Shiro 框架之登录访问创建session 时的源码解析

小咪咪 2022-09-04 09:43 165阅读 0赞

web项目中业务代码入口创建session,自定义Filter 的实现类

1、业务代码入口：

public class CheckSessionFilter implements Filter {
    
        Logger logger = LoggerFactory.getLogger(CheckSessionFilter.class);
        
    
        @Override
        public void init(FilterConfig filterConfig) {
        }
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
                             FilterChain filterChain) throws IOException {
            try {
                XSSRequestWrapper requestWrapper = new XSSRequestWrapper((HttpServletRequest) servletRequest);
                //核心实现代码
                Object userToken = requestWrapper.getSession().getAttribute(Constants.CONST_CAS_USER_TOKEN);
                String token = null == userToken ? null : String.valueOf(userToken);
    
                MDC.put("logId", UuidUtil.getShortUuid() + ((StringUtil.isNotBlank(token) && SysUserUtil.getUser() != null) ? "U" + SysUserUtil.getUserId() : ""));
                
                filterChain.doFilter(requestWrapper, servletResponse);
            } catch (Exception e) {
                logger.error("PrintLogFilter.e:", e);
                servletResponse.setCharacterEncoding("utf-8");
                servletResponse.getWriter().write(JSON.toJSON(R.error()).toString());
            } finally {
                MDC.clear();
            }
    
        }
    
        @Override
        public void destroy() {
        //暂时空实现
    
        }
    
    
    }

2、点击 requestWrapper.getSession() 进入：

public class HttpServletRequestWrapper extends ServletRequestWrapper implements
            HttpServletRequest

@Override
        public HttpSession getSession() {
            return this._getHttpServletRequest().getSession();//点击进入
        }

3、进入

public class ShiroHttpServletRequest extends HttpServletRequestWrapper

public HttpSession getSession() {
            return getSession(true);
        }

进入：

public HttpSession getSession(boolean create) {
    
            HttpSession httpSession;
    
            if (isHttpSessions()) {
                httpSession = super.getSession(false);
                if (httpSession == null && create) {
                    //Shiro 1.2: assert that creation is enabled (SHIRO-266):
                    if (WebUtils._isSessionCreationEnabled(this)) {
                        httpSession = super.getSession(create);
                    } else {
                        throw newNoSessionCreationException();
                    }
                }
            } else {
                if (this.session == null) {
    
                    //核心代码，点击进入
                    boolean existing = getSubject().getSession(false) != null;
    
                    Session shiroSession = getSubject().getSession(create);
                    if (shiroSession != null) {
                        this.session = new ShiroHttpSession(shiroSession, this, this.servletContext);
                        if (!existing) {
                            setAttribute(REFERENCED_SESSION_IS_NEW, Boolean.TRUE);
                        }
                    }
                }
                httpSession = this.session;
            }
    
            return httpSession;
        }

4、进入

public class DelegatingSubject implements Subject

显示：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70][]

进入if语句

public Session getSession(boolean create) {
            if (log.isTraceEnabled()) {
                log.trace("attempting to get session; create = " + create +
                        "; session is null = " + (this.session == null) +
                        "; session has id = " + (this.session != null && session.getId() != null));
            }
    
            if (this.session == null && create) {
    
                //added in 1.2:
                if (!isSessionCreationEnabled()) {
                    String msg = "Session creation has been disabled for the current subject.  This exception indicates " +
                            "that there is either a programming error (using a session when it should never be " +
                            "used) or that Shiro's configuration needs to be adjusted to allow Sessions to be created " +
                            "for the current Subject.  See the " + DisabledSessionException.class.getName() + " JavaDoc " +
                            "for more.";
                    throw new DisabledSessionException(msg);
                }
    
                log.trace("Starting session for host {}", getHost());
                SessionContext sessionContext = createSessionContext();
                Session session = this.securityManager.start(sessionContext);//核心代码
                this.session = decorate(session);
            }
            return this.session;
        }

5、点击进入：

public abstract class SessionsSecurityManager extends AuthorizingSecurityManager

public Session start(SessionContext context) throws AuthorizationException {
            return this.sessionManager.start(context);//进入
        }

6、进入：

public abstract class AbstractNativeSessionManager extends AbstractSessionManager implements NativeSessionManager, EventBusAware

public Session start(SessionContext context) {
            Session session = createSession(context);//进入
            applyGlobalSessionTimeout(session);
            onStart(session, context);
            notifyStart(session);
            //Don't expose the EIS-tier Session object to the client-tier:
            return createExposedSession(session, context);
        }

7、进入

public abstract class AbstractValidatingSessionManager extends AbstractNativeSessionManager
            implements ValidatingSessionManager, Destroyable

protected Session createSession(SessionContext context) throws AuthorizationException {
            enableSessionValidationIfNecessary();
            return doCreateSession(context);//点击进入
        }

8、进入

public class DefaultSessionManager extends AbstractValidatingSessionManager implements CacheManagerAware

protected Session doCreateSession(SessionContext context) {
            Session s = newSessionInstance(context);
            if (log.isTraceEnabled()) {
                log.trace("Creating session for host {}", s.getHost());
            }
            create(s);//点击
            return s;
        }

继续：

protected void create(Session session) {
            if (log.isDebugEnabled()) {
                log.debug("Creating new EIS record for new session instance [" + session + "]");
            }
            sessionDAO.create(session);//点击进入
        }

9、点击

public abstract class CachingSessionDAO extends AbstractSessionDAO implements CacheManagerAware

public Serializable create(Session session) {
            Serializable sessionId = super.create(session);//点击
            cache(session, sessionId);
            return sessionId;
        }

10、进入父类

public Serializable create(Session session) {
            Serializable sessionId = doCreate(session);//进入
            verifySessionId(sessionId);
            return sessionId;
        }

11、点击进入子类业务方法

// 创建session，并保存到数据库
        @Override
        protected Serializable doCreate(Session session) {
            Serializable sessionId = super.doCreate(session);
           
            redisTemplate.opsForValue().set(Contans.REDIS_SESSION_KEY + sessionId.toString(), session);
            return sessionId;
        }

12、创建后返回到

public abstract class AbstractNativeSessionManager extends AbstractSessionManager implements NativeSessionManager, EventBusAware

public Session start(SessionContext context) {
            Session session = createSession(context);
            applyGlobalSessionTimeout(session);//更新session失效时间
            onStart(session, context);
            notifyStart(session);
            //Don't expose the EIS-tier Session object to the client-tier:
            return createExposedSession(session, context);
        }

进入

protected void applyGlobalSessionTimeout(Session session) {
            session.setTimeout(getGlobalSessionTimeout());
            onChange(session);//进入
        }

13、进入

public class DefaultSessionManager extends AbstractValidatingSessionManager implements CacheManagerAware

protected void onChange(Session session) {
            sessionDAO.update(session);//进入
        }

14、进入

public abstract class CachingSessionDAO extends AbstractSessionDAO implements CacheManagerAware

public void update(Session session) throws UnknownSessionException {
            doUpdate(session);//进入业务方法
            if (session instanceof ValidatingSession) {
                if (((ValidatingSession) session).isValid()) {
                    cache(session, session.getId());
                } else {
                    uncache(session);
                }
            } else {
                cache(session, session.getId());
            }
        }

15、点击进入

// 更新session的最后一次访问时间
        @Override
        protected void doUpdate(Session session) {
            super.doUpdate(session);
            String key = Contans.REDIS_SESSION_KEY + session.getId().toString();
            redisTemplate.opsForValue().set(key, session);
            redisTemplate.expire(key, expireTime, TimeUnit.SECONDS);
        }

到此，这个业务Filter的实现类流程分析完毕，下一篇继续分析其他的过滤器，敬请期待！

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70]: /images/20220829/7a4ac3fbe8d94bab8b86587da203b4c7.png