56_shiro框架_02

最新推荐文章于 2024-10-01 18:51:18 发布

Mr.chen000

最新推荐文章于 2024-10-01 18:51:18 发布

阅读量113

点赞数

分类专栏： SpringBoot 文章标签： java

本文链接：https://blog.csdn.net/m0_43407221/article/details/118272273

版权

SpringBoot 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

本文详细介绍了如何在SpringBoot项目中整合Shiro框架，包括Shiro的基础认识、依赖注入、配置ShiroConfig、认证流程、自定义Realm、授权管理、登录退出处理、登录跳转问题的解决、权限注解的使用、缓存管理和RememberMe功能的实现，为读者提供了全面的Shiro实战教程。

摘要由CSDN通过智能技术生成

文章目录

1 Shiro

1 Shiro

1.1 认识 Shiro

有空再写

1.2 SpringBoot 整合 Shiro

1.2.1 注入依赖

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring-boot-web-starter</artifactId>
    <version>1.5.0</version>
</dependency>

1.2.2 编写 ShiroConfig

20201208225829918

package com.cl.config;

import com.cl.realm.CustomRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;

/**
 * @Author chenlan
 * @Date 2020/12/8 16:53
 * @Description TODO
 */

@Configuration
public class ShiroConfig {

    /**
     * 配置 ShiroFilterFactoryBean (核心过滤器工厂)
     *
     * @return
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();

        // 设置认证失败的跳转地址
        factoryBean.setLoginUrl("/user/loginError.action");

        // 设置认证成功的跳转地址
        factoryBean.setSuccessUrl("/index.action");

        // 设置认证成功的用户访问无权限资源时的跳转地址
//        factoryBean.setUnauthorizedUrl();

//        factoryBean.getFilters();


        // 设置安全管理器
//        factoryBean.setSecurityManager(securityManager());

        HashMap<String, String> filterChainDefinitionMap = new HashMap<>(11);
        // anon 匿名过滤器 添加到此过滤器中的请求不需要进行认证 , 直接放行
        filterChainDefinitionMap.put("/favicon.ico", "anon");
        filterChainDefinitionMap.put("/images/**", "anon");
        filterChainDefinitionMap.put("/user/loginPage.action", "anon");
        // authc 表单过滤器  org.apache.shiro.web.filter.authc.FormAuthenticationFilter 表单过滤器
        filterChainDefinitionMap.put("/**", "authc");

        // 设置核心过滤器过滤链
        factoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        return factoryBean;
    }
}

1.2.3 Shiro 的过滤器

过滤器使用别名	过滤器类型
anon	org.apache.shiro.web.filter.authc.AnonymousFilter
authc	org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authcBasic	org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
logout	org.apache.shiro.web.filter.authc.LogoutFilter
noSessionCreation	org.apache.shiro.web.filter.session.NoSessionCreationFilter
perms	org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
port	org.apache.shiro.web.filter.authz.PortFilter
rest	org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
roles	org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
ssl	org.apache.shiro.web.filter.authz.SslFilter
user	org.apache.shiro.web.filter.authc.UserFilter

1.3 认证

认证逻辑

用户在前端请求登录,登录请求会被表单过滤器拦截,请求的参数存储在 request 域对象中,

默认参数名为 username 和 password ,

过滤器在 request 对象中获取这两个参数值(进行了处理)

封装到 token 令牌中,调用自定义 realm 中重写的认证方法 doGetAuthenticationInfo 对 token 进行认证

认证成功,跳转到成功页面,认证失败,返回到登录页面

FormAuthenticationFilter 部分源码

	public static final String DEFAULT_USERNAME_PARAM = "username";
    public static final String DEFAULT_PASSWORD_PARAM = "password";

    private String usernameParam = DEFAULT_USERNAME_PARAM;
    private String passwordParam = DEFAULT_PASSWORD_PARAM;

    public String getUsernameParam() {
        return usernameParam;
    }

    public String getPasswordParam() {
        return passwordParam;
    }
  
    protected String getUsername(ServletRequest request) {
        return WebUtils.getCleanParam(request, getUsernameParam());
    }

    protected String getPassword(ServletRequest request) {
        return WebUtils.getCleanParam(request, getPasswordParam());
    }

    protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
        String username = getUsername(request);
        String password = getPassword(request);
        return createToken(username, password, =request, response);
    }

1.3.1 设置安全管理器

package com.cl.config;

import com.cl.realm.CustomRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;

/**
 * @Author chenlan
 * @Date 2020/12/8 16:53
 * @Description TODO
 */

@Configuration
public class ShiroConfig {

    /**
     * 配置 ShiroFilterFactoryBean (核心过滤器工厂)
     *
     * @return
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
		....
		
        // 设置安全管理器
        factoryBean.setSecurityManager(securityManager());
        
        ....

        return factoryBean;
    }


    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 添加 自定义 realm 到 安全管理器中
        securityManager.setRealm(customRealm());
        return securityManager;
    }

    @Bean
    public Realm customRealm() {
        // 创建自定义 realm
        CustomRealm customRealm = new CustomRealm();
        // 添加凭证匹配器到 自定义 realm 中
        customRealm.setCredentialsMatcher(credentialsMatcher());
        return customRealm;
    }

    @Bean
    public HashedCredentialsMatcher credentialsMatcher() {
        // 创建 凭证匹配器
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("MD5");
        hashedCredentialsMatcher.setHashIterations(3);
        return hashedCredentialsMatcher;
    }

}

1.3.2 编写自定义 realm 认证方法

package com.cl.realm;

import com.cl.pojo.User;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

import java.util.Arrays;
import java.util.List;

/**
 * @Author chenlan
 * @Date 2020/12/8 17:27
 * @Description TODO
 */
public class CustomRealm extends AuthorizingRealm {
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principal) {
        return null;
    }

    /**
     * 认证
     * @param token
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String principal = (String) token.getPrincipal();
        // 模拟用户列表
        List<String> list = Arrays.asList("admin", "cl");
        if (!list.contains(principal)) {
            return null;
        }
        // 模拟查询用户结果
        User user = new User("cl","58debabe30441a9e22c11c95059ffc26","sxt");
        String hashedCredentials = user.getPassword();
        ByteSource credentialsSalt = ByteSource.Util.bytes(user.getSalt());
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user,hashedCredentials,credentialsSalt,this.getName());
        return authenticationInfo;
    }
}

1.3.3 设置认证失败页面

FormAutherticationFilter 部分源码:

// FormAutherticationFilter.java
// 用户登录请求通过表单过滤器时进行认证,认证失败跳转到错误页面 会共享错误信息

public static final String DEFAULT_ERROR_KEY_ATTRIBUTE_NAME = "shiroLoginFailure";

private String failureKeyAttribute = DEFAULT_ERROR_KEY_ATTRIBUTE_NAME;


public String getFailureKeyAttribute() {
      return failureKeyAttribute;
}

public void setFailureKeyAttribute(String failureKeyAttribute) {
      this.failureKeyAttribute = failureKeyAttribute;
}

protected void setFailureAttribute(ServletRequest request, AuthenticationException ae) {
      String className = ae.getClass().getName();
      request.setAttribute(getFailureKeyAttribute(), className);
}

Controller层:

// 认证失败/没有认证跳转    
    @RequestMapping("/loginError.action")
    public String loginError(HttpServletRequest request, Model model){
        String shiroLoginFailure = (String) request.getAttribute("shiroLoginFailure");
        if (shiroLoginFailure != null) {
            if(UnknownAccountException.class.getName().equals(shiroLoginFailure)){
                model.addAttribute("errorMsg", "没有此账号");
            }
            if(IncorrectCredentialsException.class.getName().equals(shiroLoginFailure)){
                model.addAttribute("errorMsg", "用户密码错误");
            }
        }
        return "login";
     }
// 认证成功跳转
    @RequestMapping("/index.action")
    public String loginSuccess(){
        return "index";
    }

1.3.4 认证成功显示认证信息

1.3.4.1 导入依赖

<!--Thymeleaf对Shiro标签支持依赖-->
        <dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>2.0.0</version>
        </dependency>

1.3.4.2 在 ShiroConfig 配置文件中配置方言

/*配置Shiro方言，让Thymeleaf支持Shiro标签*/
    @Bean
    public ShiroDialect shiroDialect() {
        return new ShiroDialect();
    }

1.3.4.3 在 thymeleaf 页面中引入 shiro 标签

<html lang="en" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">

1.3.4.4 使用`<shiro:principal>`标签

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">
<head>
    <meta charset="UTF-8">
    <title>测试:成功登录主页</title>
</head>
<body>
<shiro:principal></shiro:principal><br>
<span>欢迎:</span>
<shiro:principal property="username"></shiro:principal><br>
<a th:href="@{/user/userPage}">用户管理</a><br>
<a th:href="@{/student/studentPage}">学生管理</a><br>
<a th:href="@{/teacher/teacherPage}">教师管理</a><br>
</body>
</html>

1.3.4.5 执行效果

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-IhLaYZPg-1624769729082)(E:\Java\img\image-20201209091852605.png)]

1.3.5 退出登录

使用LogoutFilter

1.3.5.1 在配置文件 ShiroConfig 中配置 LogoutFilter

// logout 退出过滤器 org.apache.shiro.web.filter.authc.LogoutFilter
filterChainDefinitionMap.put("/logout.action", "logout");

1.3.5.2 在首页设置退出登录

<a th:href="@{/logout.action}">退出登录</a>

1.3.5.3 自定义LogoutFilter

    public LogoutFilter logoutFilter(){
        LogoutFilter logoutFilter = new LogoutFilter();
        logoutFilter.setRedirectUrl("/user/loginPage.action");
        return logoutFilter;
    }

在 ShrioFilterFactoryBean 中配置自定义的过滤器

HashMap<String, Filter> map = new HashMap<>(10);
map.put("logout",logoutFilter());
// 配置开发者自定义过滤器
factoryBean.setFilters(map);

1.4 登录跳转问题

1.4.1 产生原因

Shiro 框架表单认证过滤器,会自动记录浏览器中在当前项目中的最后一次访问的任何一个页面,并且保存到 Session中,当用户认证成功以后,shiro 自动跳转到这个页面,不管页面存在与否

1.4.2 解决方案

配置自定义表单过滤器

package com.cl.config;

import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.apache.shiro.web.util.WebUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * @Author chenlan
 * @Date 2020/12/10 15:22
 * @Description TODO
 */
public class MyFormAuthenticationFilter extends FormAuthenticationFilter {
    @Override
    protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request, ServletResponse response) throws Exception {
        // 清除保存在 session 中的 SavedRequest
        WebUtils.getAndClearSavedRequest(request);
        return super.onLoginSuccess(token, subject, request, response);
    }
}

在配置文件 ShiroConfig 添加自定义的过滤器

 /**
     * 可以对 表单过滤器的参数进行自定义
     * myFormAuthenticationFilter.setUsernameParam();
     * myFormAuthenticationFilter.setPasswordParam();
     * myFormAuthenticationFilter.setRememberMeParam();
     * @return 返回自定义表单过滤器
     */
    public MyFormAuthenticationFilter getMyFormAuthenticationFilter(){
        MyFormAuthenticationFilter myFormAuthenticationFilter = new MyFormAuthenticationFilter();
        return myFormAuthenticationFilter;
    }

在 shiroFilterFactoryBean 中添加

HashMap<String, Filter> map = new HashMap<>(10);
   map.put("authc", getMyFormAuthenticationFilter());
factoryBean.setFilters(map);

1.5 授权

授权逻辑

用户进行认证之后,访问页面会发送请求,例如:/user/userPage.action

需要权限的请求会被授权过滤器拦截,授权管理器调用自定义 realm 中的 doGetAuthorizationInfo 方法进行权限查询,如果realm 的授权列表中有此权限,则授权通过,如果没有此权限,则授权不通过,跳转到一个没有权限提示信息页面

1.5.1 自定义 realm 中查询权限

/**
     * 授权方法
     * @param principal
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principal) {
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        // 模拟用户拥有的权限
        simpleAuthorizationInfo.addStringPermissions(Arrays.asList("user:list","student:list"));
        return simpleAuthorizationInfo;
    }

1.5.2 在 ShiroConfig 的设置授权过滤器

**ShrioFilterFactoryBean **

HashMap<String, String> filterChainDefinitionMap = new HashMap<>(11);
//org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
filterChainDefinitionMap.put("/user/userPage.action","perms[user:list]");
filterChainDefinitionMap.put("/student/studentPage.action","perms[student:list]");
filterChainDefinitionMap.put("/teacher/teacherPage.action","perms[teacher:list]");
// 设置核心过滤器过滤链
factoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

1.5.3 设置授权失败跳转页面

// 设置认证成功的用户访问无权限资源时的跳转地址
factoryBean.setUnauthorizedUrl("/unauthorized.html");

当需要授权的页面很多时,在 ShiroConfig 中设置授权过滤器非常繁琐,可以使用注解配置

每次都从 realm 中查询数据库影响系统性能,可以使用shiro 缓存

1.5.4 使用注解配置

1.5.4.1 在 ShiroConfig 中开启注解开发

  /**
     * 设置Shiro框架对注解支持
     * @return
     */
    @Bean
    public SimpleMappingExceptionResolver simpleMappingExceptionResolver(){
        Properties properties = new Properties();

        /*此时跳转地址在对应 SpringMVC 视图解析前后缀对应位置，逻辑地址*/
        properties.put("org.apache.shiro.authz.UnauthorizedException","/unauthorized");

        SimpleMappingExceptionResolver simpleMappingExceptionResolver = new SimpleMappingExceptionResolver();

        simpleMappingExceptionResolver.setExceptionMappings(properties);

        return simpleMappingExceptionResolver;
    }

    /**
     * 设置 Shiro 框架对注解支持
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(){

        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();

        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());

        return authorizationAttributeSourceAdvisor;
    }

    /**
     * 设置 Spring 框架支持集成其他框架可以使用 AOP
     * @return
     */
    @Bean
    public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {

        DefaultAdvisorAutoProxyCreator autoProxyCreator = new DefaultAdvisorAutoProxyCreator();

        /*设置可以让 Shiro 框架使用 AOP 为表现层创建代理（ Shiro 权限判断的注解全部在表现层）*/
        autoProxyCreator.setProxyTargetClass(true);

        return autoProxyCreator;
}

1.5.4.2 在 controller 层设置注解

package com.cl.controller;

import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * @Author chenlan
 * @Date 2020/12/8 21:23
 * @Description TODO
 */

@Controller
@RequestMapping("/student")
public class StudentController {

    @RequestMapping("/studentPage.action")
    @RequiresPermissions("student:list")
    public String studentPage(){
        return "studentPage";
    }

}

1.5.4.3 使用Shiro 标签库

标签名称	标签条件（均是显示标签内容）
`<shiro:authenticated>`	登录之后
`<shiro:notAuthenticated>`	不在登录状态时
`<shiro:guest>`	用户在没有 RememberMe 时
`<shiro:user>`	用户在 RememberMe 时
`<shiro:hasAnyRoles name="abc,123" >`	在有 abc 或者 123 角色时
`<shiro:hasRole name="abc">`	拥有角色 abc
`<shiro:lacksRole name="abc">`	没有角色 abc
`<shiro:hasPermission name="abc">`	拥有权限资源 abc
`<shiro:lacksPermission name="abc">`	没有 abc 权限资源
`<shiro:principal>`	显示用户身份名称
`<shiro:principal property="username"/>`	显示用户身份中的属性值

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">
<head>
    <meta charset="UTF-8">
    <title>测试:成功登录主页</title>
</head>
<body>
<shiro:principal></shiro:principal><br>
<span>欢迎:</span>
<shiro:principal property="username"></shiro:principal>
<a th:href="@{/logout.action}">退出登录</a>

<shiro:hasPermission name="user:list">
<a th:href="@{/user/userPage.action}">用户管理</a><br>
</shiro:hasPermission>

<shiro:hasPermission name="student:list">
<a th:href="@{/student/studentPage.action}">学生管理</a><br>
</shiro:hasPermission>

<shiro:hasPermission name="teacher:list">
<a th:href="@{/teacher/teacherPage.action}">教师管理</a><br>
</shiro:hasPermission>

</body>
</html>

1.5.5 Shiro 缓存

1.5.5.1 添加依赖

 <!--shiro对ehcache的基础-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>1.5.0</version>
        </dependency>
        <!--引入ehcache给shiro使用-->
        <dependency>
            <groupId>net.sf.ehcache</groupId>
            <artifactId>ehcache-core</artifactId>
            <version>2.6.0</version>
        </dependency>

1.5.5.2 在安全管理器中设置缓存管理器

    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 设置缓存管理器
        securityManager.setCacheManager(cacheManager());

        // 添加自定义 realm 到 安全管理器中
        securityManager.setRealm(customRealm());
        return securityManager;
    }

    @Bean
    public CacheManager cacheManager(){
        EhCacheManager ehCacheManager = new EhCacheManager();
        return ehCacheManager;
    }

1.5.6 设置session 管理器

@Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setSessionManager(sessionManager());

        // 设置缓存管理器
        securityManager.setCacheManager(cacheManager());

        // 添加自定义 realm 到 安全管理器中
        securityManager.setRealm(customRealm());
        return securityManager;
    }

    @Bean
    public SessionManager sessionManager() {
        DefaultWebSessionManager defaultWebSessionManager = new DefaultWebSessionManager();
        defaultWebSessionManager.setGlobalSessionTimeout(2000*10);
        return defaultWebSessionManager;
    }

1.6 (RememberMe)账号保存到 cookie

1.6.1 配置会话管理器

@Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

        // 配置记住我管理器
        securityManager.setRememberMeManager(rememberMeManager());

        // 配置会话管理器
        securityManager.setSessionManager(sessionManager());

        // 设置缓存管理器
        securityManager.setCacheManager(cacheManager());

        // 添加自定义 realm 到 安全管理器中
        securityManager.setRealm(customRealm());
        return securityManager;
    }

    /**
     * 记住我管理器
     * @return
     */
    @Bean
    public RememberMeManager rememberMeManager() {
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        cookieRememberMeManager.setCookie(cookie());
        return cookieRememberMeManager;
    }

    /**
     * 存储cookie
     * @return
     */
    @Bean
    public Cookie cookie(){
        Cookie cookie = new SimpleCookie("rememberMe");
        cookie.setMaxAge(3600 * 24 * 7);
        cookie.setHttpOnly(true);
        return cookie;
    }

1.6.2 登录用户实体类实现 Serializable 接口

package com.cl.pojo;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;

import java.io.Serializable;

/**
 * @Author chenlan
 * @Date 2020/12/8 17:34
 * @Description TODO
 

@Data
@AllArgsConstructor
@NoArgsConstructor
public class User implements Serializable {

    private String username;
    private String password;
    private String salt;
}

1.6.3 登录页面设置记住我 checkbox

记住我：<input type="checkbox" name="rememberMe">

1.6.4 在ShiroFilterFactoryBean 中配置 UserFilter 过滤器

// user userFilter org.apache.shiro.web.filter.authc.UserFilter
filterChainDefinitionMap.put("/index.action", "user");

1.6.5 重写表单过滤器中的 isAccessAllowed 方法

选择了记住我之后,用户在没有进行认证时,只能访问 UserFilter 中配置的请求,不能访问其他页面,要重写表单过滤器中的 isAccessAllowed 方法

@Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        // 从请求中获取 shiro 主体
        Subject subject = getSubject(request, response);
        // 在主体中获取 session
        Session session = subject.getSession();
        // 登录主体没有进行认证和设置了记住我
        if (!subject.isAuthenticated() && subject.isRemembered()) {
            User principal = (User) subject.getPrincipal();
            session.setAttribute("USER_SESSION", principal);
        }
        return subject.isAuthenticated() || subject.isRemembered();
    }
r.authc.UserFilter
filterChainDefinitionMap.put("/index.action", "user");

1.6.5 重写表单过滤器中的 isAccessAllowed 方法

选择了记住我之后,用户在没有进行认证时,只能访问 UserFilter 中配置的请求,不能访问其他页面,要重写表单过滤器中的 isAccessAllowed 方法

@Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        // 从请求中获取 shiro 主体
        Subject subject = getSubject(request, response);
        // 在主体中获取 session
        Session session = subject.getSession();
        // 登录主体没有进行认证和设置了记住我
        if (!subject.isAuthenticated() && subject.isRemembered()) {
            User principal = (User) subject.getPrincipal();
            session.setAttribute("USER_SESSION", principal);
        }
        return subject.isAuthenticated() || subject.isRemembered();
    }