springboot项目前后端分离使用shiro的情况解决sessionid不同问题

ゝ一世哀愁。 2021-10-18 13:42 1338阅读 0赞

## 遇到的问题 ##

开发中遇到开发app或者前后端分离的项目时候,使用ajax等方式向后台访问的时候session每次都不同,这样使用shiro验证全是不能通过.原来我们使用的是token的方式,可以自己通过验证token来实现权限判断问题,但是使用shiro我们还需要自己重写权限判断.那么如何实现shiro中通过token来进行sessionid不变呢.  
我们通过配置shiro的session管理器来解决这个问题,通过将shiro的session存储在redis中进行保存.但是每次访问的session不同还是需要通过传输token来解决,其实是将客户端传递的token来当作sessionid存储起来而已.

## 解决代码 ##

下面上代码:  
首先在pom文件中添加jar包

<dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-web</artifactId>
                <version>1.4.0</version>
                <scope>compile</scope>
            </dependency>
                    <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.4.0</version>
            </dependency>
            <dependency>
                <groupId>org.crazycake</groupId>
                <artifactId>shiro-redis</artifactId>
                <version>2.8.24</version>
            </dependency>
                 <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-data-redis</artifactId>
            </dependency>
                <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-web</artifactId>
                <version>1.4.0</version>
                <scope>compile</scope>
            </dependency>

在项目中添加redis配置,这是我自己在项目中使用的redis配置项,是在使用@Value注解的时候用的

spring:
      redis:
        shiro: #配置redis缓存使用
          host: localhost
          port: 6379
          timeout: 10000
          password: 123456

添加shiro配置类中添加如下内容实现自定义管理session

import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;
    import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
    import org.crazycake.shiro.RedisCacheManager;
    import org.crazycake.shiro.RedisManager;
    import org.crazycake.shiro.RedisSessionDAO;
    import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
    import org.springframework.beans.factory.annotation.Value;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    import javax.servlet.Filter;
    import java.util.LinkedHashMap;
    import java.util.Map;
    
    @Configuration
    public class ShiroConfig {
    
    
        @Value("${spring.redis.shiro.host}")
        private String host="127.0.0.1";
        @Value("${spring.redis.shiro.port}")
        private int port=6379;
        @Value("${spring.redis.shiro.timeout}")
        private int timeout=100000;
        @Value("${spring.redis.shiro.password}")
        private String password = "";
    
     
      
     
    
        //自定义sessionManager
        @Bean("sessionManager")
        public DefaultWebSessionManager sessionManager() {
            MySessionManager mySessionManager = new MySessionManager();
            mySessionManager.setSessionDAO(new RedisSessionDAO());
            return mySessionManager;
        }
    
        /**
         * 配置shiro redisManager
         * <p>
         * 使用的是shiro-redis开源插件
         *
         * @return
         */
        @Bean
        public RedisManager redisManager() {
            RedisManager redisManager = new RedisManager();
            redisManager.setHost(host);
            redisManager.setPort(port);
            redisManager.setExpire(1800);// 配置缓存过期时间
            redisManager.setTimeout(timeout);
            redisManager.setPassword(password);
            return redisManager;
        }
       
        /**
         * 注入 securityManager
         */
        @Bean("SecurityManager")
        public SecurityManager securityManager() {
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            securityManager.setSessionManager(sessionManager());
            return securityManager;
        }
    
        /**
         * RedisSessionDAO shiro sessionDao层的实现 通过redis
         * <p>
         * 使用的是shiro-redis开源插件
         */
        @Bean
        public RedisSessionDAO redisSessionDAO() {
            RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
            redisSessionDAO.setRedisManager(redisManager());
            return redisSessionDAO;
        }
    }

添加自定义管理session的配置类如下:

import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
    import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
    import org.apache.shiro.web.util.WebUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.util.StringUtils;
    
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    import java.io.Serializable;
    
    /**
     * 修改默认获取sessionid
     */
    @Configuration
    public class MySessionManager extends DefaultWebSessionManager {
    
        private Logger logger = LoggerFactory.getLogger(MySessionManager.class);
    
    
        private static final String TOKEN = "token";
    
        private static final String REFERENCED_SESSION_ID_SOURCE = "Stateless request";
    
        public MySessionManager() {
            super();
        }
    
        @Override
        protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
            String id = WebUtils.toHttp(request).getHeader(TOKEN);
            //如果请求头中有 token 则其值为sessionId
            if (!StringUtils.isEmpty(id)) {
                request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);
                request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
                request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
                return id;
            } else {
                //否则按默认规则从cookie取sessionId
                return super.getSessionId(request, response);
            }
        }
    }

配置中使用客户端传过来的token当sessionId,如果没有传递token则使用reques中的sessionid 如果在请求头中获取到了token则将token设置成当前请求的sessionId.  
变量 `private static final String TOKEN = "token";` 是客户端请求头中的token变量名.到此可以实现sessionid同一用户请求sessionid不变.