最近因為項目需要，接觸了shiro。新手入門

發現權限攔截失效，

一直以為是以為授權和DB的問題

研究了一個下午，終于發現了問題所在

我的訪問路徑沒有寫前面的斜杠！！，而DB中的資源路徑是可以省略的，崩潰了吧

但是問題來了，為什么在其他地方可以忽略掉前面的小斜杠呢？

經過幾分鐘的搗鼓發現，在springboot中，不論是thymeleaf的模板也好（我用的thymeleaf），還是后端代碼也好，底層會自動補全這個斜杠

問題解決！！

補充知識：SpringBoot整合shiro的一個完整的小案例

SpringBoot整合配置版的shiro很簡單,邏輯清

首先在pom.xml的配置如下,shiro使用緩存ehcache

<dependency> <groupId>net.sf.ehcache</groupId> <artifactId>ehcache</artifactId> <version>2.10.4</version> </dependency> <!-- shiro spring. --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>1.2.2</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.2.2</version> </dependency> <!-- shiro ehcache --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>1.2.2</version> </dependency>

接著配置shiro

@Configurationpublic class ShiroConfig { @Bean public ShiroFilterFactoryBean shirFilter(DefaultWebSecurityManager securityManager) { ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean(); // 必須設置 SecurityManager shiroFilter.setSecurityManager(securityManager); // 攔截器 Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); // 設置login URL shiroFilter.setLoginUrl('/login'); // 登錄成功后要跳轉的鏈接 shiroFilter.setSuccessUrl('/main'); filterChainDefinitionMap.put('/webjars/**', 'anon'); filterChainDefinitionMap.put('/druid/**', 'anon'); //靜態資源的處理 filterChainDefinitionMap.put('/js/**', 'anon'); filterChainDefinitionMap.put('/css/**', 'anon'); filterChainDefinitionMap.put('/asserts/**', 'anon'); filterChainDefinitionMap.put('/fonts/**', 'anon'); filterChainDefinitionMap.put('/images/**', 'anon'); // 退出系統的過濾器 filterChainDefinitionMap.put('/logout', 'logout'); filterChainDefinitionMap.put('/login', 'anon'); filterChainDefinitionMap.put('/kaptcha', 'anon'); filterChainDefinitionMap.put('/**', 'authc'); shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap); return shiroFilter; } @Bean public HashedCredentialsMatcher hashedCredentialsMatcher() { HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher(); hashedCredentialsMatcher.setHashAlgorithmName('MD5'); hashedCredentialsMatcher.setHashIterations(1024); return hashedCredentialsMatcher; } @Bean public ShiroRealm shiroRealm(HashedCredentialsMatcher hashedCredentialsMatcher) { ShiroRealm shiroRealm = new ShiroRealm(); shiroRealm.setCredentialsMatcher(hashedCredentialsMatcher); return shiroRealm; } //shiro使用緩存ehcachae @Bean public EhCacheManager ehCacheManager() { EhCacheManager ehCacheManager = new EhCacheManager(); ehCacheManager.setCacheManagerConfigFile('classpath:ehcache.xml'); return ehCacheManager; } @Bean('sessionManager') public SessionManager sessionManager(){ DefaultWebSessionManager sessionManager = new DefaultWebSessionManager(); sessionManager.setSessionValidationSchedulerEnabled(true); sessionManager.setSessionIdCookieEnabled(true); return sessionManager; } @Bean('securityManager') public DefaultWebSecurityManager securityManager(ShiroRealm shiroRealm, SessionManager sessionManager) { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); securityManager.setRealm(shiroRealm); securityManager.setSessionManager(sessionManager); return securityManager; } @Bean('lifecycleBeanPostProcessor') public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } @Bean public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() { DefaultAdvisorAutoProxyCreator proxyCreator = new DefaultAdvisorAutoProxyCreator(); proxyCreator.setProxyTargetClass(true); return proxyCreator; } @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor(); advisor.setSecurityManager(securityManager); return advisor; }}

在配置中提到的realm如下配置

public class ShiroRealm extends AuthorizingRealm { @Autowired private UserService userService; @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { UsernamePasswordToken upToken = (UsernamePasswordToken) token; // 取出表單用戶名 String username = upToken.getUsername(); // 查詢是否有該用戶 if (userService.getByName(username) == null) { throw new UnknownAccountException('用戶不存在!'); } // 靠用戶名從數據庫查詢該用戶的全部信息 User user = userService.getByName(username); // 傳入:用戶名,加密后的密碼,鹽值,該realm的名字，加密算法和加密次數在已經在配置文件中指定 SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(username, user.getPassword(),ByteSource.Util.bytes(username), getName()); return info; } @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { // 1. 從 PrincipalCollection 中來獲取登錄用戶的信息 Object principal = principals.getPrimaryPrincipal(); // 2. 利用登錄的用戶的信息來..當前用戶的角色或權限(可能需要查詢數據庫) Set<String> roles = new HashSet<String>(); roles.add('user'); if ('admin'.equals(principal)) { roles.add('admin'); } // 3. 創建 SimpleAuthorizationInfo, 并設置其 reles 屬性 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roles); // 4. 返回 SimpleAuthorizationInfo 對象. return info; }}

由于我做的平臺只有一個管理員就不寫注冊了,這時手動算出一個admin用戶的密碼

public static void main(String[] args) { Object result = new SimpleHash('MD5','123456',ByteSource.Util.bytes('admin'),1024); System.out.println(result); }

最后寫登錄的Controller

@Controllerpublic class LoginController { // 處理登錄邏輯 @PostMapping('/login') public String login(String username, String password, String kaptcha, HttpSession session, Map<String, Object> map) { Subject currentUser = SecurityUtils.getSubject(); if (!currentUser.isAuthenticated()) { // 把用戶名和密碼封裝為 UsernamePasswordToken 對象 UsernamePasswordToken token = new UsernamePasswordToken(username, password); // 設置為rememberme token.setRememberMe(true); try {// 執行登錄.currentUser.login(token); } // 所有認證時異常的父類 catch (AuthenticationException ae) {map.put('password', '輸入的用戶名或密碼錯誤');log.info('登錄失敗: ' + ae.getMessage());return 'login'; } } if (!session.getAttribute('code').equals(kaptcha)) { map.put('kaptcha', '輸入的驗證碼錯誤'); return 'login'; } session.setAttribute('loginUser', 'user'); return 'main'; }}

以上這篇解決springboot+shiro 權限攔截失效的問題就是小編分享給大家的全部內容了，希望能給大家一個參考，也希望大家多多支持好吧啦網。