跨域不能携带cookie => jsessionId不能传递 => session失效

shiro: 认证、授权、会话管理、加密、缓存…
认证状态存在session中，若session失效，则shiro无法判断是否登录

解决方案：

  • 降低浏览器版本，让跨域时能够携带cookie
  • 使用无状态登录技术（jwt）

image.png

https://jwt.io/
image.png

Shiro改造

image.png
思路：

  1. 登录请求不走shiro，自行实现，并在成功后颁发jwt
  2. 所有的请求都走shiro自定义过滤器
  3. 自定义过滤器内部获取jwt，并根据jwt中的用户信息获取权限信息并判断是否有权限

修改方式：

  1. 登录请求处理

  2. 认证逻辑

  3. 登录时不走shiro，直接走controller，成功后颁发jwt ```java package me.maiz.project.eduk15boss.controller;

import lombok.extern.slf4j.Slf4j; import me.maiz.project.eduk15boss.common.JwtUtils; import me.maiz.project.eduk15boss.common.Result; import me.maiz.project.eduk15boss.dao.OperatorMapper; import me.maiz.project.eduk15boss.model.Operator; import me.maiz.project.eduk15boss.model.OperatorExample; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.UnknownAccountException; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.subject.Subject; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RestController;

import javax.servlet.http.HttpServletResponse; import java.util.List;

@RestController @Slf4j public class LoginController {

  1. @Autowired
  2. private OperatorMapper operatorMapper;
  5. @PostMapping("login")
  6. public Result login(HttpServletResponse response, String username, String password){
  7.     //执行登录操作，签发jwt ,但不走shiro
  8.     log.info("登录操作：{},{}",username,password);
  10.     OperatorExample example = new OperatorExample();
  11.     example.createCriteria()
  12.             .andOperatorNameEqualTo(username)
  13.             .andPasswordEqualTo(password);
  14.     List<Operator> operators = operatorMapper.selectByExample(example);
  16.     Operator user = operators.get(0);
  17.     if(user==null||operators.size()>1){
  18.         return Result.fail("用户"+username+"不存在或者密码不正确");
  19.     }
  22.     //响应里返回jwt
  23.     String jwt = JwtUtils.createJWT(user);
  24.     response.setHeader(JwtUtils.AUTH_TOKEN_NAME,jwt);
  26.     return Result.success(jwt);
  27. }

}

  3. 2. 创建filter，验证jwt，filter调用realm
  4. ```java
  5. package me.maiz.project.eduk15boss.components;
  7. import com.fasterxml.jackson.databind.ObjectMapper;
  8. import com.google.common.base.Strings;
  9. import io.jsonwebtoken.Claims;
  10. import me.maiz.project.eduk15boss.common.JwtUtils;
  11. import me.maiz.project.eduk15boss.common.Result;
  12. import me.maiz.project.eduk15boss.model.Operator;
  13. import org.apache.shiro.authc.AuthenticationToken;
  14. import org.apache.shiro.authc.UnknownAccountException;
  15. import org.apache.shiro.subject.Subject;
  16. import org.apache.shiro.web.filter.authc.AuthenticatingFilter;
  17. import org.apache.shiro.web.util.WebUtils;
  18. import org.slf4j.Logger;
  19. import org.slf4j.LoggerFactory;
  20. import org.springframework.http.HttpStatus;
  21. import org.springframework.stereotype.Component;
  22. import org.springframework.web.bind.annotation.RequestMethod;
  24. import javax.servlet.ServletRequest;
  25. import javax.servlet.ServletResponse;
  26. import javax.servlet.http.HttpServletRequest;
  27. import javax.servlet.http.HttpServletResponse;
  28. import java.io.IOException;
  30. @Component
  31. public class JWTFilter extends AuthenticatingFilter {
  33.     private static final Logger logger = LoggerFactory.getLogger(JWTFilter.class);
  35.     @Override
  36.     protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
  37.         //全局允许跨域
  38.         HttpServletRequest httpServletRequest = (HttpServletRequest) request;
  39.         String requestURI = httpServletRequest.getRequestURI();
  41.         logger.info("进入预处理:{}-{}",httpServletRequest.getMethod(),requestURI);
  43.         HttpServletResponse httpServletResponse = (HttpServletResponse) response;
  44.         httpServletResponse.setHeader("Access-control-Allow-Origin", httpServletRequest.getHeader("Origin"));
  45.         httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,PUT,DELETE");
  46.         httpServletResponse.setHeader("Access-Control-Allow-Headers", httpServletRequest.getHeader("Access-Control-Request-Headers"));
  47.         // 跨域时会首先发送一个 option请求，这里我们给 option请求直接返回正常状态
  48.         if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
  49.             httpServletResponse.setStatus(HttpStatus.OK.value());
  50.             return false;
  51.         }
  54.         return super.preHandle(request, response);
  56.     }
  58.     @Override
  59.     protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
  60.         logger.info("进入isAccessAllowed");
  61.         if(!isJwtValid(request)){
  62.             return false;
  63.         }
  64.         return super.isAccessAllowed(request, response, mappedValue);
  65.     }
  67.     private boolean isJwtValid(ServletRequest req){
  68.         HttpServletRequest request = (HttpServletRequest) req;
  69.         String token = request.getHeader(JwtUtils.AUTH_TOKEN_NAME);
  70.        if(Strings.isNullOrEmpty(token)){
  71.            logger.info("JWT未提供");
  72.            return false;
  73.        }
  74.        try {
  75.            Operator operator = JwtUtils.parseJwt(token);
  76.            return operator!=null;
  77.        }catch (Exception e){
  78.            logger.info("JWT过期或者其他错误，{}，{}",e.getMessage());
  79.            request.setAttribute("AUTHC_FAIL","AUTHC_FAIL");
  80.            return false;
  81.        }
  82.     }
  84.     /**
  85.      * 从请求中提取Token
  86.      * @param req
  87.      * @param response
  88.      * @return
  89.      * @throws Exception
  90.      */
  91.     @Override
  92.     protected AuthenticationToken createToken(ServletRequest req, ServletResponse response) throws Exception {
  93.         logger.info("进入createToken");
  95.         HttpServletRequest request = (HttpServletRequest) req;
  96.         String token = request.getHeader(JwtUtils.AUTH_TOKEN_NAME);
  97.         if(Strings.isNullOrEmpty(token)){
  98.             throw new UnknownAccountException("请求不合法，JWT token未传入");
  99.         }
  101.         return new JwtToken(token);
  102.     }
  104.     @Override
  105.     protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
  106.         logger.info("进入onAccessDenied");
  108.         HttpServletRequest httpServletRequest = WebUtils.toHttp(request);
  109.         HttpServletResponse httpServletResponse = WebUtils.toHttp(response);
  110.         String token = httpServletRequest.getHeader(JwtUtils.AUTH_TOKEN_NAME);
  111.         if(Strings.isNullOrEmpty(token)){
  112.             fail(httpServletRequest, httpServletResponse);
  113.             return false;
  114.         }
  116.         boolean executeLogin = executeLogin(httpServletRequest, httpServletResponse);
  117.         if(!executeLogin){
  118.             fail(httpServletRequest, httpServletResponse);
  119.         }
  120.         return executeLogin;
  121.     }
  123.     private void fail(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws IOException {
  124.         // 返回401
  125.         httpServletResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
  126.         // 设置响应码为401或者直接输出消息
  127.         String url = httpServletRequest.getRequestURI();
  128.         ObjectMapper objectMapper = new ObjectMapper();
  129.         boolean isAuthc =httpServletRequest.getAttribute("AUTHC_FAIL")!=null;
  130.         Result fail = Result.fail(isAuthc?"您未登录，请先登录":"未授权的请求，请先登录或取得授权");
  131.         httpServletResponse.setContentType("application/json;charset=utf-8");
  132.         httpServletResponse.getWriter().print(objectMapper.writeValueAsString(fail));
  133.     }
  135.     @Override
  136.     protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request, ServletResponse response) throws Exception {
  137.         //TODO 刷新token
  138.         logger.info("进入onLoginSuccess");
  140.         return super.onLoginSuccess(token, subject, request, response);
  141.     }
  142. }
  1. package me.maiz.project.eduk15boss.components;
  3. import com.google.common.collect.Sets;
  4. import lombok.extern.slf4j.Slf4j;
  5. import me.maiz.project.eduk15boss.common.JwtUtils;
  6. import me.maiz.project.eduk15boss.dao.OperatorMapper;
  7. import me.maiz.project.eduk15boss.model.Operator;
  8. import org.apache.shiro.authc.AuthenticationException;
  9. import org.apache.shiro.authc.AuthenticationInfo;
  10. import org.apache.shiro.authc.AuthenticationToken;
  11. import org.apache.shiro.authc.SimpleAuthenticationInfo;
  12. import org.apache.shiro.authz.AuthorizationInfo;
  13. import org.apache.shiro.authz.SimpleAuthorizationInfo;
  14. import org.apache.shiro.realm.AuthorizingRealm;
  15. import org.apache.shiro.subject.PrincipalCollection;
  16. import org.springframework.beans.factory.annotation.Autowired;
  18. @Slf4j
  19. public class ShiroRealm extends AuthorizingRealm {
  22.     @Override
  23.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  24.         log.info("获取授权信息");
  25.         Object primaryPrincipal = principals.getPrimaryPrincipal();
  26.         Operator user = (Operator) primaryPrincipal;
  27.         //TODO  查询权限等
  29.         SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
  30.         simpleAuthorizationInfo.setRoles(null);
  31.         simpleAuthorizationInfo.setStringPermissions(Sets.newHashSet("student:add"));
  32.         return simpleAuthorizationInfo;
  33.     }
  35.     @Override
  36.     public boolean supports(AuthenticationToken token) {
  37.         return token instanceof JwtToken;
  38.     }
  40.     @Override
  41.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  42.         log.info("登录操作：{}",token);
  43.         JwtToken jwtToken = (JwtToken) token;
  44.         Operator operator = JwtUtils.parseJwt(jwtToken.getToken());
  46.         return new SimpleAuthenticationInfo(operator, jwtToken.getToken().toCharArray(),getName());
  47.     }
  49. }
  1. 配置过滤器，使其生效 ```java package me.maiz.project.eduk15boss.config;

import me.maiz.project.eduk15boss.components.JWTFilter; import me.maiz.project.eduk15boss.components.ShiroRealm; import org.apache.shiro.cache.MemoryConstrainedCacheManager; import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.realm.Realm; import org.apache.shiro.spring.web.ShiroFilterFactoryBean; import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition; import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration;

import javax.servlet.Filter; import java.util.LinkedHashMap;

@Configuration public class ShiroConfig {

  1. /**
  2.  * 自定义Realm 提供数据源
  3.  * @return
  4.  */
  5. @Bean
  6. public Realm shiroRealm(){
  7.     ShiroRealm shiroRealm = new ShiroRealm();
  8.     shiroRealm.setCacheManager(cacheManager());
  9.     return shiroRealm;
  10. }
  13. @Bean
  14. public MemoryConstrainedCacheManager cacheManager(){
  15.     return new MemoryConstrainedCacheManager();
  16. }
  19. /**
  20.  * shiro的过滤器链
  21.  * @return
  22.  */
  23. @Bean
  24. public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager){
  25.     ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  26.     shiroFilterFactoryBean.setSecurityManager(securityManager);
  27.     DefaultShiroFilterChainDefinition sfcd = new DefaultShiroFilterChainDefinition();
  28.     ShiroFilterFactoryBean filterFactoryBean = new ShiroFilterFactoryBean();

// filterFactoryBean.setLoginUrl(loginUrl); // filterFactoryBean.setSuccessUrl(successUrl); // filterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);

  1.     filterFactoryBean.setSecurityManager(securityManager);
  3.     // 在 Shiro过滤器链上加入 自定义过滤器JWTFilter 并取名为jwt
  4.     LinkedHashMap<String, Filter> filters = new LinkedHashMap<>();
  5.     filters.put("jwt", new JWTFilter());
  6.     shiroFilterFactoryBean.setFilters(filters);
  8.     //放行 使用
  9.     sfcd.addPathDefinition("/","anon");
  10.     sfcd.addPathDefinition("/login","anon");
  11.     sfcd.addPathDefinition("/error/404.html","anon");
  12.     sfcd.addPathDefinition("/css/**","anon");
  13.     sfcd.addPathDefinition("/js/**","anon");
  14.     sfcd.addPathDefinition("/images/**","anon");
  15.     sfcd.addPathDefinition("/fonts/**","anon");
  16.     sfcd.addPathDefinition("/html/**","anon");
  17.     //logout 登出
  18.     sfcd.addPathDefinition("/logout","logout");
  19.     //其他则需要认证
  20.     sfcd.addPathDefinition("/**","jwt");
  21.     shiroFilterFactoryBean.setFilterChainDefinitionMap(sfcd.getFilterChainMap());
  23.     return shiroFilterFactoryBean;
  24. }

}

  1. 其他工具类：
  2. ```java
  3. package me.maiz.project.eduk15boss.components;
  5. import lombok.Data;
  6. import lombok.experimental.Accessors;
  7. import org.apache.shiro.authc.AuthenticationToken;
  10. @Data
  11. @Accessors(chain = true)
  12. public class JwtToken implements AuthenticationToken {
  15.     /**
  16.      * 登录token
  17.      */
  18.     private String token;
  20.     public JwtToken(String token) {
  21.         this.token = token;
  22.     }
  24.     @Override
  25.     public Object getPrincipal() {
  26.         return token;
  27.     }
  29.     @Override
  30.     public Object getCredentials() {
  31.         return token;
  32.     }
  35. }
  1. package me.maiz.project.eduk15boss.common;
  3. import io.jsonwebtoken.Claims;
  4. import io.jsonwebtoken.JwtBuilder;
  5. import io.jsonwebtoken.Jwts;
  6. import io.jsonwebtoken.SignatureAlgorithm;
  7. import me.maiz.project.eduk15boss.model.Operator;
  9. import java.util.Date;
  10. import java.util.HashMap;
  11. import java.util.Map;
  13. public class JwtUtils {
  15.     public static final String AUTH_TOKEN_NAME="auth_token";
  17.     /**
  18.      * 签名用的密钥
  19.      */
  20.     private static final String SIGNING_KEY = "78sebr72umyz33i9876gc31urjgyfhgj";
  22.     private static final long DEFAULT_EXPIRATION_MILLIS=2*24*60*60*1000L;
  23.     private static final String USER_ID_KEY = "userId";
  24.     public static final String USERNAME_KEY = "username";
  27.     public static String createJWT(Operator user) {
  28.         Map<String,Object> claims = new HashMap<>();
  29.         claims.put(USER_ID_KEY,user.getOperatorId());
  30.         claims.put(USERNAME_KEY,user.getOperatorName());
  31.         return create(DEFAULT_EXPIRATION_MILLIS,claims);
  32.     }
  34.     public static Operator parseJwt(String token){
  35.         Claims claims = parse(token);
  36.         Operator user = new Operator();
  37.         user.setOperatorId((Integer) claims.get(USER_ID_KEY));
  38.         user.setOperatorName((String) claims.get(USERNAME_KEY));
  39.         return user;
  40.     }
  41.     /**
  42.      * 用户登录成功后生成Jwt
  43.      * 使用Hs256算法
  44.      *
  45.      * @param expiredInMillis jwt过期时间
  46.      * @param claims 保存在Payload（有效载荷）中的内容
  47.      * @return token字符串
  48.      */
  49.     public static String create(long expiredInMillis, Map<String, Object> claims) {
  50.         //指定签名的时候使用的签名算法
  51.         SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
  53.         //生成JWT的时间
  54.         long nowMillis = System.currentTimeMillis();
  55.         Date now = new Date(nowMillis);
  57.         //创建一个JwtBuilder，设置jwt的body
  58.         JwtBuilder builder = Jwts.builder()
  59.                 //保存在Payload（有效载荷）中的内容
  60.                 .setClaims(claims)
  61.                 //iat: jwt的签发时间
  62.                 .setIssuedAt(now)
  63.                 //设置过期时间
  64.                 .setExpiration(new Date(nowMillis+expiredInMillis))
  65.                 //设置签名使用的签名算法和签名使用的秘钥
  66.                 .signWith(signatureAlgorithm, SIGNING_KEY);
  68.         return builder.compact();
  69.     }
  71.     /**
  72.      * 解析token，获取到Payload（有效载荷）中的内容，包括验证签名，判断是否过期
  73.      *
  74.      * @param token
  75.      * @return
  76.      */
  77.     public static Claims parse(String token) {
  78.         //得到DefaultJwtParser
  79.         Claims claims = Jwts.parser()
  80.                 //设置签名的秘钥
  81.                 .setSigningKey(SIGNING_KEY)
  82.                 //设置需要解析的token
  83.                 .parseClaimsJws(token).getBody();
  84.         return claims;
  85.     }
  86. }

前端自动携带jwt，在main.js中配置axios

  2. // axios.defaults.withCredentials=true
  3. axios.defaults.baseURL="http://localhost:8081";
  5. //添加拦截器，每次请求携带token
  6. axios.interceptors.request.use(function (config) {
  7.   const token = localStorage.getItem("jwt");
  8.   config.headers.auth_token =  token;
  9.   return config;
  10. });

相关依赖：

  1. <!--jwt-->
  2. <dependency>
  3.   <groupId>io.jsonwebtoken</groupId>
  4.   <artifactId>jjwt</artifactId>
  5.   <version>0.9.1</version>
  6. </dependency>
  7. <!--guava工具类-->
  8. <dependency>
  9.   <groupId>com.google.guava</groupId>
  10.   <artifactId>guava</artifactId>
  11.   <version>29.0-jre</version>
  12. </dependency>

代码参见：
https://github.com/stickgoal/eduk15/tree/main/eduk15-boss