<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring</artifactId><version>1.4.0</version>
</dependency>

@Configuration
public class Config {/*** 常用的过滤器:*  anon：无需认证就能访问 *  authc：必须认证了才能访问 user：必须拥有记住我功能才能访问 *  perms：拥有对每个资源的权限才能访问*  role：拥有某个角色权限才能访问* @return*/@Beanpublic ShiroFilterFactoryBean getShiroFilterFactoryBean() {ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();bean.setSecurityManager(securityManager());LinkedHashMap<String, String> filterMap = new LinkedHashMap<>();// 添加一个拦截器filterMap.put("/loginAction/login", "anon");//登录的话无需认证就能访问filterMap.put("/**", "authc");//拦截所有请求,有认证才能登录//这里没有启用授权过滤器,就是写个例子//filterMap.put("/user/add", "perms[user:add]");bean.setFilterChainDefinitionMap(filterMap);// 设置登录请求,这里是被拦截后回转的页面bean.setLoginUrl("/loginAction/loginError");// 设置未授权页面,这里是未授权跳转的页面,没有启动bean.setUnauthorizedUrl("/loginAction/noauth");return bean;}/*** 安全管理器* @return*/@Beanpublic DefaultWebSecurityManager securityManager() {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();securityManager.setSessionManager(sessionManager());securityManager.setRealm(userRealm());return securityManager;}@Beanpublic SessionManager sessionManager() {TokenSessionManager tokenSessionManager = new TokenSessionManager();return tokenSessionManager; }@Beanpublic UserRealm userRealm() {return new UserRealm();}
}接下来写UserRealm
public class UserRealm extends AuthorizingRealm {private final static Log _logger = LogFactory.getLog(UserRealm.class);@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {//这里是权限认证的地方,我项目中没有使用shiro的权限认证System.out.println("执行授权");SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();// info.addStringPermission("user:add");// 拿到当前登录的用户Subject subject = SecurityUtils.getSubject();UserCache currentUser = (UserCache) subject.getPrincipal();info.addStringPermission(currentUser.getOpId());return info;}@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {//subject.login(token);一定会到这里来,这里就是验证登录的地方UserCache user = new UserCache();user.setOpId("test");user.setUserPassword("1234");user.setUserName("test");UsernamePasswordToken userToken = (UsernamePasswordToken) token;//这里要判断用户名和密码了,通常是去数据库核对用户名和密码了if(!new String(userToken.getUsername()).equals(user.getUserName())) {//用户名错误throw new UnknownAccountException();}if (!new String(userToken.getPassword()).equals(user.getUserPassword())) {//密码错误throw new IncorrectCredentialsException(); }return new SimpleAuthenticationInfo(user, user.getUserPassword(), "");}}

public class TokenSessionManager extends DefaultWebSessionManager {private static final String TOKEN = "token";private static final String REFERENCED_SESSION_ID_SOURCE = "Stateless request";private final static Log _logger = LogFactory.getLog(TokenSessionManager.class);public TokenSessionManager() {super();}@Overridepublic Serializable getSessionId(ServletRequest request, ServletResponse response) {// String token = WebUtils.toHttp(request).getHeader(TOKEN);// 前端请求头必须传入token的值,把他的值当做是sessionIdif (!StringUtils.isEmpty(token)) {request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, token);request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);_logger.info("token=" + token);return token;} else {_logger.info("token为空");return null;// 否则按默认规则从cookie取sessionId//return super.getSessionId(request, response);}}
}

@RequestMapping(value = "/loginError", produces = "application/json; charset=utf-8")@ResponseBodypublic String loginError(@RequestHeader("token") String token) {return "hello world loginError; token = " + token;}

@RequestMapping(value = "/userTest", produces = "application/json; charset=utf-8")@ResponseBodypublic String userTest() {return "hello world Test";}

@RequestMapping(value = "/login", produces = "application/json; charset=utf-8")@ResponseBodypublic String login(String username, String password, HttpServletRequest request) {// 获取当前的用户Subject subject = SecurityUtils.getSubject();// 封装用户的登录数据UsernamePasswordToken userToken = new UsernamePasswordToken(username, password);try {subject.login(userToken);UserCache user = (UserCache) subject.getPrincipal();System.out.println(user.getOpId());String token = _jwtTokenUtil.createToken(getJSON(user));return "登录成功token=" + token;} catch (UnknownAccountException e) {return "用户名错误";} catch (IncorrectCredentialsException e) {return "密码错误";}}