• 前后端分离--前置路由守卫(登录过滤)和整合shiro安全框架

    前置路由守卫:就是在路由跳转前加上自己得一些业务代码。

     添加配置

    1. router.beforeEach((to, from, next) => {
    2.   var path = to.path;
    3.   if(path==="/login"){
    4.     return next();
    5.   }
    6.  
    7.   var token = sessionStorage.getItem("token");
    8.   if(token){
    9.     return next();
    10.   }
    11.   return next("/login")
    12. })

    整合shiro安全框架

    添加依赖

    1.  <dependency>
    2.             <groupId>org.apache.shirogroupId>
    3.             <artifactId>shiro-spring-boot-starterartifactId>
    4.             <version>1.7.0version>
    5.         dependency>

    添加shiro配置类

    1. import com.ytr.system.filter.Myfilter;
    2. import com.ytr.system.realm.MyRealm;
    3. import org.apache.shiro.authc.credential.CredentialsMatcher;
    4. import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
    5. import org.apache.shiro.realm.Realm;
    6. import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    7. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    8. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    9. import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
    10. import org.springframework.boot.web.servlet.FilterRegistrationBean;
    11. import org.springframework.context.annotation.Bean;
    12. import org.springframework.context.annotation.Configuration;
    13. import org.springframework.web.filter.DelegatingFilterProxy;
    14.  
    15. import javax.servlet.Filter;
    16. import java.util.HashMap;
    17.  
    18.  
    19. /**
    20.  * @author Yang
    21.  * @ClassName myConfig
    22.  * @date 2022/8/7 14:44
    23.  */
    24. @Configuration
    25. public class ShiroConfig {
    26.  
    27.     /*配置shiro管理器*/
    28.     @Bean
    29.     public DefaultWebSecurityManager securityManager() {
    30.         DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
    31.         /*设置读取的自定义的relam*/
    32.         defaultWebSecurityManager.setRealm(realm());
    33.         return defaultWebSecurityManager;
    34.     }
    35.  
    36.  
    37.     /*创建realm配置自定义的relam*/
    38.     @Bean
    39.     public Realm realm() {
    40.         MyRealm myRealm = new MyRealm();
    41.         /*设置密码加密器 调用自定义的加密器*/
    42.         myRealm.setCredentialsMatcher(credentialsMatcher());
    43.         return myRealm;
    44.     }
    45.  
    46.     /*设置密码加密器配置*/
    47.     @Bean
    48.     public CredentialsMatcher credentialsMatcher() {
    49.         /*创建密码加密器*/
    50.         HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
    51.         /*设置加密形式*/
    52.         credentialsMatcher.setHashAlgorithmName("MD5");
    53.         /*设置加密次数*/
    54.         credentialsMatcher.setHashIterations(1024);
    55.         return credentialsMatcher;
    56.     }
    57.  
    58.     /*创建过滤器*/
    59.     @Bean(value = "shiroFilter")
    60.     public ShiroFilterFactoryBean filterFactoryBean() {
    61.         ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
    62.         factoryBean.setSecurityManager(securityManager());
    63.  
    64.         //设置拦截规则
    65.         HashMap map = new HashMap<>();
    66.         map.put("/system/login", "anon");
    67.         map.put("/**", "authc");
    68.  
    69.         //放行Swagger2页面，需要放行这些
    70.         map.put("/swagger-ui.html", "anon");
    71.         map.put("/swagger/**", "anon");
    72.         map.put("/webjars/**", "anon");
    73.         map.put("/swagger-resources/**", "anon");
    74.         map.put("/v2/**", "anon");
    75.         map.put("/static/**", "anon");
    76.         map.put("/doc.html", "anon");
    77.         map.put("/swagger2/**", "anon");
    78.  
    79.         factoryBean.setFilterChainDefinitionMap(map);
    80.  
    81.         //设置自定义认证过滤器
    82.         HashMap filterMap = new HashMap();
    83.         filterMap.put("authc", new Myfilter());
    84.         factoryBean.setFilters(filterMap);
    85.  
    86.         return factoryBean;
    87.     }
    88.  
    89.     @Bean //注册filter
    90.     public FilterRegistrationBean filterRegistrationBean() {
    91.         FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean<>();
    92.         filterRegistrationBean.setName("shiroFilter");
    93.         filterRegistrationBean.setFilter(new DelegatingFilterProxy());
    94.         filterRegistrationBean.addUrlPatterns("/*");
    95.         return filterRegistrationBean;
    96.     }
    97.  
    98.     //开启shiro注解
    99.     @Bean
    100.     public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() {
    101.         AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
    102.         authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
    103.         return authorizationAttributeSourceAdvisor;
    104.  
    105.     }
    106.  
    107.     @Bean
    108.     public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
    109.         DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
    110.         advisorAutoProxyCreator.setProxyTargetClass(true);
    111.         return advisorAutoProxyCreator;
    112.     }
    113.  
    114.    /* @Bean
    115.     //LifecycleBeanPostProcessor 是管理shiro生命周期的
    116.     //这个方法不加也可以
    117.     public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
    118.         return new LifecycleBeanPostProcessor();
    119.     }*/
    120.  
    121.  
    122. }

    添加过滤器

    1. import com.fasterxml.jackson.databind.ObjectMapper;
    2.  
    3. import com.ytr.system.vo.CommonResult;
    4. import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
    5.  
    6. import javax.servlet.ServletRequest;
    7. import javax.servlet.ServletResponse;
    8. import java.io.PrintWriter;
    9.  
    10. /**
    11.  * @author Yang
    12.  * @ClassName Myfilter
    13.  * @date 2022/8/7 10:41
    14.  */
    15. public class Myfilter extends FormAuthenticationFilter {
    16.     @Override
    17.     //未登录时进入该方法
    18.     protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    19.         response.setContentType("application/json;charset=utf-8");
    20.         PrintWriter writer = response.getWriter();
    21.         CommonResult commonResult = new CommonResult(3000, "未登录", null);
    22.         ObjectMapper objectMapper = new ObjectMapper();
    23.         String json = objectMapper.writeValueAsString(commonResult);
    24.         writer.print(json);
    25.         writer.flush();
    26.         writer.close();
    27.         return false;
    28.     }
    29. }

    添加自定义relam

    1. import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
    2. import com.ytr.system.entity.User;
    3. import com.ytr.system.service.IUserService;
    4. import org.apache.shiro.authc.AuthenticationException;
    5. import org.apache.shiro.authc.AuthenticationInfo;
    6. import org.apache.shiro.authc.AuthenticationToken;
    7. import org.apache.shiro.authc.SimpleAuthenticationInfo;
    8. import org.apache.shiro.authz.AuthorizationInfo;
    9. import org.apache.shiro.authz.SimpleAuthorizationInfo;
    10. import org.apache.shiro.realm.AuthorizingRealm;
    11. import org.apache.shiro.subject.PrincipalCollection;
    12. import org.apache.shiro.subject.Subject;
    13. import org.apache.shiro.util.ByteSource;
    14. import org.springframework.beans.factory.annotation.Autowired;
    15.  
    16. import java.util.List;
    17.  
    18. /**
    19.  * @author Yang
    20.  * @ClassName MyRealm
    21.  * @date 2022/8/7 14:54
    22.  */
    23. public class MyRealm extends AuthorizingRealm {
    24.  
    25.  
    26.     @Autowired
    27.      private IUserService iUserService;
    28.     /*授权方法  当执行权限校验时执行此方法*/
    29.     @Override
    30.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    31.  
    32.  
    33.         return null;
    34.     }
    35.  
    36.     /*认证方法*/
    37.     @Override
    38.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    39.  
    40.         /*根据token获取账号*/
    41.         String username = (String) authenticationToken.getPrincipal();
    42.         /*定义查询封装类，将查询的条件封装进去*/
    43.         QueryWrapper queryWrapper = new QueryWrapper<>();
    44.         queryWrapper.eq("username",username);
    45.         queryWrapper.eq("is_deleted",0);
    46.         /*根据账号查询用户信息*/
    47.         User one = iUserService.getOne(queryWrapper);
    48.         if (one != null) {
    49.             /*获取盐*/
    50.             ByteSource byteSource = ByteSource.Util.bytes(one.getSalt());
    51.             /*从数据库获取密码*/
    52.             SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(one, one.getPassword(), byteSource, this.getName());
    53.             return info;
    54.         }
    55.         return null;
    56.     }
    57. }

    添加自定义的过滤器

    1. import com.fasterxml.jackson.databind.ObjectMapper;
    2.  
    3. import com.ytr.system.vo.CommonResult;
    4. import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
    5.  
    6. import javax.servlet.ServletRequest;
    7. import javax.servlet.ServletResponse;
    8. import java.io.PrintWriter;
    9.  
    10. /**
    11.  * @author Yang
    12.  * @ClassName Myfilter
    13.  * @date 2022/8/7 10:41
    14.  */
    15. public class Myfilter extends FormAuthenticationFilter {
    16.     @Override
    17.     //未登录时进入该方法
    18.     protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    19.         response.setContentType("application/json;charset=utf-8");
    20.         PrintWriter writer = response.getWriter();
    21.         CommonResult commonResult = new CommonResult(3000, "未登录", null);
    22.         ObjectMapper objectMapper = new ObjectMapper();
    23.         String json = objectMapper.writeValueAsString(commonResult);
    24.         writer.print(json);
    25.         writer.flush();
    26.         writer.close();
    27.         return false;
    28.     }
    29. }
    30.  
    31.  
    32.

    修改登录接口

    修改

    1. import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
    2. import com.ytr.system.entity.User;
    3. import com.ytr.system.service.IUserService;
    4. import com.ytr.system.vo.CommonResult;
    5. import com.ytr.system.vo.LoginVo;
    6. import io.swagger.annotations.Api;
    7. import io.swagger.annotations.ApiOperation;
    8. import org.apache.shiro.SecurityUtils;
    9. import org.apache.shiro.authc.UsernamePasswordToken;
    10. import org.apache.shiro.subject.Subject;
    11. import org.springframework.beans.factory.annotation.Autowired;
    12. import org.springframework.data.redis.core.RedisTemplate;
    13. import org.springframework.data.redis.core.ValueOperations;
    14. import org.springframework.web.bind.annotation.*;
    15.  
    16. import java.util.UUID;
    17. import java.util.concurrent.TimeUnit;
    18.  
    19. /**
    20.  * @author Yang
    21.  * @ClassName LoginCon
    22.  * @date 2022/8/8 15:30
    23.  */
    24. @RestController
    25. @RequestMapping(value = "/system")
    26. @Api(tags = "登录接口类")
    27. public class LoginCon {
    28.  
    29.     @Autowired
    30.     IUserService userService;
    31.  
    32.     @Autowired
    33.     private RedisTemplate redisTemplate;
    34.  
    35.     @ApiOperation(value = "登录接口方法")
    36.     @PostMapping(value = "/login")
    37.     public CommonResult login(@RequestBody LoginVo loginVo){
    38.         try{
    39.             /*获取subject*/
    40.             Subject subject = SecurityUtils.getSubject();
    41.             /*封装用户信息*/
    42.             UsernamePasswordToken usernamePasswordToken=new UsernamePasswordToken(loginVo.getUid(),loginVo.getUpwd());
    43.             /*调用login方法*/
    44.             subject.login(usernamePasswordToken);
    45.             /*获取查询到的用户信息 */
    46.             Object principal = subject.getPrincipal();
    47.             //随机生成一个唯一字符串。
    48.             String token = UUID.randomUUID().toString();
    49.             //把该token作为redis的key value为当前登录用户信息
    50.             ValueOperations forValue = redisTemplate.opsForValue();
    51.             /*存值，并设置有效时间*/
    52.             forValue.set(token,principal,24, TimeUnit.HOURS);
    53.             return new CommonResult(2000,"登录成功",token);
    54.         }catch (Exception e){
    55.             return new CommonResult(5000,"登陆失败",null);
    56.         }
    57.     }
    58. }

    进行测试

    这个跨域问题之前已经解决，这篇笔记用的就是在下面的笔记代码中修改来的，在里面已经解决了跨域问题，可这里又出现了

     前后端分离https://blog.csdn.net/weixin_43766390/article/details/126228074?spm=1001.2014.3001.5501

    原因：

    前端的请求被shiro得拦截器给拦截了。前端VUE发送两种请求方式，OPTIONS和http请求，

    浏览器会首先发送预检请求OPTIONS请求，当OPTIONS请求通过之后，会再次发送我们当前的实际请求，所以我们要做的是让请求通过预检。

    解决方法

    修改我们写的过滤器添加一个登录判断

    1. @Override
    2.     /*这个方法返回true的话下面的未登录方法一定不会执行 */
    3.     protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
    4.         HttpServletRequest httpServletRequest = (HttpServletRequest) request;
    5.         /*获取请求方式*/
    6.         String method = httpServletRequest.getMethod();
    7.         if(method!=null && method.equals("OPTIONS")){
    8.             return true;
    9.         }
    10.  
    11.         /*判断请求头是否携带token值*/
    12.         String taken = httpServletRequest.getHeader("taken");
    13.         if(taken!=null){
    14.             return true;
    15.         }
    16.         
    17.         return false;
    18.     }

    在获取token后应该再和redis中的对比，看看是不是确实存在的token

    解决方案： 

     

    1.  @Autowired
    2.     private RedisTemplate redisTemplate;
    3.     /*创建过滤器*/
    4.     @Bean(value = "shiroFilter")
    5.     public ShiroFilterFactoryBean filterFactoryBean() {
    6.         ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
    7.         factoryBean.setSecurityManager(securityManager());
    8.  
    9.         //设置拦截规则
    10.         HashMap map = new HashMap<>();
    11.         map.put("/system/login", "anon");
    12.         map.put("/**", "authc");
    13.  
    14.         //放行Swagger2页面，需要放行这些
    15.         map.put("/swagger-ui.html", "anon");
    16.         map.put("/swagger/**", "anon");
    17.         map.put("/webjars/**", "anon");
    18.         map.put("/swagger-resources/**", "anon");
    19.         map.put("/v2/**", "anon");
    20.         map.put("/static/**", "anon");
    21.         map.put("/doc.html", "anon");
    22.         map.put("/swagger2/**", "anon");
    23.  
    24.         factoryBean.setFilterChainDefinitionMap(map);
    25.  
    26.         //设置自定义认证过滤器（过滤未登录的）
    27.         HashMap filterMap = new HashMap();
    28.         filterMap.put("authc", new Myfilter(redisTemplate));
    29.         factoryBean.setFilters(filterMap);
    30.  
    31.         return factoryBean;
    32.     }

    过滤器

    1. import com.fasterxml.jackson.databind.ObjectMapper;
    2.  
    3. import com.ytr.system.vo.CommonResult;
    4. import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
    5. import org.springframework.data.redis.core.RedisTemplate;
    6.  
    7. import javax.servlet.ServletRequest;
    8. import javax.servlet.ServletResponse;
    9. import javax.servlet.http.HttpServletRequest;
    10. import java.io.PrintWriter;
    11.  
    12. /**
    13.  * @author Yang
    14.  * @ClassName Myfilter
    15.  * @date 2022/8/7 10:41
    16.  */
    17. public class Myfilter extends FormAuthenticationFilter {
    18.  
    19.     private RedisTemplate redisTemplate;
    20.  
    21.     /*定义构造函数*/
    22.     public Myfilter(RedisTemplate redisTemplate){
    23.         this.redisTemplate=redisTemplate;
    24.     }
    25.  
    26.     @Override
    27.     /*这个方法返回true的话下面的未登录方法一定不会执行 */
    28.     protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
    29.         HttpServletRequest httpServletRequest = (HttpServletRequest) request;
    30.         /*获取请求方式*/
    31.         String method = httpServletRequest.getMethod();
    32.         if(method!=null && method.equals("OPTIONS")){
    33.             return true;
    34.         }
    35.  
    36.         /*判断请求头是否携带token值*/
    37.         String taken = httpServletRequest.getHeader("token");
    38.         System.out.println(taken);
    39.         if(taken!=null && redisTemplate.hasKey(taken)){
    40.             System.out.println(taken);
    41.  
    42.             return true;
    43.         }
    44.  
    45.         return false;
    46.     }
    47.  
    48.     @Override
    49.     //未登录时进入该方法
    50.     protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    51.         response.setContentType("application/json;charset=utf-8");
    52.         PrintWriter writer = response.getWriter();
    53.         CommonResult commonResult = new CommonResult(3000, "未登录", null);
    54.         ObjectMapper objectMapper = new ObjectMapper();
    55.         String json = objectMapper.writeValueAsString(commonResult);
    56.         writer.print(json);
    57.         writer.flush();
    58.         writer.close();
    59.         return false;
    60.     }
    61. }

    注意

    设置axios基础路径

    退出功能(清空前端session)

    前端代码

     后端

    1. /*退出*/
    2.     @GetMapping("/quit")
    3.     public CommonResult quit(HttpServletRequest request){
    4.         /*从前端请求中获取token*/
    5.         String token = request.getHeader("token");
    6.         /*对比数据库查看有没有这个token*/
    7.         if(redisTemplate.hasKey(token)){
    8.             /*删除*/
    9.             redisTemplate.delete(token);
    10.             return new CommonResult(2000,"退出成功",null);
    11.         }
    12.         return new CommonResult(5000,"退出失败",null);
    13.     }

    递归查询多级菜单

    1.  
    2. import com.ytr.system.entity.Permission;
    3. import com.ytr.system.entity.User;
    4. import com.ytr.system.mapper.PermissionMapper;
    5. import com.ytr.system.service.IPermissionService;
    6. import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
    7. import com.ytr.system.vo.CommonResult;
    8. import org.springframework.beans.factory.annotation.Autowired;
    9. import org.springframework.data.redis.core.RedisTemplate;
    10. import org.springframework.data.redis.core.ValueOperations;
    11. import org.springframework.stereotype.Service;
    12.  
    13. import java.util.ArrayList;
    14. import java.util.List;
    15.  
    16. /**
    17.  * 
    18.  * 权限 服务实现类
    19.  * 
    20.  *
    21.  * @author ytr
    22.  * @since 2022-08-08
    23.  */
    24. @Service
    25. public class PermissionServiceImpl extends ServiceImpl implements IPermissionService {
    26.     @Autowired
    27.     protected RedisTemplate redisTemplate;
    28.  
    29.     @Autowired
    30.     protected PermissionMapper permissionMapper;
    31.  
    32.     @Override
    33.     public CommonResult findPermissionByuserId(String token) {
    34.         //根据token获取用户信息
    35.         ValueOperations valueOperations = redisTemplate.opsForValue();
    36.         User user = (User) valueOperations.get(token);
    37.         String id = user.getId();
    38.         /*根据用户id查询所具有的菜单*/
    39.         List permissions = permissionMapper.selMenuByUserId(id);
    40.  
    41.         //设置层级关系
    42.         List firstMenus = new ArrayList<>();
    43.         for (Permission first : permissions) {
    44.             //int
    45.             if (first.getPid().equals("1")) {
    46.                 firstMenus.add(first);
    47.             }
    48.         }
    49.  
    50.  
    51.         //为一级菜单设置二级菜单
    52.         for (Permission first : firstMenus) {
    53.             //根据一级菜单id 查询 该菜单得二级菜单。如果出现不确定有几级菜单 那么我们可以使用方法得递归调用
    54.             first.setChildren(findChildren(permissions, first.getId()));
    55.  
    56.         }
    57.         System.out.println("打印firstMenus"+firstMenus);
    58.         return new CommonResult(2000,"查询成功",firstMenus);
    59.     }
    60.  
    61.     //方法递归
    62.     private List findChildren(List permissionList, String id) {
    63.         List children = new ArrayList<>();
    64.         for (Permission p : permissionList) {
    65.             if (p.getPid().equals(id)) {
    66.                 children.add(p);
    67.             }
    68.         }
    69.  
    70.         for (Permission child : children) {
    71.             child.setChildren(findChildren(permissionList, child.getId()));
    72.         }
    73.         return children;
    74.     }
    75. }

  • 相关阅读:
    stm32使用通用定时器生成pwm
    1014 Waiting in Line（30）& 1017 Queueing at Bank（25）
    登陆页面/登陆框渗透测试思路
    MyBatis-Plus中解决表名或字段名不一致
    中小企业如何实施MES管理系统
    【重温C++ Primer】第一章、初识C++
    455-C++ 多态（知乎）
    【Vue3响应式原理#02】Proxy and Reflect
    C++这么难,为什么我们还要用C++?C++ Core Guidelines解析给了我答案
    【论文阅读】Hypergraph Convolutional Network for Group Recommendation
  • 原文地址：https://blog.csdn.net/weixin_43766390/article/details/126246595