springboot+shiro(session管理)(二)前后端综合后端

悠悠 2023-02-18 11:54 47阅读 0赞

之前有个写好的前端VUE项目，这里前端代码不想改动了，稍微改下后端，做下适配。

1、修改下登录接口，因为(1)前端项目用的是data传参，(2)并且访问的是/login，(3)密码做了加密：

package com.shiro.session.controller;
    
    import com.demo.dto.UserDTO;
    import com.shiro.session.dto.CommonEnums;
    import com.shiro.session.dto.ResponseMessage;
    import com.shiro.session.util.AESUtils;
    import com.shiro.session.util.MD5Util;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestBody;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpSession;
    import java.util.HashMap;
    import java.util.Map;
    
    @RestController
    public class IndexController {
        @RequestMapping(value = "/login")
        public ResponseMessage login(@RequestBody UserDTO user, HttpSession session){
            String username = user.getUserName();
            String passwordRsa = user.getPassword();
            //明文密码
            String password = null;
            //md5加密后的密码
            String md5Password = null;
            try {
                password = AESUtils.decryptStr(passwordRsa,AESUtils.key);
                md5Password = MD5Util.MD5(password);
            } catch (Exception e) {
                throw new IncorrectCredentialsException();
            }
            // 认证成功
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, md5Password);
            try {
                subject.login(usernamePasswordToken);
                // 返回token
                String token = (String) subject.getSession().getId();
                // 当前用户存放
                session.setAttribute("currentUser", username);
                return ResponseMessage.success("登录成功",token);
            } catch (IncorrectCredentialsException e) {
                return ResponseMessage.error("用户名或密码错误");
            }
    
        }
    
    }

2、同步改下登录认证：

package com.shiro.session.realms;
    import com.demo.dto.AuthorityDTO;
    import com.demo.dto.UserDTO;
    import com.demo.service.UserService;
    import com.shiro.session.util.AESUtils;
    import com.shiro.session.util.MD5Util;
    import org.apache.shiro.authc.*;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.springframework.beans.factory.annotation.Autowired;
    
    import java.security.NoSuchAlgorithmException;
    import java.util.List;
    
    
    public class MyShiroRealm extends AuthorizingRealm {
    
    
        @Autowired
        private UserService userService;
    
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
            UserDTO userInfo = (UserDTO) principals.getPrimaryPrincipal();
            List<AuthorityDTO> authorities = userService.getAuthortiesByUserId(userInfo.getId());
            // 添加权限
            for (AuthorityDTO authority : authorities) {
                if (authority != null){
                    authorizationInfo.addStringPermission(authority.getAuthorityName());
                }
    
            }
            // 添加角色
            return authorizationInfo;
        }
    
        /**
         *
         * 用来进行身份认证的，也就是说验证用户输入的账号和密码是否正确
         *
         */
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
                throws AuthenticationException {
            // 获取用户的输入的域账号
            UsernamePasswordToken currentUser = (UsernamePasswordToken) token;
            String userAccount = currentUser.getUsername();
            //
            String password = String.valueOf(currentUser.getPassword());
            UserDTO user = userService.findByUserName(userAccount);
            if(user == null){
                throw new IncorrectCredentialsException();
            }
    
            if(!user.getPassword().equals(password)){
                throw new IncorrectCredentialsException();
            }
            System.out.println("验证成功");
            //注意密码要和UsernamePasswordToken中的保持一致
            return new SimpleAuthenticationInfo(user, password, getName());
        }
    
    }

3、改下ShiroConfig的拦截：

@Bean
        public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            shiroFilterFactoryBean.setSecurityManager((org.apache.shiro.mgt.SecurityManager) securityManager);
            Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
            //注意过滤器配置顺序
            //配置退出过滤器,其中的具体的退出代码Shiro已经替我们实现了，登出后跳转配置的loginUrl,
            // authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问
            filterChainDefinitionMap.put("/static/**", "anon");
            filterChainDefinitionMap.put("/code/getCode", "anon");
            filterChainDefinitionMap.put("/login", "anon");
            filterChainDefinitionMap.put("/user/login", "anon");
            //剩下接口全部需要认证
            filterChainDefinitionMap.put("/**", "authc");
            // 配置shiro默认登录界面地址，前后端分离中登录界面跳转应由前端路由控制，后台仅返回json数据
            shiroFilterFactoryBean.setLoginUrl("/home/unauth");
            LinkedHashMap<String, Filter> filtsMap=new LinkedHashMap<String, Filter>();
            filtsMap.put("authc",new ShiroFormAuthenticationFilter() );
            shiroFilterFactoryBean.setFilters(filtsMap);
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
            return shiroFilterFactoryBean;
        }