springmvc拦截器实现登录验证
首先创建一个实体类：
Customer：
1 package com.petcare.pojo.base; 2 3 import java.sql.Date; 4 import java.sql.Timestamp; 5 6 /** 7 * Created by frank on 2017/5/7. 8 */ 9 10 public class Customer { 11 private Long customerId; 12 private String account; 13 private String passwd; 14 private String customerName; 15 private String wechat; 16 private String mobile; 17 18 public Long getCustomerId() { 19 return customerId; 20 } 21 public void setCustomerId(Long customerId) { 22 this.customerId = customerId; 23 } 24 public String getAccount() { 25 return account; 26 } 27 public void setAccount(String account) { 28 this.account = account; 29 } 30 public String getPasswd() { 31 return passwd; 32 } 33 public void setPasswd(String passwd) { 34 this.passwd = passwd; 35 } 36 public String getCustomerName() { 37 return customerName; 38 } 39 public void setCustomerName(String customerName) { 40 this.customerName = customerName; 41 } 42 public String getWechat() { 43 return wechat; 44 } 45 public void setWechat(String wechat) { 46 this.wechat = wechat; 47 } 48 public String getMobile() { 49 return mobile; 50 } 51 public void setMobile(String mobile) { 52 this.mobile = mobile; 53 } 54 55 @Override 56 public boolean equals(Object o) { 57 if (this == o) return true; 58 if (o == null || getClass() != o.getClass()) return false; 59 60 Customer customer = (Customer) o; 61 62 if (customerId != customer.customerId) return false; 63 if (account != null ? !account.equals(customer.account) : customer.account != null) return false; 64 if (passwd != null ? !passwd.equals(customer.passwd) : customer.passwd != null) return false; 65 if (customerName != null ? !customerName.equals(customer.customerName) : customer.customerName != null) 66 return false; 67 if (wechat != null ? !wechat.equals(customer.wechat) : customer.wechat != null) return false; 68 if (mobile != null ? !mobile.equals(customer.mobile) : customer.mobile != null) return false; 69 if (homephone != null ? !homephone.equals(customer.homephone) : customer.homephone != null) return false; 70 if (customerSex != null ? !customerSex.equals(customer.customerSex) : customer.customerSex != null) 71 return false; 72 if (customerBirth != null ? !customerBirth.equals(customer.customerBirth) : customer.customerBirth != null) 73 return false; 74 if (address != null ? !address.equals(customer.address) : customer.address != null) return false; 75 if (createSeid != null ? !createSeid.equals(customer.createSeid) : customer.createSeid != null) return false; 76 if (createTime != null ? !createTime.equals(customer.createTime) : customer.createTime != null) return false; 77 if (updateTime != null ? !updateTime.equals(customer.updateTime) : customer.updateTime != null) return false; 78 79 return true; 80 } 81 82 @Override 83 public int hashCode() { 84 int result = (int) (customerId ^ (customerId >>> 32)); 85 result = 31 * result + (account != null ? account.hashCode() : 0); 86 result = 31 * result + (passwd != null ? passwd.hashCode() : 0); 87 result = 31 * result + (customerName != null ? customerName.hashCode() : 0); 88 result = 31 * result + (wechat != null ? wechat.hashCode() : 0); 89 result = 31 * result + (mobile != null ? mobile.hashCode() : 0); 90 result = 31 * result + (homephone != null ? homephone.hashCode() : 0); 91 result = 31 * result + (customerSex != null ? customerSex.hashCode() : 0); 92 result = 31 * result + (customerBirth != null ? customerBirth.hashCode() : 0); 93 result = 31 * result + (address != null ? address.hashCode() : 0); 94 result = 31 * result + (createSeid != null ? createSeid.hashCode() : 0); 95 result = 31 * result + (createTime != null ? createTime.hashCode() : 0); 96 result = 31 * result + (updateTime != null ? updateTime.hashCode() : 0); 97 return result; 98 } 99 }
controller层;
1 @Controller 2 public class LoginController { 3 4 private Logger log = LoggerFactory.getLogger(getClass()); 5 6 public static final AjaxResponse ACCOUNT_NOT_EXIST = new AjaxResponse(-100101, "账号不存在"); 7 public static final AjaxResponse PASSWORD_NOT_PASSED = new AjaxResponse(-100102, "您输入密码错误"); 8 public static final AjaxResponse SYSTEM_BUSY = new AjaxResponse(-100000, "系统繁忙"); 9 public static final AjaxResponse ACCOUNT_LOCKED = new AjaxResponse(-100103, "您的帐号被锁定"); 10 11 12 @Autowired 13 private CustomerService customerService; 14 15 @RequestMapping(value = "/login", method = RequestMethod.GET) 16 public String loginPage(){ 17 return "/login"; 18 } 19 20 @RequestMapping(value = "/login", method = RequestMethod.POST) 21 @ResponseBody 22 public AjaxResponse login(String u , String p, HttpSession session){ 23 24 // 封装令牌 25 UsernamePasswordToken token = new UsernamePasswordToken(u,p); 26 Subject subject = null; 27 try { 28 subject = SecurityUtils.getSubject(); 29 // 用令牌登陆,如果登陆失败，则抛出异常 30 subject.login(token); 31 token.clear(); 32 } catch (AccountNotExistException ex) { 33 return ACCOUNT_NOT_EXIST; 34 } catch (PasswordWrongException ex) { 35 return PASSWORD_NOT_PASSED; 36 } 37 catch (AccountLockedException ex) { 38 return ACCOUNT_LOCKED; 39 } 40 catch (Exception ex) { 41 log.error("login error happend.", ex); 42 return SYSTEM_BUSY; 43 } 44 45 Customer c = customerService.getBaseCustomer(u); 46 47 // 保存会话 48 session.setAttribute(Const.SESSION_SUBJECT, subject); // shiro已登录用户 49 session.setAttribute(Const.SESSION_USER_KEY,c );// 登陆用户 50 return AjaxResponse.OK; 51 52 } 53 }
UsernamePasswordToken源码：
package org.apache.shiro.authc; /** * Constructs a new UsernamePasswordToken encapsulating the username and password submitted * during an authentication attempt, with a <tt>null</tt> {@link #getHost() host} and a * <tt>rememberMe</tt> default of <tt>false</tt>. * * @param username the username submitted for authentication * @param password the password character array submitted for authentication */ public UsernamePasswordToken(final String username, final char[] password) { this(username, password, false, null); } /** * Constructs a new UsernamePasswordToken encapsulating the username and password submitted * during an authentication attempt, with a <tt>null</tt> {@link #getHost() host} and * a <tt>rememberMe</tt> default of <tt>false</tt> * <p/> * <p>This is a convience constructor and maintains the password internally via a character * array, i.e. <tt>password.toCharArray();</tt>. Note that storing a password as a String * in your code could have possible security implications as noted in the class JavaDoc.</p> * * @param username the username submitted for authentication * @param password the password string submitted for authentication */ public UsernamePasswordToken(final String username, final String password) { this(username, password != null ? password.toCharArray() : null, false, null); }
getSubject()源码：
1 package org.apache.shiro; 2 3 import org.apache.shiro.mgt.SecurityManager; 4 import org.apache.shiro.subject.Subject; 5 import org.apache.shiro.util.ThreadContext; 6 7 8 /** 9 * Accesses the currently accessible {@code Subject} for the calling code depending on runtime environment. 10 * 11 * @since 0.2 12 */ 13 public abstract class SecurityUtils { 14 15 /** 16 * ONLY used as a 'backup' in VM Singleton environments (that is, standalone environments), since the 17 * ThreadContext should always be the primary source for Subject instances when possible. 18 */ 19 private static SecurityManager securityManager; 20 21 /** 22 * Returns the currently accessible {@code Subject} available to the calling code depending on 23 * runtime environment. 24 * <p/> 25 * This method is provided as a way of obtaining a {@code Subject} without having to resort to 26 * implementation-specific methods. It also allows the Shiro team to change the underlying implementation of 27 * this method in the future depending on requirements/updates without affecting your code that uses it. 28 * 29 * @return the currently accessible {@code Subject} accessible to the calling code. 30 * @throws IllegalStateException if no {@link Subject Subject} instance or 31 * {@link SecurityManager SecurityManager} instance is available with which to obtain 32 * a {@code Subject}, which which is considered an invalid application configuration 33 * - a Subject should <em>always</em> be available to the caller. 34 */ 35 public static Subject getSubject() { 36 Subject subject = ThreadContext.getSubject(); 37 if (subject == null) { 38 subject = (new Subject.Builder()).buildSubject(); 39 ThreadContext.bind(subject); 40 } 41 return subject; 42 } 43 }
login源码：
1 /** 2 * Performs a login attempt for this Subject/user. If unsuccessful, 3 * an {@link AuthenticationException} is thrown, the subclass of which identifies why the attempt failed. 4 * If successful, the account data associated with the submitted principals/credentials will be 5 * associated with this {@code Subject} and the method will return quietly. 6 * <p/> 7 * Upon returning quietly, this {@code Subject} instance can be considered 8 * authenticated and {@link #getPrincipal() getPrincipal()} will be non-null and 9 * {@link #isAuthenticated() isAuthenticated()} will be {@code true}. 10 * 11 * @param token the token encapsulating the subject's principals and credentials to be passed to the 12 * Authentication subsystem for verification. 13 * @throws org.apache.shiro.authc.AuthenticationException 14 * if the authentication attempt fails. 15 * @since 0.9 16 */ 17 void login(AuthenticationToken token) throws AuthenticationException;
clear源码：
1 /*-------------------------------------------- 2 | M E T H O D S | 3 ============================================*/ 4 5 /** 6 * Clears out (nulls) the username, password, rememberMe, and inetAddress. The password bytes are explicitly set to 7 * <tt>0x00</tt> before nulling to eliminate the possibility of memory access at a later time. 8 */ 9 public void clear() { 10 this.username = null; 11 this.host = null; 12 this.rememberMe = false; 13 14 if (this.password != null) { 15 for (int i = 0; i < password.length; i++) { 16 this.password[i] = 0x00; 17 } 18 this.password = null; 19 } 20 21 }
四个异常类，此时产生一个疑问，怎么验证数据那，此时需要一个配置我文件spring-shiro：
1 <?xml version="1.0" encoding="UTF-8"?> 2 <beans xmlns="http://www.springframework.org/schema/beans" 3 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jee="http://www.springframework.org/schema/jee" 4 xmlns:tx="http://www.springframework.org/schema/tx" xmlns:util="http://www.springframework.org/schema/util" 5 xmlns:context="http://www.springframework.org/schema/context" 6 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd" 7 default-lazy-init="true"> 8 9 <!-- 安全管理器 --> 10 <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> 11 <property name="realm" ref="shiroDBRealm" /> 12 <!--<property name="cacheManager" ref="cacheManager" />--> 13 </bean> 14 <!--<bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />--> 15 16 <!-- shiro过滤器 --> 17 <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> 18 <property name="securityManager" ref="securityManager" /> 19 <property name="loginUrl" value="/login.action" /> 20 <property name="successUrl" value="/welcome.action" /> 21 <property name="unauthorizedUrl" value="/login.action" /> 22 <property name="filterChainDefinitions"> 23 <value> 24 </value> 25 </property> 26 </bean> 27 <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /> 28 29 <!-- 验证数据类 --> 30 <bean id="shiroDBRealm" class="com.petcare.admin.security.shiro.ShiroDBRealm" /> 31 32 </beans>
类shiroDBRealm：
1 /** 2 * Specl.com Inc. 3 * Copyright (c) 2010-2011 All Rights Reserved. 4 */ 5 package com.petcare.admin.security.shiro; 6 7 import com.petcare.admin.service.CustomerService; 8 import com.petcare.pojo.base.Customer; 9 import org.apache.commons.lang.StringUtils; 10 import org.apache.shiro.authc.*; 11 import org.apache.shiro.authz.AuthorizationInfo; 12 import org.apache.shiro.authz.SimpleAuthorizationInfo; 13 import org.apache.shiro.realm.AuthorizingRealm; 14 import org.apache.shiro.subject.PrincipalCollection; 15 import org.slf4j.Logger; 16 import org.slf4j.LoggerFactory; 17 18 import javax.annotation.Resource; 19 20 21 22 /** 23 * 权限数据访问类。 24 * 25 * 26 */ 27 public class ShiroDBRealm extends AuthorizingRealm { 28 29 private Logger log = LoggerFactory.getLogger(this.getClass()); 30 31 /** 32 * 账号访问层。 33 */ 34 @Resource 35 private CustomerService customerService; 36 37 /** 38 * 认证方法。 39 */ 40 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException { 41 42 log.debug("do authentication ，token data [{}]", authcToken); 43 44 UsernamePasswordToken token = (UsernamePasswordToken) authcToken; 45 46 if (token.getUsername() == null) { 47 return null; 48 } 49 50 // 根据账户名获得账户 51 Customer customer = customerService.getBaseCustomer(token.getUsername()); 52 53 // 当账号密码不存在 54 if (customer == null) { 55 log.debug("customer not exist."); 56 throw new AccountNotExistException(); 57 } 58 59 // 当密码错误 60 if (!StringUtils.equals(customer.getPasswd(), new String(token.getPassword()))) { 61 log.debug("password not equals."); 62 throw new PasswordWrongException(); 63 } 64 65 // if(customer.getIsDelete()==1) { 66 // log.debug("customer is locked."); 67 // throw new AccountLockedException(); 68 // } 69 return new SimpleAuthenticationInfo(customer.getAccount(), customer.getPasswd(), getName()); 70 } 71 72 /** 73 * 授权方法。 74 */ 75 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { 76 77 log.debug("do authortization , principals data [{}]", principals); 78 79 // String username = (String) principals.fromRealm(getName()).iterator().next(); 80 // 81 // // 根据账户名获得账户 82 // CustomerAccount account = customerAccountDao.getAccountByUsername(username); 83 // 84 // if (account == null) { 85 // log.debug("account not exist."); 86 // throw new AccountNotExistException(); 87 // } 88 89 // 封装授权信息 90 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); 91 // 将用户的角色字符，进行授权 92 // info.addRoles(account.getRoleStringList()); 93 // 将用户的权限字符，进行授权 94 // info.addStringPermissions(account.getPermissionStringList()); 95 return info; 96 } 97 }
web.xml:
有待修改：
1 <!-- listeners --> 2 <listener> 3 <listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class> 4 </listener> 5 <listener> 6 <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> 7 </listener> 8 9 10 <!-- shiro,find spring bean by filter name is 'shiroFilter' --> 11 <filter> 12 <filter-name>shiroFilter</filter-name> 13 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 14 <init-param> 15 <param-name>targetFilterLifecycle</param-name> 16 <param-value>true</param-value> 17 </init-param> 18 </filter>
