springBoot前后端分離項目中shiro的302跳轉(zhuǎn)問題

更新時間：2021年12月17日 11:40:05 作者：小羅的

這篇文章主要介紹了springBoot前后端分離項目中shiro的302跳轉(zhuǎn)問題，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教

springBoot前后端分離項目shiro的302跳轉(zhuǎn)

項目是使用的springboot ,使用的shiro做的用戶鑒權(quán)。在前端請求時當(dāng)用戶信息失效，session失效的時候，shiro會重定向到配置的login.jsp 頁面，或者是自己配置的logUrl。

因是前后端分離項目，與靜態(tài)資源文件分離，固重定向后，接著會404。

經(jīng)過查找網(wǎng)上配置資料，發(fā)現(xiàn)302原因是

FormAuthenticationFilter中onAccessDenied 方法做了相應(yīng)處理。那知道問題所在，就可以有解決方了。
重寫 onAccessDenied 方法，針對自己的業(yè)務(wù)做相應(yīng)處理，然后在加載過濾器配置的時候添加到配置中。

以下是代碼

增加類ShiroFormAuthenticationFilter 重新方法

package com.oilpay.wallet.shiro; 
import com.alibaba.fastjson.JSONObject;
import com.oilpay.wallet.interceptor.TokenInterceptor;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.RequestMethod;
 
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.PrintWriter;
 
/**
 *
 * 重寫權(quán)限驗證問題，登錄失效后返回狀態(tài)碼
 *
 */
public class ShiroFormAuthenticationFilter extends FormAuthenticationFilter { 
    Logger logger  = LoggerFactory.getLogger(TokenInterceptor.class); 
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        if (isLoginRequest(request, response)) {
            if (isLoginSubmission(request, response)) {
                if (logger.isTraceEnabled()) {
                    logger.trace("Login submission detected.  Attempting to execute login.");
                }
                return executeLogin(request, response);
            } else {
                if (logger.isTraceEnabled()) {
                    logger.trace("Login page view.");
                }
                //allow them to see the login page ;)
                return true;
            }
        } else {
            HttpServletRequest req = (HttpServletRequest)request;
            HttpServletResponse resp = (HttpServletResponse) response;
            if(req.getMethod().equals(RequestMethod.OPTIONS.name())) {
                resp.setStatus(HttpStatus.OK.value());
                return true;
            }
 
            if (logger.isTraceEnabled()) {
                logger.trace("Attempting to access a path which requires authentication.  Forwarding to the " +
                        "Authentication url [" + getLoginUrl() + "]");
            }
            //前端Ajax請求時requestHeader里面帶一些參數(shù)，用于判斷是否是前端的請求
            String test= req.getHeader("test");
            if (test!= null || req.getHeader("wkcheck") != null) {
                //前端Ajax請求，則不會重定向
                resp.setHeader("Access-Control-Allow-Origin",  req.getHeader("Origin"));
                resp.setHeader("Access-Control-Allow-Credentials", "true");
                resp.setContentType("application/json; charset=utf-8");
                resp.setCharacterEncoding("UTF-8");
                PrintWriter out = resp.getWriter();
                JSONObject result = new JSONObject();
                result.put("message", "登錄失效");
                result.put("resultCode", 1000);
                out.println(result);
                out.flush();
                out.close();
            } else {
                saveRequestAndRedirectToLogin(request, response);
            }
            return false;
        }
    }
}

在過濾器配置中添加

@Bean(name="shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") SecurityManager manager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(manager);
        //配置訪問權(quán)限
        LinkedHashMap<String, String> filterChainDefinitionMap=new LinkedHashMap<String, String>();
        filterChainDefinitionMap.put("/common/logout", "logout");
        filterChainDefinitionMap.put("/","anon");
        filterChainDefinitionMap.put("/common/login","anon");
 
        filterChainDefinitionMap.put("/common/*","anon");
        filterChainDefinitionMap.put("/imageVerifyCode/getCode", "anon");
        filterChainDefinitionMap.put("/sendVerifyCode/register", "anon");
        filterChainDefinitionMap.put("/sendVerifyCode/resetLoginPwd", "anon");
        filterChainDefinitionMap.put("/**", "authc"); //表示需要認(rèn)證才可以訪問
 
        LinkedHashMap<String, Filter> filtsMap=new LinkedHashMap<String, Filter>();
        filtsMap.put("authc",new ShiroFormAuthenticationFilter() );
        shiroFilterFactoryBean.setFilters(filtsMap);
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

至此，可以按照自己的需求做相應(yīng)處理。

關(guān)于shiro 總是302的問題

我的原因是使用了authc，由于autuc對應(yīng)的過濾器FormAuthenticationFilter中onAccessDenied方法返回的值都為false，所以訪問url時會一直進(jìn)行循環(huán)重定向，解決方案：重寫onAccessDenied方法，并注入到shiroFiter中。

附上shiro配置文件

<!-- shiroFilter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
   <property name="securityManager" ref="securityManager" />
   <!-- 設(shè)定角色的登錄鏈接，這里為cas登錄頁面的鏈接可配置回調(diào)地址  -->
   <!-- 登錄地址 -->
   <property name="loginUrl" value="/login.html"/>
   <!-- 登錄后跳轉(zhuǎn)到業(yè)務(wù)頁面 -->
   <property name="successUrl" value="/index.do"/>
   <!-- 錯誤頁面 -->
   <property name="unauthorizedUrl" value="/denied.html"/>
   <property name="filters">
      <map>
         <!--將重寫了的FormAuthenticationFilter.onAccessDenied方法的類注入到其中-->
         <entry key="authc" value-ref="formAuthenticationFilter"></entry>
      </map>
   </property>
   <property name="filterChainDefinitions">
      <value>
          /login.html=anon
         <!--配置靜態(tài)資源-->
         /js/**=anon
         /templates/**=anon
         /assets/**=anon
         /css/**=anon
         <!--權(quán)限設(shè)置-->
         /index.do=authc
         /user/login.do=anon
         /**=authc
        </value>
   </property>
</bean>
<!-- 重寫FormAuthenticationFilter的onAccessDenied方法的自定義過濾器 -->
<bean id="formAuthenticationFilter" class="com.jd.risk.giasys.service.realm.filter.MyFilter" />

重寫onAccessDenied方法

package com.jd.risk.giasys.service.realm.filter;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
/**
 * Created by jianghaisong on 2017/12/17.
 */
public class MyFilter extends FormAuthenticationFilter{
    private Logger log = LoggerFactory.getLogger(MyFilter.class);
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
       //進(jìn)行重寫,業(yè)務(wù)邏輯
    }
}

以上為個人經(jīng)驗，希望能給大家一個參考，也希望大家多多支持腳本之家。

您可能感興趣的文章: