Apache Shiro 集成
1:加入jar:shiro-all-1.2.1.jar
2:
其他:
1:
请求与 loginUrl
2:
http请求为post请求
3:
使用 authc 进行拦截
以上三个条件满足,则可触发 登录验证(包含:username, password, rememberMe三个请求参数)
4:
原文:
This filter constructs a UsernamePasswordToken with the values found in username, password, and rememberMe request parameters. It then calls Subject.login(usernamePasswordToken), effectively automatically performing a login attempt. Note that the login attempt will only occur when the isLoginSubmission(request,response) is true, which by default occurs when the request is for the loginUrl and is a POST request.
5:
/login/logout.htm = logout
6:
清除个人登录缓存:
在 shiroDbRealm extends AuthorizingRealm中的doGetAuthenticationInfo方法中:
加入代码:clearCachedAuthorizationInfo(new ShiroUser(token.getUsername())); // 清除权限缓存
在登录时强制检查不存在的权限,防止权限懒加载:
SpringContextHolder.getBean(ShiroDbRealm.class).isPermitted(SecurityUtils.getSubject().getPrincipals(), "强制shiro检查加载用户权限缓存,避免懒加载!" + System.currentTimeMillis());
页:
[1]