防止 shiro 认证失败后跳转页面，自定义shiro授权过滤器

一、注册自定义授权过滤器一、创建自定义授权过滤器

一、注册自定义授权过滤器

import org.apache.shiro.spring.LifecycleBeanPostProcessor; import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor; import org.apache.shiro.spring.web.ShiroFilterFactoryBean; import org.apache.shiro.web.mgt.DefaultWebSecurityManager; import org.apache.shiro.web.servlet.Cookie; import org.apache.shiro.web.session.mgt.DefaultWebSessionManager; import org.crazycake.shiro.RedisCacheManager; import org.crazycake.shiro.RedisManager; import org.crazycake.shiro.RedisSessionDAO; import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.DependsOn; import quantity.knowledgebase.realm.CustomSessionManager; import quantity.knowledgebase.realm.MyFormAuthenticationFilter; import quantity.knowledgebase.realm.MyRealm; import javax.servlet.Filter; import java.util.LinkedHashMap; import java.util.concurrent.ConcurrentHashMap; /** * shiro配置类 */ @Configuration public class ShiroFilterConf { /** * ShrioFilterFactoryBean 过滤bena * * @param defaultWebSecurityManager * @return */ @Bean public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager) { ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean(); /*********************************主要内容***************************/ /***************************注册自定义授权过滤器**********************/ // 1、创建过滤器Map，用来装自定义过滤器 LinkedHashMap<String, Filter> linkedHashMap = new LinkedHashMap<>(); // 2、将自定义过滤器放入map中，如果实现了自定义授权过滤器，那就必须在这里注册，否则Shiro不会使用自定义的授权过滤器 linkedHashMap.put("authc", new MyFormAuthenticationFilter()); // 3、将过滤器Ma绑定到shiroFilterFactoryBean上 bean.setFilters(linkedHashMap); /**********************************************************************/ //设置安全管理器 bean.setSecurityManager(defaultWebSecurityManager); /* 添加shiro的内置过滤器 anon 无需认证就可以访问 authc 必须认证才能访问 user 必须拥有记住我功能 才能用 perms 拥有对某个用户资源才能访问 role 拥有某个角色权限才能访问 */ ConcurrentHashMap<String, String> map = new ConcurrentHashMap<>(); //FormAuthenticationFilter authc 认证过滤器 //AnonymousFilter anon 匿名过滤器 map.put("/personnel_gm/**", "authc"); map.put("/product/**", "authc"); map.put("/statistics_offer/**", "authc"); //定义一个过滤器链 bean.setFilterChainDefinitionMap(map); //其他资源都需要认证 authc 表示需要认证才能进行访问 user表示配置记住我或认证通过可以访问的地址 return bean; } /** * 安全对象 FafaulWebSecurityManager * * @param userRealm * @return */ @Bean(name = "securityManager") public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") MyRealm userRealm) { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); //关联UserRealm securityManager.setRealm(userRealm); securityManager.setSessionManager(sessionManager()); // 安全管理器中 设置 sessionManager securityManager.setCacheManager(cacheManager()); return securityManager; } /** * 创建 Realm对象 ，需要自定义Realm * * @return */ @Bean public MyRealm userRealm() { MyRealm userRealm = new MyRealm(); return userRealm; } /** * 会话管理器 * * @return */ @Bean public DefaultWebSessionManager sessionManager() { CustomSessionManager sessionManager = new CustomSessionManager(); sessionManager.setSessionDAO(redisSessionDAO()); Cookie sessionIdCookie = sessionManager.getSessionIdCookie(); sessionIdCookie.setPath("/"); sessionManager.setSessionIdCookie(sessionIdCookie); return sessionManager; } /** * 配置redisManager * * @return */ public RedisManager getRedisManager() { RedisManager redisManager = new RedisManager(); redisManager.setHost("192.168.0.1:6379"); redisManager.setPassword("123456"); return redisManager; } /** * 配置具体cache实现类 * * @return */ public RedisCacheManager cacheManager() { RedisCacheManager redisCacheManager = new RedisCacheManager(); redisCacheManager.setRedisManager(getRedisManager()); //设置redis过期时间，单位是秒 redisCacheManager.setExpire(60*60*24*360*5); redisCacheManager.setKeyPrefix("ihrm:shiro:cache:"); //设置权限信息缓存的名称前缀 return redisCacheManager; } /** * 自定义session持久化 * * @return */ public RedisSessionDAO redisSessionDAO() { RedisSessionDAO redisSessionDAO = new RedisSessionDAO(); redisSessionDAO.setRedisManager(getRedisManager()); redisSessionDAO.setExpire(60*60*24*360*5); redisSessionDAO.setKeyPrefix("ihrm:shiro:session:"); //设置session缓存的名称前缀 return redisSessionDAO; } /** * 管理shiro一些bean的生命周期 即bean初始化 与销毁 * * @return */ @Bean public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } /** * 加入注解的使用，不加入这个AOP注解不生效(shiro的注解 例如 @RequiresGuest , 但是 一般使用配置文件的方式) * * @return */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager) { AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor(); authorizationAttributeSourceAdvisor.setSecurityManager(defaultWebSecurityManager); return authorizationAttributeSourceAdvisor; } /** * 用来扫描上下文寻找所有的Advistor(通知器), 将符合条件的Advisor应用到切入点的Bean中，需 * 要在LifecycleBeanPostProcessor创建后才可以创建 * * @return */ @Bean @DependsOn("lifecycleBeanPostProcessor") public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() { DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator(); defaultAdvisorAutoProxyCreator.setUsePrefix(true); return defaultAdvisorAutoProxyCreator; } }

一、创建自定义授权过滤器

import org.apache.shiro.web.filter.authc.FormAuthenticationFilter; import org.json.JSONObject; import quantity.knowledgebase.util.HttpGetIpUtil; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.Cookie; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.PrintWriter; public class MyFormAuthenticationFilter extends FormAuthenticationFilter { @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { System.out.println("验证失败"); HttpServletResponse httpServletResponse = (HttpServletResponse) response; httpServletResponse.setStatus(200); httpServletResponse.setContentType("application/json;charset=utf-8"); PrintWriter out = httpServletResponse.getWriter(); JSONObject json = new JSONObject(); json.put("code", -1); json.put("msg", "登录已失效，请重新登录！"); out.println(json); out.flush(); out.close(); return false; } }