Skip to content

Commit 1c7fbe4

Browse files
nineyanineya
committed
添加注释
1 parent 9fe53bd commit 1c7fbe4

12 files changed

Lines changed: 90 additions & 91 deletions

File tree

‎pom.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>com.nineya.study</groupId>
8+
<artifactId>framework-study</artifactId>
9+
<packaging>pom</packaging>
10+
<version>1.0-SNAPSHOT</version>
11+
<modules>
12+
<module>shiro-study</module>
13+
</modules>
14+
15+
</project>

‎shiro-study/src/main/java/com/nineya/shiro/ShiroApplication.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
/**
77
* @author 殇雪话诀别
88
* 2021/2/15
9+
* 程序入口
910
*/
1011
@SpringBootApplication
1112
public class ShiroApplication {
1213
public static void main(String[] args) {
1314
SpringApplication.run(ShiroApplication.class);
1415
}
15-
1616
}

‎shiro-study/src/main/java/com/nineya/shiro/config/ShiroConfiguration.java‎

Lines changed: 35 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,90 +1,80 @@
11
package com.nineya.shiro.config;
22

33
import com.nineya.shiro.filter.TokenFilter;
4-
import org.apache.shiro.SecurityUtils;
5-
import org.apache.shiro.cache.MemoryConstrainedCacheManager;
6-
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
7-
import org.apache.shiro.mgt.DefaultSubjectDAO;
84
import org.apache.shiro.mgt.SecurityManager;
95
import org.apache.shiro.realm.Realm;
10-
import org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration;
11-
import org.apache.shiro.spring.config.ShiroBeanConfiguration;
126
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
137
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
14-
import org.apache.shiro.spring.web.config.*;
15-
import org.apache.shiro.subject.Subject;
168
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
179
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
18-
import org.springframework.boot.autoconfigure.cache.RedisCacheManagerBuilderCustomizer;
19-
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
2010
import org.springframework.context.annotation.Bean;
2111
import org.springframework.context.annotation.Configuration;
22-
import org.springframework.context.annotation.Import;
23-
import org.springframework.web.bind.annotation.ModelAttribute;
2412

2513
import javax.servlet.Filter;
26-
import java.util.Collections;
2714
import java.util.HashMap;
2815
import java.util.Map;
2916

3017
/**
3118
* @author 殇雪话诀别
3219
* 2021/2/15
20+
* 配置类
3321
*/
3422
@Configuration
3523
public class ShiroConfiguration {
3624

25+
/**
26+
* 配置代理，没有配置将会导致注解不生效
27+
* @return
28+
*/
3729
@Bean
3830
public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
3931
DefaultAdvisorAutoProxyCreator defaultAAP = new DefaultAdvisorAutoProxyCreator();
4032
defaultAAP.setProxyTargetClass(true);
4133
return defaultAAP;
4234
}
4335

36+
/**
37+
* 配置代理，没有配置将会导致注解不生效
38+
* @return
39+
*/
4440
@Bean
4541
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
4642
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
4743
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
4844
return authorizationAttributeSourceAdvisor;
4945
}
5046

51-
//将自己的验证方式加入容器
47+
/**
48+
* 将自己的验证方式加入容器
49+
* @return
50+
*/
5251
@Bean
53-
public Realm myShiroRealm() {
54-
StudyRealm customRealm = new StudyRealm();
55-
return customRealm;
52+
public Realm studyRealm() {
53+
StudyRealm studyRealm = new StudyRealm();
54+
return studyRealm;
5655
}
5756

58-
// @Bean
59-
// public ShiroFilterChainDefinition shiroFilterChainDefinition() {
60-
// DefaultShiroFilterChainDefinition chainDefinition = new DefaultShiroFilterChainDefinition();
61-
//
62-
// // 其实等同于注解的权限控制
63-
// chainDefinition.addPathDefinition("/admin", "authc, roles[read,write]");
64-
// chainDefinition.addPathDefinition("/index", "authc, perms[select]");
65-
// // 不允许管理员的create权限
66-
// chainDefinition.addPathDefinition("/add", "authc, perms[user:create]");
67-
//
68-
// // 对所有用户认证
69-
// chainDefinition.addPathDefinition("/**", "authc");
70-
//
71-
// return chainDefinition;
72-
// }
73-
74-
// @Bean
75-
// public TokenFilter tokenFilter() {
76-
// return new TokenFilter();
77-
// }
57+
/**
58+
* 不应该将过滤器的实现注册为bean，否则会导致Filter过滤器顺序混乱，导致抛出异常
59+
* 如果一定要注册为 Bean，可以使用 Order 指定优先级，还未尝试过
60+
* @return
61+
*/
62+
public TokenFilter tokenFilter() {
63+
return new TokenFilter();
64+
}
7865

79-
//Filter工厂，设置对应的过滤条件和跳转条件
66+
/**
67+
* Filter工厂，设置对应的过滤条件和跳转条件
68+
* @return
69+
*/
8070
@Bean
8171
public ShiroFilterFactoryBean shiroFilterFactoryBean() {
8272
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
8373
shiroFilterFactoryBean.setSecurityManager(securityManager());
8474
Map<String, String> map = new HashMap<>();
8575
//登出
8676
map.put("/logout", "logout");
87-
//对所有用户认证
77+
// 使用我们自己创建的jwt过滤器名称
8878
map.put("/**", "jwt");
8979
//登录
9080
shiroFilterFactoryBean.setLoginUrl("/login");
@@ -93,39 +83,19 @@ public ShiroFilterFactoryBean shiroFilterFactoryBean() {
9383
//错误页面，认证不通过跳转
9484
shiroFilterFactoryBean.setUnauthorizedUrl("/error");
9585
shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
96-
shiroFilterFactoryBean.setFilters(new HashMap<String, Filter>(){{put("jwt", new TokenFilter());}});
86+
shiroFilterFactoryBean.setFilters(new HashMap<String, Filter>(){{put("jwt", tokenFilter());}});
9787
return shiroFilterFactoryBean;
9888
}
9989

100-
//权限管理，配置主要是Realm的管理认证
90+
/**
91+
* 权限管理，配置主要是Realm的管理认证，同时可以配置缓存管理等
92+
* @return
93+
*/
10194
@Bean
10295
public DefaultWebSecurityManager securityManager() {
10396
DefaultWebSecurityManager webSecurityManager = new DefaultWebSecurityManager();
104-
105-
//session管理
106-
// webSecurityManager.setSessionManager(sessionManager());
107-
10897
//realm管理
109-
webSecurityManager.setRealm(myShiroRealm());
110-
111-
//缓存管理
112-
// webSecurityManager.setCacheManager(new MemoryConstrainedCacheManager());
113-
//使用ehcache
114-
// EhCacheManager ehCacheManager = new EhCacheManager();
115-
// ehCacheManager.setCacheManager(getEhCacheManager());
116-
// webSecurityManager.setCacheManager(ehCacheManager);
117-
118-
//redis实现
119-
// webSecurityManager.setCacheManager(redisCacheManager());
120-
121-
// //关闭session
122-
// DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
123-
// DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();
124-
// defaultSessionStorageEvaluator.setSessionStorageEnabled(false);
125-
// subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);
126-
// webSecurityManager.setSubjectDAO(subjectDAO);
127-
SecurityUtils.setSecurityManager(webSecurityManager);
128-
98+
webSecurityManager.setRealm(studyRealm());
12999
return webSecurityManager;
130100
}
131101
}

‎shiro-study/src/main/java/com/nineya/shiro/config/StudyRealm.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
import java.util.stream.Collectors;
1919

2020
/**
21+
* 自定义 realm
22+
*
2123
* @author 殇雪话诀别
2224
* 2021/2/15
2325
*/
@@ -33,7 +35,7 @@ public boolean supports(AuthenticationToken token) {
3335
}
3436

3537
/**
36-
* 授权，在认证之后仔细
38+
* 授权，在认证之后执行
3739
* @param principals
3840
* @return
3941
*/
@@ -70,7 +72,7 @@ protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
7072
if (user == null) {
7173
return null;
7274
}
73-
// 第一个参数是主体，将会在授权时封装成PrincipalCollection进行使用，所以必须将jwt内容传回
75+
// 第一个参数是主体，将会在授权时封装成PrincipalCollection.getPrimaryPrincipal()进行使用，所以必须将jwt内容传回
7476
// 第二个参数是认证信息，即密码，为后面验证可以通过，需要和token中的内容一样
7577
// 第三个参数是领域名称
7678
return new SimpleAuthenticationInfo(token.getPrincipal(), token.getCredentials(), user.getUserName());

‎shiro-study/src/main/java/com/nineya/shiro/controller/ExceptionController.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,14 @@
99
/**
1010
* @author 殇雪话诀别
1111
* 2021/2/15
12+
* 对未通过权限认证的部分异常进行异常处理
1213
*/
1314
@ControllerAdvice
1415
public class ExceptionController {
1516

16-
public static Subject subject;
1717
@ExceptionHandler
1818
@ResponseBody
1919
public String ErrorHandler(AuthorizationException e) {
20-
System.out.println(subject.getPrincipals());
2120
return "没有通过权限验证！\n" + e.getMessage();
2221
}
2322
}

‎shiro-study/src/main/java/com/nineya/shiro/controller/LoginController.java‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,12 @@
11
package com.nineya.shiro.controller;
22

3-
import com.auth0.jwt.JWT;
4-
import com.auth0.jwt.algorithms.Algorithm;
53
import com.nineya.shiro.entity.User;
64
import com.nineya.shiro.service.LoginService;
75
import com.nineya.shiro.util.UserTokenUtil;
8-
import org.apache.shiro.SecurityUtils;
9-
import org.apache.shiro.authc.AuthenticationException;
10-
import org.apache.shiro.authc.UnknownAccountException;
11-
import org.apache.shiro.authc.UsernamePasswordToken;
12-
import org.apache.shiro.authz.AuthorizationException;
136
import org.apache.shiro.authz.annotation.RequiresPermissions;
147
import org.apache.shiro.authz.annotation.RequiresRoles;
15-
import org.apache.shiro.authz.annotation.RequiresUser;
16-
import org.apache.shiro.subject.Subject;
178
import org.springframework.util.StringUtils;
189
import org.springframework.web.bind.annotation.GetMapping;
19-
import org.springframework.web.bind.annotation.PostMapping;
2010
import org.springframework.web.bind.annotation.RequestParam;
2111
import org.springframework.web.bind.annotation.RestController;
2212

@@ -34,6 +24,16 @@ public class LoginController {
3424
@Resource
3525
private UserTokenUtil tokenUtil;
3626

27+
/**
28+
* 使用 jwt 进行登录时此处逻辑将有些不同
29+
* 如果没有使用Token，用户将在此方法中通过 subject.login(usernamePasswordToken) 进行登录。
30+
* 使用 jwt 时，将不再使用 session 存储登录状态，subject.login(usernamePasswordToken) 逻辑将在 Filter 解析 token 时进行，并且
31+
* 每次请求都需要进行 token 解析和登录操作。
32+
* 也就是说认证、授权两个步骤，原本只要登录时进行认证，每次请求进行授权，使用 jwt 后每次请求都需要记性jwt解析、认证和授权三个步骤。
33+
* @param userName 用户名
34+
* @param password 密码
35+
* @return
36+
*/
3737
@GetMapping("/login")
3838
public String login(@RequestParam("userName") String userName, @RequestParam("password") String password) {
3939
if (StringUtils.isEmpty(userName) || StringUtils.isEmpty(password)) {
@@ -46,6 +46,7 @@ public String login(@RequestParam("userName") String userName, @RequestParam("pa
4646
return tokenUtil.createToken(userName);
4747
}
4848

49+
// 这是没有使用 jwt 时，基于 session 的实现方式
4950
// @GetMapping("/login")
5051
// public String login(User user) {
5152
// if (StringUtils.isEmpty(user.getUserName()) || StringUtils.isEmpty(user.getPassword())) {
@@ -72,19 +73,31 @@ public String login(@RequestParam("userName") String userName, @RequestParam("pa
7273
// return "login success";
7374
// }
7475

76+
/**
77+
* 允许角色为 read 且为 write 用户访问
78+
* @return
79+
*/
7580
@RequiresRoles({"read", "write"})
7681
@GetMapping("/admin")
7782
public String admin() {
7883
return "admin";
7984
}
8085

86+
/**
87+
* 允许拥有 select 权限的用户访问
88+
* @return
89+
*/
8190
@RequiresPermissions("select")
8291
@GetMapping("/select")
8392
public String select() {
8493
return "select";
8594
}
8695

87-
@RequiresPermissions("user:create")
96+
/**
97+
* 允许拥有 create 权限的用户访问
98+
* @return
99+
*/
100+
@RequiresPermissions("create")
88101
@GetMapping("/create")
89102
public String create() {
90103
return "create";

‎shiro-study/src/main/java/com/nineya/shiro/entity/Role.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
/**
66
* @author 殇雪话诀别
77
* 2021/2/15
8-
* 角色
8+
* 角色，包含权限集合
99
*/
1010
public class Role {
1111
private long id;

‎shiro-study/src/main/java/com/nineya/shiro/entity/User.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
/**
66
* @author 殇雪话诀别
77
* 2021/2/15
8-
* 用户
8+
* 用户，包含角色集合
99
*/
1010
public class User {
1111
private long uid;

‎shiro-study/src/main/java/com/nineya/shiro/filter/TokenFilter.java‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ protected boolean isAccessAllowed(ServletRequest request, ServletResponse respon
4040
if (isLoginAttempt(request, response)) {
4141
//如果存在，则进入 executeLogin 方法执行登入，检查 token 是否正确
4242
try {
43-
executeLogin(request, response);
43+
return executeLogin(request, response);
4444
} catch (Exception e) {
4545
//token 错误
4646
e.printStackTrace();
@@ -62,9 +62,7 @@ protected boolean executeLogin(ServletRequest request, ServletResponse response)
6262
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
6363
String token = httpServletRequest.getHeader(AUTHORIZATION_HEADER);
6464
BearerToken jwtToken = new BearerToken(token, request.getRemoteAddr());
65-
ExceptionController.subject = getSubject(request, response);
66-
ExceptionController.subject.login(jwtToken);
67-
ExceptionController.subject = getSubject(request, response);
65+
getSubject(request, response).login(jwtToken);
6866
return true;
6967
}
7068
}

‎shiro-study/src/main/java/com/nineya/shiro/service/LoginService.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
/**
66
* @author 殇雪话诀别
77
* 2021/2/15
8+
* 用户登录服务接口
89
*/
910
public interface LoginService {
1011

0 commit comments

Comments
 (0)