Shiro学习——(五)利用servlet+shiro进行web用户授权案例

最新推荐文章于 2022-06-23 09:20:39 发布

六六和May宝

最新推荐文章于 2022-06-23 09:20:39 发布

阅读量899

点赞数 1

分类专栏： Shiro

本文链接：https://blog.csdn.net/weixin_43683536/article/details/90211676

版权

Shiro 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

使用IDEA开发工具进行开发

创建一个Maven 的Webapp工程

导入依赖

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.source>1.7</maven.compiler.source>
    <maven.compiler.target>1.7</maven.compiler.target>
  </properties>

  <dependencies>
 <!--shiro核心类库-->
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-core</artifactId>
      <version>1.4.0</version>
    </dependency>

    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-log4j12</artifactId>
      <version>1.7.25</version>
    </dependency>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>1.7.25</version>
    </dependency>
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <version>5.1.43</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>5.1.6.RELEASE</version>
    </dependency>

    <!--shiro  web-->
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-web</artifactId>
      <version>1.4.0</version>
    </dependency>
    <!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
      <scope>provided</scope>
    </dependency>
  </dependencies>

  <build>
    <finalName>shiro-servlet</finalName>
    <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
      <plugins>
        <plugin>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.1.0</version>
        </plugin>
        <!-- see http://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_war_packaging -->
        <plugin>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.0.2</version>
        </plugin>
        <plugin>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.8.0</version>
        </plugin>
        <plugin>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>2.22.1</version>
        </plugin>
        <plugin>
          <artifactId>maven-war-plugin</artifactId>
          <version>3.2.2</version>
        </plugin>
        <plugin>
          <artifactId>maven-install-plugin</artifactId>
          <version>2.5.2</version>
        </plugin>
        <plugin>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>2.8.2</version>
        </plugin>
      </plugins>
    </pluginManagement>

    <resources>
      <resource>
        <directory>src/main/resources</directory>
        <includes>
          <include>log4j.properties</include>
          <include>**/*.ini</include>
        </includes>
        <filtering>true</filtering>
      </resource>
      <!--<resource>
          <directory>src/main/resources</directory>
          <includes>
              <include>**/*.xml</include>
              <include>**/*.properties</include>
          </includes>
      </resource>-->
    </resources>
  </build>
</project>

编写配置文件

resources文件目录下

1、log4j.properties

log4j.rootLogger=WARN, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m%n

如果不加就会报以下异常

log4j:WARN No appenders could be found for logger (org.apache.shiro.web.env.EnvironmentLoader).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.

2、shiro.ini数据源文件

[users]
root = secret,admin
guest = guest, guest
test = 123456, guest,test

[roles]
#*代表全部权限
admin = *
guest = user:list
#表示拥有menu里面的两个权限
test = menu:list,menu:add

[urls]
#anon无需验证    authc必须进行index.html才能进行访问
/login.html = anon
/index.html = authc
#代表只有admin用户才能看的到，且需要验证
/role.html = authc,roles[admin]
#代表拥有admin用户和menu权限的才能看的到
/menu/** = authc,roles[admin],perms[menu:*]

编写web.xml文件

将web.xml文件放在**webapp/WEB-INF/**路径下，由于IDEA自带的web.xml文件的版本太低，所以我们可以自己设置一个web.xml高版本的文件。

   <!--web.xml 4.0版本-->
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="4.0"
         xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
          http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd">
 
</web-app>

<!--web.xml配置-->
<display-name>Archetype Created Web Application</display-name>

<!--数据来源-->
<context-param>
  <param-name>shiroEnvironmentClass</param-name>
  <param-value>org.apache.shiro.web.env.IniWebEnvironment</param-value>
</context-param>

<!--配置文件路径-->
<context-param>
  <param-name>shiroConfigLocations</param-name>
  <param-value>classpath:shiro-web.ini</param-value>
</context-param>

<listener>
  <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>

<!--引入过滤器-->
<filter>
  <filter-name>ShiroFilter</filter-name>
  <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>ShiroFilter</filter-name>
  <url-pattern>*.html</url-pattern>
</filter-mapping>

编写Servlet

1、LoginServlet

package com.day511.demoshiro.javaweb;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebServlet(name = "loginServlet",urlPatterns = "/login.html")
public class LoginServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        this.doPost(req,resp);
    }
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        //拿到用户名 密码
        String username = req.getParameter("username");
        String password = req.getParameter("password");
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(username,password);
        try {
            //成功跳转到首页
            subject.login(token);
            resp.sendRedirect("/index.html");
        } catch (AuthenticationException e) {
            e.printStackTrace();
            //提示信息
            req.setAttribute("error","用户名或密码错误");
            //失败依然返回当前的登录页
            req.getRequestDispatcher("/login.jsp").forward(req,resp);
        }
    }
}

2、IndexServlet

package com.day511.demoshiro.javaweb;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebServlet(name = "indexServlet",urlPatterns = "/index.html")
public class IndexServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        this.doPost(req,resp);
    }
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //直接实现页面跳转
        req.getRequestDispatcher("/index.jsp").forward(req,resp);
    }
}

3、RoleServlet

package com.day511.demoshiro.javaweb;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebServlet(name = "roleServlet",urlPatterns = "/role.html")
public class RoleServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        this.doPost(req,resp);
    }
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //直接实现页面跳转
        req.getRequestDispatcher("/role.jsp").forward(req,resp);
    }
}

4、LogoutServlet 退出登录

package com.day511.demoshiro.javaweb;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebServlet(name = "logoutServlet",urlPatterns = "/logout.html")
public class LogoutServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        this.doPost(req,resp);
    }
    
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        //退出跳转到首页
        req.getRequestDispatcher("/login.jsp").forward(req,resp);

    }
}

jsp页面

1、index.jsp

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags"%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
Hello World
<a href="/logout.html">退出登录</a>
<%--根据权限来判定   如果有menu:add权限，才能看的到menu--%>
<shiro:hasPermission name="menu:add">
    <a href="#">menu</a>###
</shiro:hasPermission>

<%--根据角色来判定   如果有admin这个角色，才可以看的到role--%>
<shiro:hasRole name="admin">
    <a href="#">role</a>
</shiro:hasRole>
</body>
</html>

2、login.jsp

 taglib prefix="shiro" uri="http://shiro.apache.org/tags"%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>登录界面</title>
</head>
<body>

<form action="/login.html" method="post">
    用户名：<input type="text" name="username" /><br/>
    密码: <input type="text" name="password" /> <br/>
    <input type="submit" value="登录" />${error}
</form>
</body>
</html>

3、role.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
role.jsp
</body>
</html>

上一篇：Shiro学习——(四)Shiro+mysql进行验证

六六和May宝

关注

1
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
Shiro学习——(五)利用servlet+shiro进行web用户授权案例

使用IDEA开发工具进行开发创建一个Maven 的Webapp工程导入依赖 <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <maven.compiler.source>1.7</maven.compiler....
复制链接

扫一扫