shiro异步请求返回JSON响应

Posted 2020-11-21 mozq

shiro异步请求返回JSON响应

需求1：当shiro请求资源，但是没有进行认证时，默认是进行重定向，现在需要返回JSON响应。注意异步请求，服务器重定向后，ajax拿到的是浏览器重定向后的到的页面源码。
解决2: 自定义FormAuthenticationFilter。覆盖onAccessDenied方法。返回JSON字符串。并将自定义的过滤器添加到ShiroFilterFactoryBean，键的名称为authc。

需求2：ShiroFilterFactoryBean用注解时，过滤的urls被写死在代码中，需要将urls的配置放到配置文件中。
解决2：
    方法1:ShiroFilterFactoryBean不使用注解方法，而是xml配置注入。@ImportResource("classpath:shiro/shiro-config.xml")
    方法2:自己通过shiro的Ini类加载ini配置文件。读取自定义的urls。

步骤

自定义 authc 对应过滤器 FormAuthenticationFilter。覆盖 onAccessDenied 方法返回JSON响应。

将自定义过滤器添加到 ShiroFilterFactoryBean。名称为 authc 。

ResultFormAuthenticationFilter

package com.mozq.shiro.shiro01.config;

import com.alibaba.fastjson.JSONObject;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;

@Slf4j
public class ResultFormAuthenticationFilter extends FormAuthenticationFilter {

    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        if (isLoginRequest(request, response)) {
            if (isLoginSubmission(request, response)) {
                if (log.isTraceEnabled()) {
                    log.trace("Login submission detected.  Attempting to execute login.");
                }
                return executeLogin(request, response);
            } else {
                if (log.isTraceEnabled()) {
                    log.trace("Login page view.");
                }
                //allow them to see the login page ;)
                return true;
            }
        } else {
            if (log.isTraceEnabled()) {
                log.trace("Attempting to access a path which requires authentication.  Forwarding to the " +
                          "Authentication url [" + getLoginUrl() + "]");
            }
            if(isAjaxRequest(request)){
                saveRequest(request);
                writeResult(response);
                return false;
            }
            //saveRequestAndRedirectToLogin(request, response);
            return false;
        }
    }

    private boolean isAjaxRequest(ServletRequest request){
        return request instanceof  HttpServletRequest && "XMLHttpRequest".equalsIgnoreCase(((HttpServletRequest)request).getHeader("X-Requested-With"));
    }

    private void writeResult(ServletResponse servletResponse){
        if(servletResponse instanceof HttpServletResponse){
            HttpServletResponse response = (HttpServletResponse) servletResponse;
            HashMap<String, String> result = new HashMap<>();
            result.put("code", "401");
            result.put("message","未登录");
            try {
                response.setHeader("Content-Type", "application/json;charset=UTF-8");
                response.getWriter().write(JSONObject.toJSONString(result));
                response.getWriter().flush();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }
}

package com.yuantiao.smartcardms.config.shiro;

import org.apache.shiro.realm.Realm;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.apache.shiro.mgt.SecurityManager;

import java.util.HashMap;
import java.util.Map;

/**
 * @description:
 * @author: [e-mail]
 * @date: 2019/11/1 14:14
 */
@Configuration
public class ShiroConfig {

    //自定义 org.apache.shiro.realm.Realm
    @Bean
    public Realm realm(){
        //IniRealm iniRealm = new IniRealm("classpath:user.ini");
        SysUserRealm realm = new SysUserRealm();
        return realm;
    }

    //定义 org.apache.shiro.mgt.SecurityManager
    @Bean
    public SecurityManager securityManager(Realm realm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(realm);
        return securityManager;
    }

    //定义 org.apache.shiro.spring.web.ShiroFilterFactoryBean
/*    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //过滤的路径
        Map<String, String> map = new HashMap<>();
        map.put("/**", "authc");
        map.put("/user/login/pc", "anon");//放行登录相关接口
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);

        shiroFilterFactoryBean.setLoginUrl("/login.html");//登录页面
        return shiroFilterFactoryBean;
    }*/
}

使用配置文件来创建ShiroFilterFactoryBean

package com.yuantiao.smartcardms;

import org.apache.catalina.connector.Connector;
import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ImportResource;
import org.springframework.scheduling.annotation.EnableScheduling;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;

/**
 * SpringBoot项目启动类
 */
@SpringBootApplication
@EnableScheduling/* 开启定时任务 */
@MapperScan("com.yuantiao.smartcardms.dao.mapper")
@ImportResource("classpath:shiro/shiro-config.xml")
public class SmartcardMsApplication {

    public static void main(String[] args) {
        SpringApplication.run(SmartcardMsApplication.class, args);
    }

    /**
     * CORS跨域请求解决403
     * @return
     */
    private CorsConfiguration buildConfig() {
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.addAllowedOrigin("*");
        corsConfiguration.addAllowedHeader("*");
        corsConfiguration.addAllowedMethod("*");
        corsConfiguration.setAllowCredentials(true);
        return corsConfiguration;
    }

    /**
     * 跨域请求COOKIES携带SessionId
     * @return
     */
    @Bean
    public CorsFilter corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", buildConfig());
        return new CorsFilter(source);
    }

    /**
     * 请求链接[]{}非法字符
     * @return
     */
    @Bean
    public TomcatServletWebServerFactory webServerFactory() {
        TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
        factory.addConnectorCustomizers((Connector connector) -> {
            connector.setProperty("relaxedPathChars", ""<>[\]^`{|}");
            connector.setProperty("relaxedQueryChars", ""<>[\]^`{|}");
        });
        return factory;
    }

}

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <bean class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="filterChainDefinitionMap" >
            <!-- 用props无法保证资源是按照顺序加载到filterChainDefinitionMap的，会有问题 -->
            <!--<props>-->
                <!--<prop key="/user/add">anon</prop>-->
                <!--<prop key="/user/delete">roles[laoban]</prop>-->
                <!--<prop key="/user/login/pc">anon</prop>-->
                <!--<prop key="/user/logout">anon</prop>-->
                <!--<prop key="/**">authc</prop>-->
            <!--</props>-->
            <map>
                <entry key="/user/login/pc" value="anon"/>
                <entry key="/**" value="authc"/>
            </map>
        </property>
        <property name="loginUrl" value="/login.html"/>
        <property name="securityManager" ref="securityManager"/>
        <property name="filters">
            <map>
                <entry key="authc">
                    <bean class="com.yuantiao.smartcardms.config.shiro.ResultFormAuthenticationFilter"/>
                </entry>
            </map>
        </property>
    </bean>

</beans>

错误

<property name="filterChainDefinitionMap" >
    <value>
        /card.html = anon
        /** = authc
    </value>
</property>
<!--
Caused by: java.lang.IllegalStateException: Cannot convert value of type 'java.lang.String' to required type 'java.util.Map' for property 'filterChainDefinitionMap': no matching editors or conversion strategy found

看到网上很多filterChainDefinitionMap这种写，但是一配置直接报错。value指定的是字符串，而filterChainDefinitionMap是一个LinkedHashMap对象。完全无法这样配置。
-->

bugs

jquery-3.1.1.min.js:4 POST http://localhost:9000/smartcard/user/login/pc 415
请求头：
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Set-Cookie: JSESSIONID=080D2E469D78CD39C88AE54950B6640D; Path=/smartcard; HttpOnly
Set-Cookie: rememberMe=deleteMe; Path=/smartcard; Max-Age=0; Expires=Sat, 02-Nov-2019 02:32:54 GMT