JavaWeb|Springboot整合Shiro实现登录验证

<!--整合shiro-->
<dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-spring-boot-web-starter</artifactId>
   <version>1.4.0</version>
</dependency>

#1.第一行表示是否允许将sessionld 放到cookie 中
shiro.sessionManager.sessionIdCookieEnabled=true
#2第二行表示是否允许将sessionld 放到Url地址拦中
shiro.sessionManager.sessionIdUrlRewritingEnabled=true
#3.第三行表示访问未获授权的页面时，默认的跳转路径
shiro.unauthorizedUrl=/login
#4.第四行表示开启shiro
shiro.web.enabled=true
#5.第五行表示登录成功的跳转页面
shiro.successUrl=/index
#6.第六行表示登录页面
shiro.loginUrl=/doLogin

public class UserRealm extends AuthorizingRealm {
   @Autowired
   private StudentServiceImpl studentService;

    @Override
   protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
       return null;
    }
   @Override
   protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String username = authenticationToken.getPrincipal().toString();
        Optional<Student> studentOptional = studentService.findStudentBySno(username);
       if (studentOptional.isPresent()) {
            Student student = studentOptional.get();
           return new SimpleAuthenticationInfo(username, student.getPassword(), ByteSource.Util.bytes(username), getName());
}
       throw new UnknownAccountException("不存在");
    }
}

@Configuration
public class ShiroConfig {
   @Bean
   UserRealm userRealm() {
       return new UserRealm();
    }
   @Bean
   DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(userRealm());
       return defaultWebSecurityManager;
    }
   @Bean
   ShiroFilterChainDefinition shiroFilterChainDefinition() {
        DefaultShiroFilterChainDefinition defaultShiroFilterChainDefinition = new DefaultShiroFilterChainDefinition();
        defaultShiroFilterChainDefinition.addPathDefinition("/doLogin", "anon");
        defaultShiroFilterChainDefinition.addPathDefinition("/**", "authc");
       return defaultShiroFilterChainDefinition;
    }
}

@PostMapping("/doLogin")
public Result<Object> doLogin(@RequestBody UserToken userToken) {
    Subject subject = SecurityUtils.getSubject();
    String pwd = ShiroKit.mds(String.valueOf(userToken.getPassword()), userToken.getUsername());
    UsernamePasswordToken token = new UsernamePasswordToken(userToken.getUsername(), pwd);
    String sessionId = (String) subject.getSession().getId();
   try {
        subject.login(token);
        Map<String, String> map = new HashMap<String, String>();
        map.put("sessionId", sessionId);
        map.put("username", userToken.getUsername());
       return common.SUCCESS(map);
    } catch (Exception e) {
       return common.ERROR(codeEnum.getERR_PWD(), "用户名或密码错误", "");
    }
}

public class ShiroKit {
   public static String mds(String password, String salt) {
       return new Md5Hash(password, salt, 1).toHex();//  加密一次
    }
}

@GetMapping("/logout")
public Result logout() {
    SecurityUtils.getSubject().logout();
   return common.SUCCESS("");
}