java清除shiro里的token_shiro token 分析

1.ShiroConfig.java 定义匿名用户可以访问的资源

filterMap.put("/webjars/**", "anon");

filterMap.put("/druid/**", "anon");

filterMap.put("/api/**", "anon");

filterMap.put("/sys/login", "anon");

filterMap.put("/**/*.css", "anon");

filterMap.put("/**/*.js", "anon");

filterMap.put("/**/*.html", "anon");

filterMap.put("/fonts/**", "anon");

filterMap.put("/plugins/**", "anon");

filterMap.put("/swagger/**", "anon");

filterMap.put("/favicon.ico", "anon");

filterMap.put("/", "anon");

filterMap.put("/**", "oauth2");           --除了anon，拦截其他所有请求

2.OAuth2Filter.java 基于shiro的全局过滤器

继承AuthenticatingFilter 实现createToken、isAccessAllowed、onAccessDenied、onLoginFailure等抽象方法

import com.google.gson.Gson;

import io.renren.common.utils.R;

import org.apache.commons.lang.StringUtils;

import org.apache.http.HttpStatus;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.web.filter.authc.AuthenticatingFilter;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

public class OAuth2Filter extends AuthenticatingFilter {

@Override

protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception {

//获取请求token

String token = getRequestToken((HttpServletRequest) request);

if(StringUtils.isBlank(token)){

return null;

}

return new OAuth2Token(token);

}

@Override

protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {

return false;

}

@Override

protected boolean onAccessDenied(ServletRequest request, ServletResponse r