Base class for all Filters that require the current user to be authenticated. This class encapsulates the logic of checking whether a user is already authenticated in the system while subclasses are required to perform specific logic for unauthenticated requests.
需要对当前用户进行身份验证的所有筛选器的基类。这个类封装了检查用户是否已经在系统中通过身份验证的逻辑,而需要子类对未通过身份验证的请求执行特定的逻辑。
isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue)
Determines whether the current subject is authenticated. The default implementation {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) acquires} the currently executing Subject and then returns {@link org.apache.shiro.subject.Subject#isAuthenticated() subject.isAuthenticated()};
确定当前主题是否经过身份验证。默认实现@link #getSubject(javax.servlet。ServletRequest, javax.servlet.ServletResponse)获取当前执行的Subject,然后返回{@link org.apache.shiro.subject.Subject#isAuthenticated() Subject .isAuthenticated()};
如果当前subject已经认证,就返回true,否则返回false
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
Subject subject = getSubject(request, response);
return subject.isAuthenticated() && subject.getPrincipal() != null;
}
issueSuccessRedirect(ServletRequest request, ServletResponse response) throws Exception
Redirects to user to the previously attempted URL after a successful login. This implementation simply calls{@link org.apache.shiro.web.util.WebUtils WebUtils}.{@link WebUtils#redirectToSavedRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse, String) redirectToSavedRequest}using the {@link #getSuccessUrl() successUrl} as the {@code fallbackUrl} argument to that call.
成功登录后,重定向到用户之前尝试的URL。这个实现简单地调用{@link org.apache.shiro.web.util.WebUtils WebUtils}。{@link WebUtils # redirectToSavedRequest (javax.servlet。ServletRequest javax.servlet。redirectToSavedRequest}使用{@link #getSuccessUrl() successUrl}作为该调用的{@code fallbackUrl}参数。
protected void issueSuccessRedirect(ServletRequest request, ServletResponse response) throws Exception {
WebUtils.redirectToSavedRequest(request, response, getSuccessUrl());
}
总结:
这个类封装了检查用户是否已经在系统中通过身份验证的逻辑,而需要子类对未通过身份验证的请求执行特定的逻辑。