shiro整合中登录的时候url地址栏带jsessionid的解决方式

﹏ヽ暗。殇╰゛Y 2022-02-25 18:15 1038阅读 0赞

###### 在shiro登录完成的时候，第一次或者重启项目之后访问系统时候 浏览器地址栏会出现后缀带jsessionid，如下图： ######

![在这里插入图片描述][20190402143732187.png]

#### 解决方式： ####

###### 1.web.xml ######

web.xml必须为3.0版本

<?xml version="1.0" encoding="UTF-8"?>  
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
        
        <session-config>
    	    <tracking-mode>COOKIE</tracking-mode>
    	</session-config>
    </web-app>

###### 2.新建MyShiroHttpServletResponse继承ShiroHttpServletResponse，重写其方法encodeRedirectURL和toEncoded ######

package com.zc.store.shiro;
    
    import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
    import org.apache.shiro.web.servlet.ShiroHttpServletResponse;
    
    import javax.servlet.ServletContext;
    import javax.servlet.http.HttpServletResponse;
    
    /** * * 类描述： 解决第一次登录时，url带jsessionid的问题 * 项目名称：store * 类名称：MyShiroHttpServletResponse * 创建人：ZLY * 创建时间：2019年4月2日 上午9:32:31 * 备注： */
    public class MyShiroHttpServletResponse extends ShiroHttpServletResponse { 
        public MyShiroHttpServletResponse(HttpServletResponse wrapped, ServletContext context, ShiroHttpServletRequest request) { 
            super(wrapped, context, request);
        }
    
        @Override
        public String encodeRedirectURL(String url){ 
            /** 下面是ShiroHttpServletResponse源码，重写shiro的encodeRedirectURL方法，把url路径里的JSESSIONID去掉 **/
    // if (isEncodeable(toAbsolute(url))) { 
    // return toEncoded(url, request.getSession().getId());
    // } else { 
    // return url;
    // }
            return url;
        }
        @Override
        protected String toEncoded(String url, String sessionId) { 
            if ((url == null) || (sessionId == null))
                return (url);
    
            String path = url;
            String query = "";
            String anchor = "";
            int question = url.indexOf('?');
            if (question >= 0) { 
                path = url.substring(0, question);
                query = url.substring(question);
            }
            int pound = path.indexOf('#');
            if (pound >= 0) { 
                anchor = path.substring(pound);
                path = path.substring(0, pound);
            }
            StringBuilder sb = new StringBuilder(path);
            /** 下面是ShiroHttpServletResponse源码，重写shiro的toEncoded方法使其不拼接JSESSIONID **/
    // if (sb.length() > 0) { // session id param can't be first.
    // sb.append(";");
    // sb.append(DEFAULT_SESSION_ID_PARAMETER_NAME);
    // sb.append("=");
    // sb.append(sessionId);
    // }
            sb.append(anchor);
            sb.append(query);
            return (sb.toString());
    
        }
    }

###### 3.新建MySpringShiroFilter继承AbstractShiroFilter ######

package com.zc.store.shiro;
    
    import org.apache.shiro.web.filter.mgt.FilterChainResolver;
    import org.apache.shiro.web.mgt.WebSecurityManager;
    import org.apache.shiro.web.servlet.AbstractShiroFilter;
    import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
    
    import javax.servlet.ServletResponse;
    import javax.servlet.http.HttpServletResponse;
    
    /** * * 类描述： 解决第一次登录时，url带jsessionid的问题 * 项目名称：store * 类名称：MySpringShiroFilter * 创建人：ZLY * 创建时间：2019年4月2日 上午9:34:00 * 备注： */
    public class MySpringShiroFilter extends AbstractShiroFilter { 
        protected MySpringShiroFilter(WebSecurityManager webSecurityManager, FilterChainResolver resolver) { 
            super();
            if (webSecurityManager == null) { 
                throw new IllegalArgumentException("WebSecurityManager property cannot be null.");
            }
            setSecurityManager(webSecurityManager);
            if (resolver != null) { 
                setFilterChainResolver(resolver);
            }
        }
    
        @Override
        protected ServletResponse wrapServletResponse(HttpServletResponse orig, ShiroHttpServletRequest request) { 
            return new MyShiroHttpServletResponse(orig, getServletContext(), request);
        }
    }

###### 4.新建MyShiroFilterFactoryBean继承ShiroFilterFactoryBean ######

package com.zc.store.shiro;
    
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.filter.mgt.FilterChainManager;
    import org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver;
    import org.apache.shiro.web.mgt.WebSecurityManager;
    import org.apache.shiro.web.servlet.AbstractShiroFilter;
    import org.springframework.beans.factory.BeanInitializationException;
    
    /** * * 类描述： 解决第一次登录时，url带jsessionid的问题 * 项目名称：store * 类名称：MyShiroFilterFactoryBean * 创建人：ZLY * 创建时间：2019年4月2日 上午9:34:41 * 备注： */
    public class MyShiroFilterFactoryBean extends ShiroFilterFactoryBean { 
        @Override
        public Class getObjectType() { 
            return MySpringShiroFilter.class;
        }
    
        @Override
        protected AbstractShiroFilter createInstance() throws Exception { 
    
            SecurityManager securityManager = getSecurityManager();
            if (securityManager == null) { 
                String msg = "SecurityManager property must be set.";
                throw new BeanInitializationException(msg);
            }
    
            if (!(securityManager instanceof WebSecurityManager)) { 
                String msg = "The security manager does not implement the WebSecurityManager interface.";
                throw new BeanInitializationException(msg);
            }
    
            FilterChainManager manager = createFilterChainManager();
    
            PathMatchingFilterChainResolver chainResolver = new PathMatchingFilterChainResolver();
            chainResolver.setFilterChainManager(manager);
    
            return new MySpringShiroFilter((WebSecurityManager) securityManager, chainResolver);
        }
    }

###### 5.修改shiro的配置文件, ######

注释掉的就是原有的，现在我们不用原有的，使用我们自己写好的，  
< bean id=“shiroFilter” class=“com.zc.store.shiro.MyShiroFilterFactoryBean”>

<bean id="shiroFilter" class="com.zc.store.shiro.MyShiroFilterFactoryBean">
    		
    	    <property name="securityManager" ref="securityManager"></property>
    	    
    	    <property name="loginUrl" value="/login"></property>	   
    	    
    	    <property name="unauthorizedUrl" value="/unauthorized.jsp"></property>
    	   	
    	   	<property name="filters">
    	   		<map>
    	   			
    	   			<entry key="kickout" value-ref="KickoutSessionControlFilter"/>
    	   		</map>
    	   	</property>
    	   		
    		
    		
    	    <property name="filterChainDefinitions">
    	    	<value>
    	            /js/**=anon
    				/css/**=anon
    				/images/**=anon
    				/skin/**=anon
    	           	/lib/**=anon
    	           	/model/**=anon
    	           	/WEB-INF/jsp/**=anon
    	           	/**/submitLogin=anon
    	           	/**/login=anon
    	           	/admin/**=authc
    	            /**=user,kickout
    	        </value>
    	    </property>
    	</bean>

##### 重新启动，第一次访问也不会再有 jsessionid了。 #####

[20190402143732187.png]: /images/20220225/87fd228c1e2243e9b809c8228a697ca1.png