Shiro未登录时请求跳转问题

比眉伴天荒 2022-09-16 12:18 242阅读 0赞

问题：未登录时浏览器发送的请求都会重定向，导致前端无法捕捉重定向后的消息。

原因：FormAuthenticationFilter.onAccessDenied()中做的重定向

解决：继承FormAuthenticationFilter，重写onAccessDenied方法,在config中配置filter

import com.alibaba.fastjson.JSONObject;
    import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.http.HttpStatus;
    import org.springframework.web.bind.annotation.RequestMethod;
    
    import javax.servlet.ServletRequest;
    import javax.servlet.ServletResponse;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.PrintWriter;
    
    /**
     * @description:
     * @author: bgq
     * @create: 2021/10/19 10:51
     */
    public class ShiroFormAuthenticationFilter extends FormAuthenticationFilter {
        private static final Logger log = LoggerFactory.getLogger(ShiroFormAuthenticationFilter.class);
    
        @Override
        protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
            if (this.isLoginRequest(request, response)) {
                if (this.isLoginSubmission(request, response)) {
                    if (log.isTraceEnabled()) {
                        log.trace("Login submission detected.  Attempting to execute login.");
                    }
    
                    return this.executeLogin(request, response);
                } else {
                    if (log.isTraceEnabled()) {
                        log.trace("Login page view.");
                    }
    
                    return true;
                }
            } else {
                HttpServletRequest req = (HttpServletRequest)request;
                HttpServletResponse resp = (HttpServletResponse)response;
                if (req.getMethod().equals(RequestMethod.OPTIONS.name())) {
                    resp.setStatus(HttpStatus.OK.value());
                    return true;
                } else {
                    if (log.isTraceEnabled()) {
                        log.trace("Attempting to access a path which requires authentication.  Forwarding to the Authentication url [{}]" ,this.getLoginUrl());
                    }
                    /**
                     * 在这里实现自己想返回的信息，其他地方和源码一样就可以了
                     */
                    resp.setHeader("Access-Control-Allow-Origin", req.getHeader("Origin"));
                    resp.setHeader("Access-Control-Allow-Credentials", "true");
                    resp.setContentType("application/json; charset=utf-8");
                    resp.setCharacterEncoding("UTF-8");
                    PrintWriter out = resp.getWriter();
                    JSONObject result = new JSONObject();
                    result.put("code",403);
                    result.put("msg","未登录");
                    out.println(result);
                    out.flush();
                    out.close();
                    return false;
                }
            }
        }
    
    }

@Configuration
    public class ShiroConfig { 
    /**
         * Shiro基础配置
         *
         * @Author bgq
         * @CreateTime 2021/5/06 8:42
         */
        @Bean
        public ShiroFilterFactoryBean shiroFilterFactory(SecurityManager securityManager) {
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
            // 注意过滤器配置顺序不能颠倒
            // 配置过滤:不会被拦截的链接
            filterChainDefinitionMap.put("/login/**", "anon");
            filterChainDefinitionMap.put("/**", "authc");
            // 配置shiro默认登录界面地址，前后端分离中登录界面跳转应由前端路由控制，后台仅返回json数据
    //        shiroFilterFactoryBean.setLoginUrl("/login/unauth");
            LinkedHashMap<String, Filter> filtsMap = new LinkedHashMap<>();
            // 这里使用自定义的filter
            filtsMap.put("authc", new ShiroFormAuthenticationFilter());
            shiroFilterFactoryBean.setFilters(filtsMap);
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
            return shiroFilterFactoryBean;
        }
    }