shiro基于cookie多服务器共享session，坑记录

港控/mmm° 2022-05-14 00:24 183阅读 0赞

**目的**：基于cookie和rememberMe来实现多服务器共享登陆session方案。

**问题描述**：

cacheManager、sessionManager、rememberMeManager各种都配置好了，死活共享不了session  
（我的检查方法：两台服务器，启动其中一台后登陆，然后关闭启动另一台，看登陆效果）  
！！！罪魁祸首是【filterChainDefinitions】配置中**/\*\* = authc**改为**/\*\* = user** ，解决问题……（捣鼓半天XXOOO）

**权限规则区别**：

anno，任何人都可以访问；

authc：必须是登录之后才能进行访问，**不包括remember me**；（这种比较严格的，一般用于支付）

user：登录用户才可以访问，包含remember me；

spring-shiro.xml如下：

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd"
           default-lazy-init="true">
    
        <description>Shiro安全配置</description>
    
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            
            <property name="realm" ref="shiroDbRealm"/>
            
            <property name="cacheManager" ref="shiroCacheManager"/>
            
            
            <property name="sessionManager" ref="sessionManager"/>
            
            <property name="rememberMeManager" ref="rememberMeManager"/>
        </bean>
    
        
        
        <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
            <property name="cipherKey"
                      value="#{T(org.apache.shiro.codec.Base64).decode('0ooHuCiTA46LHOdJKHdLAg==')}"/>
            <property name="cookie" ref="sharesession"/>
        </bean>
        <bean id="sharesession" class="org.apache.shiro.web.servlet.SimpleCookie">
            <constructor-arg value="rememberMe"/>
            <property name="domain" value=""/>
            <property name="path" value="/"/>
            <property name="httpOnly" value="true"/>
            <property name="maxAge" value="36000"/>
        </bean>
    
        
        <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
            
            <property name="globalSessionTimeout" value="3600000"/>
    
            <property name="sessionValidationSchedulerEnabled" value="true"/>
            <property name="sessionDAO" ref="shiroSessionDao"/>
            <property name="sessionIdCookie" ref="sessionIdCookie"/>
            
            
    
            
        </bean>
    
    
        
        <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
            <constructor-arg value="adminjsid"/>
            <property name="domain" value=""/>
            <property name="path" value="/"/>
            <property name="httpOnly" value="true"/>
            
            <property name="maxAge" value="-1"/>
        </bean>
    
        
        <bean id="shiroSessionDao"
              class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO"/>
    
        
        <bean id="shiroDbRealm" class="com.betawoo.admin.commons.shiro.ShiroDbRealm"/>
    
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            
            <property name="securityManager" ref="securityManager"/>
            
            <property name="loginUrl" value="/login"/>
            
            <property name="successUrl" value="/index"/>
            
            <property name="unauthorizedUrl" value="/unauth"/>
            <property name="filterChainDefinitions">
                <value>
                    /commons/** = anon 
                    /static/** = anon
                    /login = anon
                    /** = user
                    
                </value>
            </property>
        </bean>
    
        
        <bean id="shiroCacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"/>
    
        
        
    
        
        <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
            <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
            <property name="arguments" ref="securityManager"/>
        </bean>
    
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
        
        <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
              depends-on="lifecycleBeanPostProcessor"/>
    
        
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager"/>
        </bean>
    </beans>