解決springboot+shiro 權(quán)限攔截失效的問題
最近因為項目需要,接觸了shiro。新手入門
發(fā)現(xiàn)權(quán)限攔截失效,
一直以為是以為授權(quán)和DB的問題
研究了一個下午,終于發(fā)現(xiàn)了問題所在
我的訪問路徑?jīng)]有寫前面的斜杠?。?/strong>,而DB中的資源路徑是可以省略的,崩潰了吧
但是問題來了,為什么在其他地方可以忽略掉前面的小斜杠呢?
經(jīng)過幾分鐘的搗鼓發(fā)現(xiàn),在springboot中,不論是thymeleaf的模板也好(我用的thymeleaf),還是后端代碼也好,底層會自動補全這個斜杠
問題解決?。?/p>
補充知識:SpringBoot整合shiro的一個完整的小案例
SpringBoot整合配置版的shiro很簡單,邏輯清
首先在pom.xml的配置如下,shiro使用緩存ehcache
<dependency> <groupId>net.sf.ehcache</groupId> <artifactId>ehcache</artifactId> <version>2.10.4</version> </dependency> <!-- shiro spring. --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>1.2.2</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.2.2</version> </dependency> <!-- shiro ehcache --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>1.2.2</version> </dependency>
接著配置shiro
@Configuration public class ShiroConfig { @Bean public ShiroFilterFactoryBean shirFilter(DefaultWebSecurityManager securityManager) { ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean(); // 必須設(shè)置 SecurityManager shiroFilter.setSecurityManager(securityManager); // 攔截器 Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); // 設(shè)置login URL shiroFilter.setLoginUrl("/login"); // 登錄成功后要跳轉(zhuǎn)的鏈接 shiroFilter.setSuccessUrl("/main"); filterChainDefinitionMap.put("/webjars/**", "anon"); filterChainDefinitionMap.put("/druid/**", "anon"); //靜態(tài)資源的處理 filterChainDefinitionMap.put("/js/**", "anon"); filterChainDefinitionMap.put("/css/**", "anon"); filterChainDefinitionMap.put("/asserts/**", "anon"); filterChainDefinitionMap.put("/fonts/**", "anon"); filterChainDefinitionMap.put("/images/**", "anon"); // 退出系統(tǒng)的過濾器 filterChainDefinitionMap.put("/logout", "logout"); filterChainDefinitionMap.put("/login", "anon"); filterChainDefinitionMap.put("/kaptcha", "anon"); filterChainDefinitionMap.put("/**", "authc"); shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap); return shiroFilter; } @Bean public HashedCredentialsMatcher hashedCredentialsMatcher() { HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher(); hashedCredentialsMatcher.setHashAlgorithmName("MD5"); hashedCredentialsMatcher.setHashIterations(1024); return hashedCredentialsMatcher; } @Bean public ShiroRealm shiroRealm(HashedCredentialsMatcher hashedCredentialsMatcher) { ShiroRealm shiroRealm = new ShiroRealm(); shiroRealm.setCredentialsMatcher(hashedCredentialsMatcher); return shiroRealm; } //shiro使用緩存ehcachae @Bean public EhCacheManager ehCacheManager() { EhCacheManager ehCacheManager = new EhCacheManager(); ehCacheManager.setCacheManagerConfigFile("classpath:ehcache.xml"); return ehCacheManager; } @Bean("sessionManager") public SessionManager sessionManager(){ DefaultWebSessionManager sessionManager = new DefaultWebSessionManager(); sessionManager.setSessionValidationSchedulerEnabled(true); sessionManager.setSessionIdCookieEnabled(true); return sessionManager; } @Bean("securityManager") public DefaultWebSecurityManager securityManager(ShiroRealm shiroRealm, SessionManager sessionManager) { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); securityManager.setRealm(shiroRealm); securityManager.setSessionManager(sessionManager); return securityManager; } @Bean("lifecycleBeanPostProcessor") public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } @Bean public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() { DefaultAdvisorAutoProxyCreator proxyCreator = new DefaultAdvisorAutoProxyCreator(); proxyCreator.setProxyTargetClass(true); return proxyCreator; } @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor(); advisor.setSecurityManager(securityManager); return advisor; } }
在配置中提到的realm如下配置
public class ShiroRealm extends AuthorizingRealm { @Autowired private UserService userService; @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { UsernamePasswordToken upToken = (UsernamePasswordToken) token; // 取出表單用戶名 String username = upToken.getUsername(); // 查詢是否有該用戶 if (userService.getByName(username) == null) { throw new UnknownAccountException("用戶不存在!"); } // 靠用戶名從數(shù)據(jù)庫查詢該用戶的全部信息 User user = userService.getByName(username); // 傳入:用戶名,加密后的密碼,鹽值,該realm的名字,加密算法和加密次數(shù)在已經(jīng)在配置文件中指定 SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(username, user.getPassword(), ByteSource.Util.bytes(username), getName()); return info; } @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { // 1. 從 PrincipalCollection 中來獲取登錄用戶的信息 Object principal = principals.getPrimaryPrincipal(); // 2. 利用登錄的用戶的信息來..當前用戶的角色或權(quán)限(可能需要查詢數(shù)據(jù)庫) Set<String> roles = new HashSet<String>(); roles.add("user"); if ("admin".equals(principal)) { roles.add("admin"); } // 3. 創(chuàng)建 SimpleAuthorizationInfo, 并設(shè)置其 reles 屬性 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roles); // 4. 返回 SimpleAuthorizationInfo 對象. return info; } }
由于我做的平臺只有一個管理員就不寫注冊了,這時手動算出一個admin用戶的密碼
public static void main(String[] args) { Object result = new SimpleHash("MD5","123456",ByteSource.Util.bytes("admin"),1024); System.out.println(result); }
最后寫登錄的Controller
@Controller public class LoginController { // 處理登錄邏輯 @PostMapping("/login") public String login(String username, String password, String kaptcha, HttpSession session, Map<String, Object> map) { Subject currentUser = SecurityUtils.getSubject(); if (!currentUser.isAuthenticated()) { // 把用戶名和密碼封裝為 UsernamePasswordToken 對象 UsernamePasswordToken token = new UsernamePasswordToken(username, password); // 設(shè)置為rememberme token.setRememberMe(true); try { // 執(zhí)行登錄. currentUser.login(token); } // 所有認證時異常的父類 catch (AuthenticationException ae) { map.put("password", "輸入的用戶名或密碼錯誤"); log.info("登錄失敗: " + ae.getMessage()); return "login"; } } if (!session.getAttribute("code").equals(kaptcha)) { map.put("kaptcha", "輸入的驗證碼錯誤"); return "login"; } session.setAttribute("loginUser", "user"); return "main"; } }
以上這篇解決springboot+shiro 權(quán)限攔截失效的問題就是小編分享給大家的全部內(nèi)容了,希望能給大家一個參考,也希望大家多多支持腳本之家。
- SpringBoot+Shiro+Redis+Mybatis-plus 實戰(zhàn)項目及問題小結(jié)
- Springboot和bootstrap實現(xiàn)shiro權(quán)限控制配置過程
- SpringBoot + Shiro前后端分離權(quán)限
- SpringBoot 整合 Shiro 密碼登錄與郵件驗證碼登錄功能(多 Realm 認證)
- Springboot shiro認證授權(quán)實現(xiàn)原理及實例
- 基于springboot實現(xiàn)整合shiro實現(xiàn)登錄認證以及授權(quán)過程解析
- SpringBoot整合Shiro實現(xiàn)登錄認證的方法
- Springboot+Shiro+Mybatis+mysql實現(xiàn)權(quán)限安全認證的示例代碼
相關(guān)文章
springmvc處理響應(yīng)數(shù)據(jù)的解析
今天小編就為大家分享一篇關(guān)于springmvc處理響應(yīng)數(shù)據(jù)的解析,小編覺得內(nèi)容挺不錯的,現(xiàn)在分享給大家,具有很好的參考價值,需要的朋友一起跟隨小編來看看吧2019-01-01關(guān)于注解FeignClient的使用規(guī)范
這篇文章主要介紹了關(guān)于注解FeignClient的使用規(guī)范,具有很好的參考價值,希望對大家有所幫助。如有錯誤或未考慮完全的地方,望不吝賜教2022-03-03