总结之shiro(五)——过滤器、注解式、jsp标签控制

矫情吗；* 2022-04-22 00:10 114阅读 0赞

## 过滤器 ##

<table> 
 <thead> 
  <tr> 
   <th>过滤器简称</th> 
   <th>对应的java类</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>anon</td> 
   <td>org.apache.shiro.web.filter.authc.AnonymousFilter</td> 
  </tr> 
  <tr> 
   <td>authc</td> 
   <td>org.apache.shiro.web.filter.authc.FormAuthenticationFilter</td> 
  </tr> 
  <tr> 
   <td>authcBasic</td> 
   <td>org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter</td> 
  </tr> 
  <tr> 
   <td>perms</td> 
   <td>org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter</td> 
  </tr> 
  <tr> 
   <td>port</td> 
   <td>org.apache.shiro.web.filter.authz.PortFilter</td> 
  </tr> 
  <tr> 
   <td>rest</td> 
   <td>org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter</td> 
  </tr> 
  <tr> 
   <td>roles</td> 
   <td>org.apache.shiro.web.filter.authz.RolesAuthorizationFilter</td> 
  </tr> 
  <tr> 
   <td>ssl</td> 
   <td>org.apache.shiro.web.filter.authz.SslFilter</td> 
  </tr> 
  <tr> 
   <td>user</td> 
   <td>org.apache.shiro.web.filter.authc.UserFilter</td> 
  </tr> 
  <tr> 
   <td>logout</td> 
   <td>org.apache.shiro.web.filter.authc.LogoutFilter</td> 
  </tr> 
 </tbody> 
</table>

在spring-shiro.xml配置过滤器

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            <property name="securityManager" ref="securityManager"/>
            
            <property name="loginUrl" value="/toLogin"/>
            
            
            
            <property name="unauthorizedUrl" value="403.html" />
            <property name="filterChainDefinitions">
                <value>
                    
                    
                    /login.html = anon
                    /toLogin = anon
                    /testRole2=roles["admin"]
                    /testRole3=rolesOr["admin","admin1"]
                    /testPerms =perms[user:select]
                    /testPerms1 =perms["user:select","user:update"]
                    
                    
                    /** = authc
                </value>
            </property>
            <property name="filters">
                <util:map>
                    <entry key="rolesOr" value-ref="rolesOrFilter"/>
                </util:map>
            </property>
        </bean>

在过滤器中配路径，路径多会造成过滤器配置太繁琐了，可以使用注解

## 注解 ##

对controller开启AOP  
在springmvc.xml中配置shiro注解支持，可在controller方法中使用shiro注解配置权限

<aop:config proxy-target-class="true"/>
        <bean class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager"/>
        </bean>

### 权限注解控制 ###

*  @RequiresPermissions("")//权限
 *  @RequiresRoles()//角色

@RequestMapping(value = "/massages/{id}")
        @RequiresPermissions("massage:select")//该方法必须有massage:select权限才能访问
        public String findMassageById(@PathVariable Integer id,ModelMap modelMap){

## jsp标签控制 ##

Jsp页面添加：  
<%@ tagliburi=“[http://shiro.apache.org/tags][http_shiro.apache.org_tags]” prefix=“shiro” %>

<table> 
 <thead> 
  <tr> 
   <th>标签名称</th> 
   <th>标签条件（均是显示标签内容）</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>&lt;shiro:authenticated &gt;</td> 
   <td>登录之后</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:notAuthenticated &gt;</td> 
   <td>用户在没有RememberMe时</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:user &gt;</td> 
   <td>用户在RememberMe时</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:hasAnyRoles name=“abc,123” &gt;</td> 
   <td>在有abc或者123角色时</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:hasRole name=“abc”&gt;</td> 
   <td>拥有角色abc</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:lacksRole name=“abc”&gt;</td> 
   <td>没有角色abc</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:hasPermission name=“abc”&gt;</td> 
   <td>拥有权限资源abc</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:lacksPermission name=“abc”&gt;</td> 
   <td>没有abc权限资源</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:principal &gt;</td> 
   <td>显示用户身份名称</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:principal property=“username”/&gt;</td> 
   <td>显示用户身份中的属性值</td> 
  </tr> 
 </tbody> 
</table>

### jsp页面添加标签 ###

例：没有认证——出现注册、登录按钮

<shiro:notAuthenticated>
            <button >注册</button>
            <button >登录</button>
    </shiro:notAuthenticated>

[http_shiro.apache.org_tags]: http://shiro.apache.org/tags