1.前言
当决定前端与后端代码分开部署时，发现shiro自带的session不起作用了。
然后通过对请求head的分析，然后在网上查找一部分解决方案。
最终就是，登录成功之后，前端接收到后端传回来的sessionId，存入cookie当中。
之后，前端向后端发送请求时，请求Head中都会带上这个sessionid。
后端代码通过对这个sessionid的解析，拿到正确的session。
2.代码改造
（1）后端代码改造
-
添加CustomSessionManager.java
1/** 2 * 类的详细说明 3 * 4 * @author 郭广明 5 * @version 1.0 6 * @Date 2018/11/3014:56 7 */ 8public class CustomSessionManager extends DefaultWebSessionManager { 9 10 /** 11 * 获取请求头中key为“Authorization”的value == sessionId 12 */ 13 private static final String AUTHORIZATION ="Authorization"; 14 15 private static final String REFERENCED_SESSION_ID_SOURCE = "cookie"; 16 17 /** 18 * @Description shiro框架 自定义session获取方式<br/> 19 * 可自定义session获取规则。这里采用ajax请求头 {@link AUTHORIZATION}携带sessionId的方式 20 */ 21 @Override 22 protected Serializable getSessionId(ServletRequest request, ServletResponse response) { 23 // TODO Auto-generated method stub 24 String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATION); 25 if (StringUtils.isNotEmpty(sessionId)) { 26 request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE); 27 request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId); 28 request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE); 29 return sessionId; 30 } 31 return super.getSessionId(request, response); 32 } 33 34} -
改造ShiroConfig.java
1@Configuration 2public class ShiroConfig { 3 4 @Autowired 5 private UserService userService; 6 7 @Bean 8 public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) { 9 ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); 10 11 // 必须设置 SecurityManager 12 shiroFilterFactoryBean.setSecurityManager(securityManager); 13 14 // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面 15 shiroFilterFactoryBean.setLoginUrl("/login"); 16 17 // 拦截器. 18 Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); 19 // 配置不会被拦截的链接 顺序判断 20 filterChainDefinitionMap.put("/static/**", "anon"); 21 filterChainDefinitionMap.put("/doLogin", "anon"); 22 filterChainDefinitionMap.put("/swagger-resources", "anon"); 23 filterChainDefinitionMap.put("/v2/api-docs", "anon"); 24 filterChainDefinitionMap.put("/webjars/**", "anon"); 25 filterChainDefinitionMap.put("/swagger-ui.html", "anon"); 26 27 // <!-- 过滤链定义，从上向下顺序执行，一般将 /**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了; 28 // <!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问--> 29 filterChainDefinitionMap.put("/**", "anon"); 30 31 shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap); 32 System.out.println("Shiro拦截器工厂类注入成功"); 33 return shiroFilterFactoryBean; 34 } 35 36 /** 37 * 注入MyRealm 38 * @return 39 */ 40 @Bean 41 public SecurityManager securityManager() { 42 DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); 43 // 设置realm. 44 securityManager.setSessionManager(sessionManager()); 45 securityManager.setRealm(myShiroRealm()); 46 return securityManager; 47 } 48 49 /** 50 * 配置注解 51 * @param securityManager 52 * @return 53 */ 54 @Bean 55 public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { 56 AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor 57 = new AuthorizationAttributeSourceAdvisor(); 58 authorizationAttributeSourceAdvisor.setSecurityManager(securityManager); 59 return authorizationAttributeSourceAdvisor; 60 } 61 62 @Bean 63 public MyRealm myShiroRealm() { 64 return new MyRealm(userService); 65 } 66 67 @Bean("sessionManager") 68 public SessionManager sessionManager(){ 69 CustomSessionManager manager = new CustomSessionManager(); 70 /*使用了shiro自带缓存， 71 如果设置 redis为缓存需要重写CacheManager（其中需要重写Cache） 72 manager.setCacheManager(this.RedisCacheManager());*/ 73 74 manager.setSessionDAO(new EnterpriseCacheSessionDAO()); 75 return manager; 76 } 77 78}
（2）前端代码改造
-
添加CookieUtil.js
1export default { 2 setCookie: (name,value,days) =>{ 3 var d = new Date; 4 d.setTime(d.getTime() + 24*60*60*1000*days); 5 window.document.cookie = name + "=" + value + ";path=/;expires=" + d.toGMTString(); 6 }, 7 getCookie: name =>{ 8 var v = window.document.cookie.match('(^|;) ?' + name + '=([^;]*)(;|$)'); 9 return v ? v[2] : null; 10 }, 11 delCookie: name =>{ 12 this.setCookie(name, '', -1); //将时间设置为过去时，立即删除cookie 13 } 14 15} -
改造HttpUtil.js
1import axios from 'axios' 2import doCookie from '@/util/cookieUtil' 3 4axios.defaults.headers.common['Authorization'] = doCookie.getCookie("SESSIONID") 5axios.defaults.baseURL = 'http://127.0.0.1:8080' 6 7 8/** 9 * Get请求 10 */ 11export function get(url, callback){ 12 axios.get(url) 13 .then(function (response) { 14 if(response.data.length==0 || response.data==null) { 15 callback(null,true) 16 } else { 17 callback(response.data,true) 18 } 19 }) 20 .catch(function (error) { 21 callback(null,false) 22 }) 23} 24 25export function remove(url, callback){ 26 axios.delete(url) 27 .then(function (response) { 28 if(response.data.length==0 || response.data==null) { 29 callback(null,true) 30 } else { 31 callback(response.data,true) 32 } 33 }) 34 .catch(function (error) { 35 callback(null,false) 36 }) 37} 38 39export function post(url, data, callback){ 40 axios.post(url,data) 41 .then(function (response) { 42 if(response.data.length==0 || response.data==null) { 43 callback(null,true) 44 } else { 45 callback(response.data,true) 46 } 47 }) 48 .catch(function (error) { 49 callback(null,false) 50 }) 51} 52 53export function put(url, data, callback){ 54 axios.put(url,data) 55 .then(function (response) { 56 if(response.data.length==0 || response.data==null) { 57 callback(null,true) 58 } else { 59 callback(response.data,true) 60 } 61 }) 62 .catch(function (error) { 63 callback(null,false) 64 }) 65} 66 67 68export default { 69 get, 70 post, 71 put, 72 remove, 73}