web项目中用户登录的具体流程

一个登录的具体流程：

1、前端发送公钥的请求。

2、后台生产公钥私钥对，将公钥返回前端，私钥保存到session中。

3、前端拿到公钥后，对用户输入的密码进行md5加密，然后在对（md5加密后的密码+密码）进行rsa加密，发起登录请求，将用户名和加密后的密码传入后台进行校验。

4、后台接受到加密后的密码首先利用私钥对密码进行解密

5、对密码进行完整的校验即采用前32位的MD5码与原始密码(32位之后的值即为密码)进行MD5加密后进行比较。

6、验证通过后采用shiro的subject.login()将登陆验证的工作转交给shiro进行。

7、通过判断shiro返回的异常信息来获取校验未成功的原因。

8、验证通过检查此用户在其他地方时候登陆。方法为自定义一个session的缓存将登录过的session与用户名存入map中，从缓存中获取此用户名对应的缓存判断sessionid是否一致，若不一致说明此次是重复登录，将之前的session通过shiroSessionManager.getSessionDAO().delete(session)进行剔除。

9、返回登录结果到前端。

具体代码片段如下：

登录校验：

public Result checkLogin(String username, String encryptPassword, RSAPrivateKey privateKey){
        
        String decryptPassword = "";
        if (privateKey != null && encryptPassword != null) {
            //解密后的密码。由mds(pass) + pass 组成。
            decryptPassword = RSAUtils.decrypt(privateKey, encryptPassword);
        }
        if(decryptPassword.length() < 32){
            return Result.error("用户名或密码验证失败。");
        }
        //完整性校验，防止篡改
        if (!isComplate(decryptPassword)) {
            return Result.error("密码被篡改,验证失败。");
        }
        decryptPassword = decryptPassword.substring(32);
        String password = new Sha256Hash(decryptPassword).toHex();
        
        //密码完整性校验通过，交给shiro进行验证
        //进行验证，这里可以捕获异常，然后返回对应信息
        try{
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
            subject.login(usernamePasswordToken);
            //剔除重复登录的用户
            SessionsSecurityManager securityManager = (SessionsSecurityManager) SecurityUtils.getSecurityManager();
            DefaultSessionManager shiroSessionManager = (DefaultSessionManager) securityManager.getSessionManager();
            Session session = sessionManager.getSession(username);
            if(session != null){
                //不是同一个会话，进行剔除
                if(!subject.getSession().getId().equals(session.getId())){
                    shiroSessionManager.getSessionDAO().delete(session);
                    sessionManager.removeSession(username);//缓存中移除
                }
            }
            //将新的用户和session加入sessionManager中
            sessionManager.addSession(username, subject.getSession());
            
        }catch(IncorrectCredentialsException ice){
            return Result.error("用户名或密码验证失败");
        }catch(UnknownAccountException uae){
            return Result.error("账号不存在");
        }catch(LockedAccountException  uae){
            return Result.error("账号被锁定"); 
        }catch(ExcessiveAttemptsException  uae){
            return Result.error("操作频繁，请稍后再试");
        }catch(ExpiredCredentialsException ece){
            return Result.error("账号已过期,请重新登录");
        }
        return Result.ok();
    }

UserManager

@Component
public class UserManager {
    
    @Autowired
    IFetchUser query;

    private ConcurrentMap<String, User> map = new ConcurrentHashMap<String, User>();
    
    public User getUser(String name){
        User user = map.get(name);
        if(user == null){
            //去库中查询
            user = query.queryFromDb(name);
            if(user != null){
                map.put(name, user);
            }
        }
        return user;
    }
    
    public void removeUser(String name){
        map.remove(name);
    }
}

 

Shiro的配置 

@Configuration
public class SysShiroConfiguration {

    
    @Bean
    public MemorySessionDAO memorySessionDAO(){
        MemorySessionDAO memorySessionDAO = new MemorySessionDAO();
        return memorySessionDAO;
    }
    
    @Bean
    public WebSessionManager webSessionManager(){
        DefaultWebSessionManager webSessionManager = new DefaultWebSessionManager();
        webSessionManager.setSessionDAO(memorySessionDAO());
        return webSessionManager;
    }
    
    @Bean
    public MemoryConstrainedCacheManager memoryConstrainedCacheManager(){
        MemoryConstrainedCacheManager cacheManager = new MemoryConstrainedCacheManager();
        return cacheManager;
    }
    
    //将自己的验证方式加入容器
    @Bean
    public CustomShiroRealm customShiroRealm() {
        CustomShiroRealm customShiroRealm = new CustomShiroRealm();
        return customShiroRealm;
    }

    //权限管理，配置主要是Realm的管理认证
    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(customShiroRealm());
        securityManager.setCacheManager(memoryConstrainedCacheManager());
        securityManager.setSessionManager(webSessionManager());
        return securityManager;
    }

    //Filter工厂，设置对应的过滤条件和跳转条件
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        Map<String,String> map = new HashMap<String, String>();
        //登出
//        map.put("/logout","logout");
//        map.put("/test/**","anon");
//        map.put("/pages/index.jsp","anon");
//        map.put("/index.jsp","anon");
//        map.put("/statics/**","anon");
        //对所有用户认证
        map.put("/**","anon");
        //登录
        shiroFilterFactoryBean.setLoginUrl("/login");
        //首页
        shiroFilterFactoryBean.setSuccessUrl("/home");
        //错误页面，认证不通过跳转
        shiroFilterFactoryBean.setUnauthorizedUrl("/error");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
        return shiroFilterFactoryBean;
    }
    
    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    @DependsOn({"lifecycleBeanPostProcessor"})
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    //加入注解的使用，不加入这个注解不生效
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }
}