SpringBoot整合Apache Shiro 重定向时去掉URL中的JSESSIONID--重写getSessionId方式

Posted 2022-07-04 闲言博客

没设置时的情况，地址栏携带了JSESSIONID了

1.设置DefaultSessionManager类的 setSessionIdUrlRewritingEnabled(false) 方法为false，它默认是true

2.重写getSessionId方法
添加如下代码

request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());

完整代码

public class CustomSessionManager extends DefaultWebSessionManager 

    private static final String AUTHORIZATING = "token";

    public CustomSessionManager()
        super();
        super.setSessionIdUrlRewritingEnabled(false);
    

    @Override
    protected Serializable getSessionId(ServletRequest request, ServletResponse response) 
        //拿到token
        String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATING);
        //不为空则自己管控
        if (sessionId != null)
            request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "cookie");
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
            return sessionId;
        else 
            //为空调用父类的
            return super.getSessionId(request,response);
        
    

设置后，重定向时不带JSESSIONID了