实现前后端session共享

最新推荐文章于 2024-04-28 18:38:58 发布

南下望极光

最新推荐文章于 2024-04-28 18:38:58 发布

阅读量708

点赞数 1

文章标签： java 开发语言

本文链接：https://blog.csdn.net/weixin_54065960/article/details/131659144

版权

2.4、重写DefaultWebSessionManager的方法

2.5、修改shiro配置类

2.6、修改shiroFilter过滤器

1、如何实现session共享

session默认存储再各自服务的内存中，我们可以采用让session统一存储再redis中来解决不共享问题。

疯狂的蛋糕的依赖。---提供了redis存储session的类。

1.1、修改shiro的配置类

@Bean
    public DefaultWebSecurityManager securityManager(){
        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        securityManager.setRealm(myRealm());
        //设置缓存管理器
        securityManager.setCacheManager(redisCacheManager());
        //session管理
        securityManager.setSessionManager(sessionManager());
        return securityManager;
    }
    
    @Bean
    public SessionManager sessionManager(){
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        sessionManager.setSessionDAO(sessionDAO());//sessionDao用于操作session对象，在容器中对对象session进行CRUD操作
        return sessionManager;
    }

    @Bean
    public SessionDAO sessionDAO(){
        //该类会对对象session进行CRUD操作
        RedisSessionDAO sessionDAO = new RedisSessionDAO();
        sessionDAO.setRedisManager(redisManager());
        return sessionDAO;
    }

    //redis缓存管理器
    @Bean
    public RedisCacheManager redisCacheManager(){
        RedisCacheManager redisCacheManager = new RedisCacheManager();
        redisCacheManager.setRedisManager(redisManager());
        //redisCacheManager.setPrincipalIdFieldName("userId");
        return redisCacheManager;
    }

    //redis管理器
    @Bean
    public RedisManager redisManager(){
        RedisManager redisManager = new RedisManager();
        redisManager.setHost("192.168.232.166"+":6379");
        redisManager.setDatabase(1);
        return redisManager;
    }

    @Bean
    public MyRealm myRealm(){
        MyRealm myRealm=new MyRealm();
        //设置密码加密器
        myRealm.setCredentialsMatcher(credentialsMatcher());
        return myRealm;
    }

   @Bean
    public HashedCredentialsMatcher credentialsMatcher(){
        HashedCredentialsMatcher credentialsMatcher=new HashedCredentialsMatcher();
        credentialsMatcher.setHashAlgorithmName("MD5");
        credentialsMatcher.setHashIterations(5);
        return credentialsMatcher;
    }

2、解决前端不支持cookie的效果

原因: 默认DefaultWebSessionManager它只接受Cookie中存储的JsessionId. 查询发现再redis中不存在对应的key.

客户发送请求时，再请求头中携带sessionId, 然后重写DefaultWebSessionManager中getSessionId()的方法。

解决：

1. 把sessionId放入请求头。

2. 重写getSessionId方法获取请求头中的sessionID

2.1、修改登录的接口

package com.lx.controller;

import com.lx.vo.LoginVo;
import com.lx.vo.Result;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.*;

/**
 * @program: springboot-shiro
 * @description:前后端分离
 * @author: 
 * @create: 2023-07-10 16:51
 **/
@Controller
/*@CrossOrigin
 origins:允许哪些跨域访问该接口 allowedHeaders：允许携带哪些头信息的请求访问 methods：允许哪些请求方式跨域请求接口*/
public class LoginPlusController {

    @PostMapping("/loginPlus")
    @ResponseBody
    public Result login(@RequestBody LoginVo loginVo) {
        System.out.println(loginVo);
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(loginVo.getUsername(), loginVo.getPassword());
        try {
            subject.login(token);
            return new Result(200,"登录成功",subject.getSession().getId());//携带当前会话的id
        } catch (Exception e) {
            e.printStackTrace();
            return new Result(500,"账号或密码错误",null);
        }
    }
}

2.2、修改前端登录办法

 methods:{
    submitForm(){
      console.log(this.form)
      this.$http.post("http://localhost:8080/loginPlus",this.loginForm).then(result=>{
        if (result.data.code==200){
          this.$message.success("登录成功")
          sessionStorage.setItem("token",result.data.data())//存在sessionStorage中，浏览器关闭token就销毁了
          this.$router.push("/product")//路由跳转
        }else {
          this.$message.error("账号或密码错误")
        }
        console.log(result)
      })
    }

2.3、修改前端main.js文件

//设置axios的请求拦截器
axios.interceptors.request.use(config=>{
  //从sessionStorage中获取token值
  var item = sessionStorage.getItem("token");
  if (item){
    config.headers.token=item;
  }
  return config;
})

2.4、重写DefaultWebSessionManager的方法

package com.lx.realm;


import com.baomidou.mybatisplus.core.toolkit.StringUtils;
import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.util.WebUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.Serializable;

/**
 * @program: springboot-shiro
 * @description:
 * @author: 
 * @create: 2023-07-11 15:08
 **/
public class MyWebSessionManager extends DefaultWebSessionManager {
    private static final String AUTHORIZATION = "token";
    private static final String REFERENCED_SESSION_ID_SOURCE = "Stateless request";
    protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
        //获取请求头中名称为token的内容
        String id = WebUtils.toHttp(request).getHeader("token");
        if (!StringUtils.isEmpty(id)) { //如果存在该token
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "Stateless request");
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
            return id;
        } else {
            //从cookie中获取sessionId.
            return super.getSessionId(request, response);
        }
    }
}

2.5、修改shiro配置类

@Bean
    public SessionManager sessionManager(){
        //DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        MyWebSessionManager sessionManager = new MyWebSessionManager();//修改为我们自己定义的SessionManager类
        sessionManager.setSessionDAO(sessionDAO());//sessionDao用于操作session对象，在容器中对对象session进行CRUD操作
        return sessionManager;
    }

2.6、修改shiroFilter过滤器

我们发现跨域请求，会发送两个请求：第一个OPTIONS请求，第二个请求是真实的请求。

OPTIONS请求：先头部队。

所以我们对OPTIONS请求都要放行

package com.lx.filter;

import com.alibaba.fastjson.JSON;
import com.lx.vo.Result;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.io.PrintWriter;

/**
 * @program: springboot-shiro
 * @description:
 * @author: 
 * @create: 2023-07-11 16:48
 **/
public class LoginFilter extends FormAuthenticationFilter {
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        response.setContentType("appliation/json;charset=utf-8");
        PrintWriter writer = response.getWriter();
        Result result = new Result(401, "未登录", null);
        String jsonString = JSON.toJSONString(result);
        writer.print(jsonString);
        writer.flush();
        writer.close();
        return false;
    }


    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        HttpServletRequest request1 = (HttpServletRequest) request;
        //获取请求方式
        String method = request1.getMethod();
        if ("OPTIONS".equals(method)){
            return true;
        }
        return super.isAccessAllowed(request, response, mappedValue);
    }
}