java：shiroProject
1.backend_system Maven Webapp:
LoginController.java:
package com.shiro.demo.controller; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; @Controller public class LoginController { /** * @description 跳转到登录页面 * @return */ @RequestMapping(value = "/login", method = RequestMethod.GET) public String login() { return "login"; } /** * @description * 当form提交后，首先由shiro进行拦截，如果中途报错，shiro只是把错误信息打印控制台上，并不会真正意义上的报错 * shiro会直接全部放行，一切不再拦截，chain.doFilter()放行 * 路径直接会找controller * 找到controller后，发现该controller并没有post请求方式，报错吧！ * 说白了，POST请求方式的login方法，是用来专门处理shiro抛出的异常的 * 在登录功能中，只要直接找到了controller，就一定登录失败！ * 在shiro拦截的过程中，如果登录成功，shiro会默认返回项目的根目录"/" * @return */ @RequestMapping(value="/login", method=RequestMethod.POST) public String logins(Model model) { return "login"; } /** * @description 跳转到无权限页面 * @return */ @RequestMapping("/noauth") public String turnNoauth() { return "noauth"; } /** * @description 当登录成功后，跳转到页面 * 所有登录成功后，都从根目录下开始定向 * @return */ @RequestMapping("/") public String turnIndexPage() { // 默认用的是请求转发 return "list"; } }
ManagerController.java:
package com.shiro.demo.controller; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; @Controller @RequestMapping("/manager") public class ManagerController { @RequestMapping(value = "book", method = RequestMethod.GET) public String turnBookPage() { // 请求转发 return "manager/books"; } }
AdminMapper.java:
package com.shiro.demo.mapper; import java.util.List; import com.shiro.demo.model.Admin; public interface AdminMapper { /** * @description 通过用户名查询用户信息 * @param username * @return */ public Admin selectAdminByUsername(String username); /** * @description 通过用户名查询该用户拥有的角色名称 * @param username * @return */ public List<String> selectRolesByUsername(String username); /** * @description 根据用户名查询出该用户下的所有权限 * @param username * @return */ public List<String> selectPermissionsByUsername(String username); }
PermissionMapper.java:
package com.shiro.demo.mapper; public interface PermissionMapper { }
RoleMapper.java:
package com.shiro.demo.mapper; public interface RoleMapper { }
Admin.java:
package com.shiro.demo.model; public class Admin { private Long id; private String username; private String password; private String salt; private Integer locked; public Long getId() { return id; } public void setId(Long id) { this.id = id; } public String getUsername() { return username; } public void setUsername(String username) { this.username = username == null ? null : username.trim(); } public String getPassword() { return password; } public void setPassword(String password) { this.password = password == null ? null : password.trim(); } public String getSalt() { return salt; } public void setSalt(String salt) { this.salt = salt == null ? null : salt.trim(); } public Integer getLocked() { return locked; } public void setLocked(Integer locked) { this.locked = locked; } }
Permission.java:
package com.shiro.demo.model; public class Permission { private Long id; private String permissionName; private String permissionResource; public Long getId() { return id; } public void setId(Long id) { this.id = id; } public String getPermissionName() { return permissionName; } public void setPermissionName(String permissionName) { this.permissionName = permissionName == null ? null : permissionName.trim(); } public String getPermissionResource() { return permissionResource; } public void setPermissionResource(String permissionResource) { this.permissionResource = permissionResource == null ? null : permissionResource.trim(); } }
Role.java:
package com.shiro.demo.model; public class Role { private Long id; private String roleName; private String roles; public Long getId() { return id; } public void setId(Long id) { this.id = id; } public String getRoleName() { return roleName; } public void setRoleName(String roleName) { this.roleName = roleName == null ? null : roleName.trim(); } public String getRoles() { return roles; } public void setRoles(String roles) { this.roles = roles == null ? null : roles.trim(); } }
ShiroRelam.java:
package com.shiro.demo.realm; import java.util.List; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.LockedAccountException; import org.apache.shiro.authc.SimpleAuthenticationInfo; import org.apache.shiro.authc.UnknownAccountException; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.apache.shiro.util.ByteSource; import org.springframework.beans.factory.annotation.Autowired; import com.shiro.demo.model.Admin; import com.shiro.demo.service.LoginService; /** * * @description 用于用户的认证和授权 * @author Seven Lee * @date 2017年9月25日 上午10:34:20 * */ public class ShiroRelam extends AuthorizingRealm { @Autowired private LoginService loginService; /** * @description 用户的认证 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { // 1.把AuthenticationToken类型转换为UsernamePasswordToken类型 UsernamePasswordToken upToken = (UsernamePasswordToken) token; // 2.从upToken获取到username String username = upToken.getUsername(); // 3.从数据库中通过username查询，认证用户是否存在(调用service) Admin admin = loginService.selectAdminByUsername(username); // 4.判断该用户是否存在,锁定 if (admin == null || "".equals(admin.getUsername())) { throw new UnknownAccountException("该用户名不存在"); } else if (admin.getLocked() == 1) { throw new LockedAccountException("该用户被锁定，请联系管理员"); } // 5.创建SimpleAuthenticationInfo对象，验证该用户的密码是否正确 // 传入的4个参数: // 1.username或者Admin实体对象 // 2.密码 // 3.salt // 4.RealmName(代理对象) SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(username, admin.getPassword(), ByteSource.Util.bytes(admin.getSalt()), getName()); // 6.返回SimpleAuthenticationInfo对象，认证完成 return info; } /** * @description 用户的授权 */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { // 1.通过认证返回的SimpleAuthenticationInfo，获取用户名或者用户的实体类对象 String username = (String) principals.getPrimaryPrincipal(); // 2.通过username查询出该认证后的用户拥有什么角色 // sys_admin sys_role admin_role List<String> roles = loginService.selectRolesByUsername(username); // 3.创建SimpleAuthorizationInfo对象，把所有的角色信息封装进该对象 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); // 4.从数据库中查询出该角色下拥有的权限,eg: 普通用户-->只拥有查看图书的权限，并没有借阅的权限，只要一办会员卡 // ，就可以对图书拥有借阅的权限 // 根据username查询出该认证用户的权限 List<String> permissions = loginService.selectPermissionsByUsername(username); try { info.addRoles(roles); info.addStringPermissions(permissions); } catch (Exception e) { e.printStackTrace(); } // 在这返回给了进行匹配授权的class return info; } }
LoginService.java:
package com.shiro.demo.service; import java.util.List; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; import com.shiro.demo.mapper.AdminMapper; import com.shiro.demo.model.Admin; @Service public class LoginService { @Autowired private AdminMapper adminMapper; /** * @description 通过用户名查询用户信息 * @param username * @return */ public Admin selectAdminByUsername(String username) { return adminMapper.selectAdminByUsername(username); } /** * @description 通过用户名查询该用户拥有的角色名称 * @param username * @return */ public List<String> selectRolesByUsername(String username) { return adminMapper.selectRolesByUsername(username); } /** * @description 根据用户名查询出该用户下的所有权限 * @param username * @return */ public List<String> selectPermissionsByUsername(String username) { return adminMapper.selectPermissionsByUsername(username); } }
AdminMapper.xml:
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" > <mapper namespace="com.shiro.demo.mapper.AdminMapper"> <resultMap id="BaseResultMap" type="com.shiro.demo.model.Admin"> <id column="id" property="id" jdbcType="BIGINT" /> <result column="username" property="username" jdbcType="VARCHAR" /> <result column="password" property="password" jdbcType="VARCHAR" /> <result column="salt" property="salt" jdbcType="VARCHAR" /> <result column="locked" property="locked" jdbcType="INTEGER" /> </resultMap> <!-- 通过用户名查询用户信息 --> <select id="selectAdminByUsername" parameterType="string" resultType="com.shiro.demo.model.Admin"> select * from sys_admin where username = #{username} </select> <!-- 通过用户名查询该用户拥有的角色名称 --> <select id="selectRolesByUsername" parameterType="string" resultType="string"> SELECT sr.roles FROM sys_admin sa LEFT JOIN admin_role ar ON ar.admin_id = sa.id LEFT JOIN sys_role sr ON sr.id = ar.role_id WHERE sa.username = #{username} </select> <!-- 根据用户名查询出该用户下的所有权限 --> <select id="selectPermissionsByUsername" parameterType="string" resultType="string"> SELECT permission_resource FROM sys_permission sp INNER JOIN role_permission rp ON rp.permission_id = sp.id INNER JOIN admin_role ar ON ar.role_id = rp.role_id INNER JOIN sys_admin sa ON sa.id = ar.admin_id WHERE sa.username = #{username} </select> </mapper>
PermissionMapper.xml:
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" > <mapper namespace="com.shiro.demo.mapper.PermissionMapper" > <resultMap id="BaseResultMap" type="com.shiro.demo.model.Permission" > <id column="id" property="id" jdbcType="BIGINT" /> <result column="permission_name" property="permissionName" jdbcType="VARCHAR" /> <result column="permission_resource" property="permissionResource" jdbcType="VARCHAR" /> </resultMap> </mapper>
RoleMapper.xml:
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" > <mapper namespace="com.shiro.demo.mapper.RoleMapper"> <resultMap id="BaseResultMap" type="com.shiro.demo.model.Role"> <id column="id" property="id" jdbcType="BIGINT" /> <result column="role_name" property="roleName" jdbcType="VARCHAR" /> <result column="roles" property="roles" jdbcType="VARCHAR" /> </resultMap> </mapper>
mybatis-config.xml：
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE configuration PUBLIC "-//mybatis.org//DTD Config 3.0//EN" "http://mybatis.org/dtd/mybatis-3-config.dtd"> <configuration> <!-- mybatis默认是没有开启延迟加载的 需要手动开启 --> <settings> <!-- 延迟加载 默认false --> <setting name="lazyLoadingEnabled" value="true" /> <!-- 积极加载 默认true --> <setting name="aggressiveLazyLoading" value="false" /> <!--开启缓存 --> <setting name="cacheEnabled" value="true" /> </settings> </configuration>
applicationContext-db.xml：
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns="http://www.springframework.org/schema/beans" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> <!--数据源配置 --> <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource" init-method="init" destroy-method="close"> <property name="driverClassName" value="${jdbc.driverClassName}" /> <property name="url" value="${jdbc.url}" /> <property name="username" value="${jdbc.username}" /> <property name="password" value="${jdbc.password}" /> </bean> <bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean"> <property name="dataSource" ref="dataSource" /> <!-- 自动扫描mapping.xml文件，**表示迭代查找 --> <property name="mapperLocations" value="classpath*:mapper/*Mapper.xml" /> <!--mybatis配置文件位置 --> <property name="configLocation" value="classpath:mybatis/mybatis-config.xml" /> </bean> <!-- DAO接口所在包名，Spring会自动查找其下的类 --> <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer"> <property name="basePackage" value="com.shiro.demo.mapper" /> <property name="sqlSessionFactoryBeanName" value="sqlSessionFactory"></property> </bean> </beans>
applicationContext-shiro.xml：
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns="http://www.springframework.org/schema/beans" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> <!--安全管理器 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <!--注入我们自定的realm --> <property name="realm" ref="shiroRealm" /> <!--注入缓存管理器 --> <property name="cacheManager" ref="cacheManager" /> <!--注入会话管理器 --> <property name="sessionManager" ref="sessionManager" /> <!--注入cookie管理器 --> <property name="rememberMeManager" ref="rememberMeManager" /> </bean> <!--注入cookie管理器 --> <!-- rememberMeManager管理器 --> <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager"> <property name="cookie" ref="rememberMeCookie" /> </bean> <!-- 记住我cookie --> <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie"> <constructor-arg value="rememberMe" /> <!-- 记住我cookie生效时间30天 --> <property name="maxAge" value="2592000" /> </bean> <!-- 会话管理器 --> <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"> <!-- session的失效时长，单位毫秒 --> <property name="globalSessionTimeout" value="600000" /> <!-- 删除失效的session --> <property name="deleteInvalidSessions" value="true" /> </bean> <!-- 缓存管理器 --> <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" /> <!--自定的relam 从数据库访问用户的认证和授权信息 --> <bean id="shiroRealm" class="com.shiro.demo.realm.ShiroRelam"> <property name="credentialsMatcher" ref="credentialsMatcher" /> </bean> <!-- 凭证管理器，设置密码的加密算法和规则 --> <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> <property name="hashAlgorithmName" value="md5" /> <property name="hashIterations" value="1024" /> </bean> <!-- shiro过滤器 --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager" /> <!-- 如果没有认证将要跳转的登陆地址，http可访问的url， 如果不在表单认证过虑器FormAuthenticationFilter中指, 定此地址就为身份认证地址 --> <property name="loginUrl" value="/login" /> <!-- 没有权限跳转的地址 --> <property name="unauthorizedUrl" value="/noauth" /> <!-- 配置安全规则 --> <property name="filterChainDefinitions"> <value> <!-- 退出拦截，请求logout执行退出操作 --> /logout = logout <!-- 所有已经被认证的用户和记住我的用户全部放行 --> <!-- /** = user --> <!-- 所有的路径都需要被认证才能访问，如果没有认证，会找到loginUrl，loginUrl指向的是controller --> /** = authc </value> </property> </bean> </beans>
applicationContext-tx.xml：
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns="http://www.springframework.org/schema/beans" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> <!-- 事务管理器 --> <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager"> <property name="dataSource" ref="dataSource" /> </bean> <!-- 事务详情 --> <tx:advice id="txAdvice" transaction-manager="transactionManager"> <tx:attributes> <tx:method name="select*" read-only="true" /> <tx:method name="find*" read-only="true" /> <tx:method name="get*" read-only="true" /> <tx:method name="query*" read-only="true" /> <tx:method name="*" /> </tx:attributes> </tx:advice> <!--支持基于注解的aspectj --> <aop:aspectj-autoproxy /> <!--aop编程，切入点表达式 确定增强的连接器，从而获得切入点 --> <aop:config> <aop:advisor advice-ref="txAdvice" pointcut="execution(* com.shiro.demo.service..*.*(..)))" /> </aop:config> </beans>
applicationContext-mvc.xml：
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context" xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:aop="http://www.springframework.org/schema/aop" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd"> <!-- 自动扫描且只扫描@Controller --> <context:component-scan base-package="com.shiro.demo.controller" /> <!-- <context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/> <context:include-filter type="annotation" expression="org.springframework.web.bind.annotation.ControllerAdvice"/> --> <!-- 当在web.xml 中 DispatcherServlet使用 <url-pattern>/</url-pattern> 映射时，能映射静态资源 --> <mvc:default-servlet-handler /> <!-- 可用在springmvc.xml配置文件中使用<mvc:annotation-driven>替代注解处理器和适配器的配置。 --> <mvc:annotation-driven> <mvc:message-converters> <bean class="org.springframework.http.converter.StringHttpMessageConverter"> <constructor-arg index="0" value="UTF-8" /> </bean> <!-- 格式化json --> <bean class="org.springframework.http.converter.json.MappingJackson2HttpMessageConverter"> <property name="prettyPrint" value="true" /> </bean> </mvc:message-converters> </mvc:annotation-driven> <!-- Jsp视图解析器 --> <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"> <property name="prefix" value="/WEB-INF/pages/" /> <property name="suffix" value=".jsp" /> </bean> <!-- 开启aop对类代理 --> <aop:config proxy-target-class="true" /> <!-- 开启shiro注解支持 --> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager" /> </bean> </beans>
application.properties：
#mysql connector
jdbc.driverClassName=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/shiro
jdbc.username=root
jdbc.password=root
applicationContext.xml：
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns="http://www.springframework.org/schema/beans" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> <!--加载配置文件 --> <context:property-placeholder location="classpath:application.properties" /> <!-- 扫描的包路径 去掉mvc的注解 --> <context:component-scan base-package="com.shiro.demo.service" /> <!-- 数据源配置 --> <import resource="spring/applicationContext-db.xml" /> <!-- 事务配置 --> <import resource="spring/applicationContext-tx.xml" /> <!-- 安全框架的配置 --> <import resource="spring/applicationContext-shiro.xml" /> </beans>
web.xml：
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"> <!--Spring入口文件的配置--> <!-- 确定配置文件位置 --> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:applicationContext.xml</param-value> </context-param> <!-- 配置spring 监听器，加载xml配置文件 --> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <!-- 解决POST请求的中文乱码--> <filter> <filter-name>CharacterEncodingFilter</filter-name> <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class> <init-param> <param-name>encoding</param-name> <param-value>utf-8</param-value> </init-param> </filter> <filter-mapping> <filter-name>CharacterEncodingFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- DispatcherServlet：前端控制器 配置前端控制器servlet --> <servlet> <servlet-name>springmvc</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <!--加载前端控制器配置文件 上下文配置位置--> <init-param> <!--contextConfigLocation：指定springmvc配置的加载位置， 如果不指定则默认加 载WEB-INF/[DispatcherServlet的Servlet名字]-servlet.xml(例如springmvc-servlet.xml)。 --> <param-name>contextConfigLocation</param-name> <param-value>classpath:springmvc/applicationContext-mvc.xml</param-value> </init-param> <!-- 表示随WEB服务器启动 --> <load-on-startup>1</load-on-startup> </servlet> <!-- 可以拦截二种请求 第一种：拦截固定后缀的url，比如设置为 *.do、*.action， 例如：/user/add.action 此方法最简单,不会导致静态资源（jpg,js,css）被拦截 第二种：拦截所有 设置为/， 例如：/user/add /user/add.action此方法可以实现REST风格的url 很多互联网类型的应用使用这种方式.但是此方法会导致静态文件(jpg,js,css)被拦截后不能正常显示.需要特殊处理 错误设置：拦截所有,设置为/*，此设置方法错误,因为请求到Action, 当action转到jsp时再次被拦截,提示不能根据jsp路径mapping成功. --> <servlet-mapping> <servlet-name>springmvc</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> <!-- shiro过虑器，DelegatingFilterProx会从spring容器中找shiroFilter --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <init-param> <param-name>targetFilterLifecycle</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <!-- <servlet-name>springmvc</servlet-name> --><!-- 所有controller --> <url-pattern>/*</url-pattern> </filter-mapping> </web-app>
books.jsp：
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%> <%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro"%> <% String path = request.getContextPath(); String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path + "/"; %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base href="<%=basePath%>"> <title>My JSP 'books.jsp' starting page</title> </head> <body> <h1>Books Manage Page</h1> <shiro:hasPermission name="book:insert"> <h4> <a href="">新增图书</a> </h4> </shiro:hasPermission> <table> <thead> <tr> <th>图书编号</th> <th>图书名称</th> <th>图书价格</th> <th>操作</th> </tr> </thead> <tbody> <tr> <td>b001</td> <td>爱因斯坦相对论</td> <td>20.5</td> <td><shiro:hasPermission name="book:delete"> <a href="">删除</a> </shiro:hasPermission> <shiro:hasPermission name="book:update"> <a href="">修改</a> </shiro:hasPermission></td> </tr> </tbody> </table> </body> </html>
list.jsp：
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%> <%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro"%> <% String path = request.getContextPath(); String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path + "/"; %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base href="<%=basePath%>"> <title>My JSP 'list.jsp' starting page</title> </head> <body> <h1> Welcome <shiro:principal></shiro:principal> </h1> <ul> <shiro:hasRole name="book_manager"> <li><a href="/backend_system/manager/book">图书管理</a></li> </shiro:hasRole> <shiro:guest> <li><a href="">加入我们</a></li> </shiro:guest> <li><a href="">请叫我男神</a></li> <li><a href="">就是这么厉害！哈哈哈</a></li> <shiro:hasRole name="menu_manager"> <li><a href="">菜单管理员</a></li> </shiro:hasRole> <li><a href="">登出</a></li> </ul> </body> </html>
login.jsp：
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%> <% String path = request.getContextPath(); String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path + "/"; %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base href="<%=basePath%>"> <title>My JSP 'login.jsp' starting page</title> </head> <body> <h1>User Login</h1> <form action="/backend_system/login" method="post"> Username:<input type="text" name="username" /><br /> Password:<input type="password" name="password" /><br /> Remember Me:<input type="checkbox" name="remember" value="1" /><br /> <input type="submit" value="Login" /> </form> </body> </html>
noauth.jsp：
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%> <% String path = request.getContextPath(); String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/"; %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base href="<%=basePath%>"> <title>My JSP 'noauth.jsp' starting page</title> </head> <body> <h1>noauth page</h1> </body> </html>
pom.xml：
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <groupId>com.shiro.demo</groupId> <artifactId>backend_system</artifactId> <packaging>war</packaging> <version>0.0.1-SNAPSHOT</version> <name>backend_system Maven Webapp</name> <url>http://maven.apache.org</url> <properties> <!-- spring --> <spring.version>4.3.4.RELEASE</spring.version> <!-- json --> <jackson.version>2.8.1</jackson.version> <fastjson.version>1.2.17</fastjson.version> <!-- servlet,jstl,jsp --> <servlet-api.version>3.0.1</servlet-api.version> <jsp-api.version>2.0</jsp-api.version> <jstl.version>1.2</jstl.version> <!-- mysql --> <mysql.version>5.1.40</mysql.version> <!-- 连接池 --> <druid.version>1.0.26</druid.version> <mybatis.version>3.3.0</mybatis.version> <!-- mybatis --> <mybatis.spring.version>1.2.3</mybatis.spring.version> <mybatis.mapper.version>3.3.9</mybatis.mapper.version> <!-- log4j的增强slf4j --> <slf4j.version>1.7.7</slf4j.version> <!-- shiro --> <shiro.version>1.2.3</shiro.version> <!-- 缓存 --> <ehcache.version>2.10.3</ehcache.version> </properties> <dependencies> <!-- servlet --> <dependency> <groupId>javax.servlet</groupId> <artifactId>javax.servlet-api</artifactId> <version>${servlet-api.version}</version> <scope>provided</scope> </dependency> <!-- jsp --> <dependency> <groupId>javax.servlet</groupId> <artifactId>jsp-api</artifactId> <version>${jsp-api.version}</version> <scope>provided</scope> </dependency> <!-- jstl --> <dependency> <groupId>javax.servlet</groupId> <artifactId>jstl</artifactId> <version>${jstl.version}</version> <scope>runtime</scope> </dependency> <!--json start --> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>${jackson.version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>${jackson.version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-annotations</artifactId> <version>${jackson.version}</version> </dependency> <dependency> <groupId>com.alibaba</groupId> <artifactId>fastjson</artifactId> <version>${fastjson.version}</version> </dependency> <!--json end --> <!--spring start --> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-context</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-aspects</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-jdbc</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-web</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-webmvc</artifactId> <version>${spring.version}</version> </dependency> <!--spring end --> <!-- database begin --> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>${mysql.version}</version> <scope>runtime</scope> </dependency> <dependency> <groupId>com.alibaba</groupId> <artifactId>druid</artifactId> <version>${druid.version}</version> </dependency> <dependency> <groupId>org.mybatis</groupId> <artifactId>mybatis</artifactId> <version>${mybatis.version}</version> </dependency> <dependency> <groupId>org.mybatis</groupId> <artifactId>mybatis-spring</artifactId> <version>${mybatis.spring.version}</version> </dependency> <!-- database end --> <!-- shiro --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>${shiro.version}</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-web</artifactId> <version>${shiro.version}</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>${shiro.version}</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>${shiro.version}</version> </dependency> <!-- shiro end --> <!--ehcache 缓存配置 --> <dependency> <groupId>net.sf.ehcache</groupId> <artifactId>ehcache</artifactId> <version>${ehcache.version}</version> </dependency> </dependencies> <build> <finalName>backend_system</finalName> </build> </project>
