupId>
  		<artifactId>mysql-connector-java</artifactId>
  		<version>5.1.47</version>
  	</dependency>
  	<dependency>
  		<groupId>org.slf4j</groupId>
  		<artifactId>slf4j-log4j12</artifactId>
  		<version>1.7.25</version>
  	</dependency>
  	<dependency>
  		<groupId>com.mchange</groupId>
  		<artifactId>c3p0</artifactId>
  		<version>0.9.5.3</version>
  	</dependency>
  	<dependency>
  		<groupId>javax.servlet</groupId>
  		<artifactId>servlet-api</artifactId>
  		<version>2.5</version>
  		<scope>provided</scope>
  	</dependency>
  	<!-- shiro相关的依赖 -->
	<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
	<dependency>
	<groupId>org.apache.shiro</groupId>
	<artifactId>shiro-spring</artifactId>
	<version>1.2.3</version>
</dependency>
<dependency>
	<groupId>org.apache.shiro</groupId>
	<artifactId>shiro-ehcache</artifactId>
	<version>1.2.3</version>
</dependency>
<dependency>
	<groupId>net.sf.ehcache</groupId>
	<artifactId>ehcache-core</artifactId>
	<version>2.5.0</version>
</dependency>


	</dependencies>
  <build> 
  	<plugins> 
  		<!-- tomcat插件 --> 
  		<plugin> 
  			<groupId>org.apache.tomcat.maven</groupId> 
  			<artifactId>tomcat7-maven-plugin</artifactId> 
  			<version>2.2</version> 
  			<configuration> 
  				<!-- 端口号 --> 
  				<port>8082</port> 
  				<!-- /表示访问路径 省略项目名 --> 
  				<path>/</path> 
  				<!-- 设置编码方式 --> 
  				<uriEncoding>utf-8</uriEncoding> 
  			</configuration> 
  		</plugin> 
  	</plugins> 
  </build>

</project>

转载于:https://my.oschina.net/u/4116658/blog/3044576