Shiro

shiro是一个功能强大且易于使用的java安全框架，可执行身份验证、授权、加密和会话管理。

功能

Authorization

授权，即权限验证。验证某个已认证的用户是否拥有某个权限，即判断用户是否能做什么事情。常见的如：验证某个用户是否拥有某个角色；细粒度的验证某个用户对某个资源是否具有某个功能权限。

Session Management

会话管理，即用户登录后就是一次会话，在没有退出之前，它的所有信息都在会话中；会话可以是普通的JavaSE环境，也可以是Web环境

Cryptography

加密，保护数据的安全性，如密码加密存储到数据库，而不是铭文存储

Web Support

Web支持，可以非常容易的集成到Web环境

Caching

缓存，比如童虎登录后，其用户信息、拥有的角色/权限不必每次都去查，这样可以提高效率

Concurrency

shiro支持多线程应用的并发验证，即，如在一个县城中开启另一个线程，能把权限自动传播过去

Testing

提供测试支持

Run As

允许一个用户假装成另一个用户的身份进行访问

Remember Me

记住我，这是个非常常见的功能，即一次登录后，下次再来的话就不用登录了

三个核心组件

image.png

Subject

当前操作用户。在shiro中，Subject这一概念不仅仅指人，也可以是第三方进程，后台账户或其他类似事务。它仅仅意味着当前跟软件交互的东西

SecurityManager

是shiro框架的心脏，并作为一种保护伞对象来协调内部的安全组件共同构成一个对象图。然而，一旦SecurityManager和它的内置对象图已经配置给一个应用程序，那么它单独留下来，且应用程序开发人员几乎使用他们所有的时间来处理SubjectAPI

Realm

担当shiro和应用程序的安全数据之间的桥梁。当它实际上与安全相关的数据，如用来执行很粉验证以及授权的用户账户交互时，shiro从一个或多个为应用程序配置的Realm中寻找许多这样的东西

JAVA访问权限控制

后台请求权限控制，通过Shiro注解 @RequiresPermissions

实例

一些实体

AuthenticationInfo，用户的角色信息集合，认证时使用。

AuthorzationInfo，角色的权限信息集合，授权时使用。

DefaultWebSecurityManager，安全管理器，开发者自定义的 Realm 需要注入到 DefaultWebSecurityManager 进行管理才能生效。

ShiroFilterFactoryBean，过滤器工厂，Shiro 的基本运行机制是开发者定制规则，Shiro 去执行，具体的执行操作就是由 ShiroFilterFactoryBean 创建的一个个 Filter 对象来完成。

SimpleAuthorizationInfo()获取角色，获取权限

SimpleAuthenticationInfo()获取用户名，密码

引入pom依赖

  1. <!--引入shrio-->
  2. <dependency>
  3.     <groupId>org.apache.shiro</groupId>
  4.     <artifactId>shiro-spring-boot-starter</artifactId>
  5.     <version>1.5.3</version>
  6. </dependency>

自定义Realm

  1. import org.apache.shiro.authc.AuthenticationException;
  2. import org.apache.shiro.authc.AuthenticationInfo;
  3. import org.apache.shiro.authc.AuthenticationToken;
  4. import org.apache.shiro.authz.AuthorizationInfo;
  5. import org.apache.shiro.realm.AuthorizingRealm;
  6. import org.apache.shiro.subject.PrincipalCollection;
  8. /**
  9.  * 自定义Realm
  10.  */
  11. public class CustomerRealm extends AuthorizingRealm {
  12.     @Override
  13.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
  14.         return null;
  15.     }
  17.     @Override
  18.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
  19.         return null;
  20.     }
  21. }

shiro配置

  1. @Configuration
  2. public class ShiroConfig {
  3.     //ShiroFilter过滤所有请求
  4.     @Bean
  5.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager) {
  6.         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  7.         //给ShiroFilter配置安全管理器
  8.         shiroFilterFactoryBean.setSecurityManager(securityManager);
  9.         //配置系统受限资源
  10.         //配置系统公共资源
  11.         Map<String, String> map = new HashMap<String, String>();
  12.         map.put("/index.jsp","authc");//表示这个资源需要认证和授权
  13.         // 设置认证界面路径
  14.         shiroFilterFactoryBean.setLoginUrl("/login.jsp");
  15.         shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
  17.         return shiroFilterFactoryBean;
  18.     }
  19.     //创建安全管理器
  20.     @Bean
  21.     public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {
  22.         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  23.         securityManager.setRealm(realm);
  24.         return securityManager;
  25.     }
  26.     //创建自定义Realm
  27.     @Bean
  28.     public Realm getRealm() {
  29.         CustomerRealm realm = new CustomerRealm();
  30.         return realm;
  31.     }
  32. }

过滤器

shiro提供和多个默认的过滤器，可以用这些过滤器来配置控制指定url的权限

认证和退出

  1. @Controller
  2. @RequestMapping("/user")
  3. public class UserController {
  4.     @RequestMapping("logout")
  5.     public String logout() {
  6.         Subject subject = SecurityUtils.getSubject();
  7.         subject.logout();
  8.         return "redirect:/login.jsp";
  9.     }
  10.     @RequestMapping("/login")
  11.     public String login(String username, String password) {
  12.         //获取主题对象
  13.         Subject subject = SecurityUtils.getSubject();
  14.         try {
  15.             subject.login(new UsernamePasswordToken(username,password));
  16.             System.out.println("登录成功！！！");
  17.             return "redirect:/index.jsp";
  18.         } catch (UnknownAccountException e) {
  19.             e.printStackTrace();
  20.             System.out.println("用户错误！！！");
  21.         } catch (IncorrectCredentialsException e) {
  22.             System.out.println("密码错误！！！");
  23.         }
  24.         return "redirect:/login.jsp";
  25.     }
  26. }

md5、salt的认证实现

  1. public class SaltUtil {
  2.     public static String getSalt(int n) {
  3.         char[] chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890!@#$%^&*()".toCharArray();
  4.         StringBuilder sb = new StringBuilder();
  5.         for (int i = 0; i < n; i++) {
  6.             char c = chars[new Random().nextInt(chars.length)];
  7.             sb.append(c);
  8.         }
  9.         return sb.toString();
  10.     }
  12.     public static void main(String[] args) {
  13.         System.out.println(getSalt(4));
  14.     }
  15. }
  1. @Service("userService")
  2. @Transactional
  3. public class UserServiceImpl implements UserService {
  4.     @Autowired
  5.     private UserDao userDao;
  7.     @Override
  8.     public void register(User user) {
  9.         //1.获取随机盐
  10.         String salt = SaltUtil.getSalt(8);
  11.         //2.将随机盐保存到数据
  12.         user.setSalt(salt);
  13.         //3.明文密码进行md5 + salt + hash散列
  14.        Md5Hash MD5 = new Md5Hash(user.getPassword(),salt,1024);
  15.        user.setPassword(MD5.toHex());
  16.        userDao.save(user);
  17.     }
  19.     @Override
  20.     public User findByUsername(String username) {
  21.         return userDao.findByUsername(username);
  22.     }
  23. }
  1. @Controller
  2. @RequestMapping("/user")
  3. public class UserController {
  5.     @Autowired
  6.     private UserService userService;
  8.     @RequestMapping("/register")
  9.     public String register(User user) {
  10.         try {
  11.             userService.register(user);
  12.             return "redirect:/login.jsp";
  13.         } catch (Exception e) {
  14.             e.printStackTrace();
  15.             return "redirect:/register.jsp";
  16.         }
  17.     }
  18.     @RequestMapping("logout")
  19.     public String logout() {
  20.         Subject subject = SecurityUtils.getSubject();
  21.         subject.logout();
  22.         return "redirect:/login.jsp";
  23.     }
  24.     @RequestMapping("/login")
  25.     public String login(String username, String password) {
  26.         //获取主题对象
  27.         Subject subject = SecurityUtils.getSubject();
  28.         try {
  29.             subject.login(new UsernamePasswordToken(username,password));
  30.             System.out.println("登录成功！！！");
  31.             return "redirect:/index.jsp";
  32.         } catch (UnknownAccountException e) {
  33.             e.printStackTrace();
  34.             System.out.println("用户错误！！！");
  35.         } catch (IncorrectCredentialsException e) {
  36.             System.out.println("密码错误！！！");
  37.         }
  38.         return "redirect:/login.jsp";
  39.     }
  40. }
  1. /**
  2.  * 自定义Realm
  3.  */
  4. public class CustomerRealm extends AuthorizingRealm {
  5.     @Override
  6.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
  7.         return null;
  8.     }
  10.     @Override
  11.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
  12.         String principal = (String) authenticationToken.getPrincipal();
  13.         //获取UserService对象
  14.         UserService userService = (UserService) ApplicationContextUtil.getBean("userService");
  15.         //System.out.println(userService);
  16.         User user = userService.findByUsername(principal);
  17.         if (!ObjectUtils.isEmpty(user)) {
  18.             return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), ByteSource.Util.bytes(user.getSalt()), this.getName());
  19.         }
  20.         return null;
  21.     }
  22. }
  1. @Component
  2. public class ApplicationContextUtil implements ApplicationContextAware {
  4.     private static ApplicationContext context;
  6.     @Override
  7.     public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
  8.         this.context = applicationContext;
  9.     }
  10.     //根据bean名字获取工厂中指定bean 对象
  11.     public static Object getBean(String beanName) {
  12.         return context.getBean(beanName);
  13.     }
  14. }
  1. @Configuration
  2. public class ShiroConfig {
  3.     //ShiroFilter过滤所有请求
  4.     @Bean
  5.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager) {
  6.         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  7.         //给ShiroFilter配置安全管理器
  8.         shiroFilterFactoryBean.setSecurityManager(securityManager);
  9.         //配置系统受限资源
  10.         //配置系统公共资源
  11.         Map<String, String> map = new HashMap<String, String>();
  12.         map.put("/user/login","anon");//表示这个为公共资源 一定是在受限资源上面
  13.         map.put("/user/register","anon");//表示这个为公共资源 一定是在受限资源上面
  14.         map.put("/register.jsp","anon");//表示这个为公共资源 一定是在受限资源上面
  15.         map.put("/**","authc");//表示这个受限资源需要认证和授权
  16.         // 设置认证界面路径
  17.         shiroFilterFactoryBean.setLoginUrl("/login.jsp");
  18.         shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
  20.         return shiroFilterFactoryBean;
  21.     }
  22.     //创建安全管理器
  23.     @Bean
  24.     public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {
  25.         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  26.         securityManager.setRealm(realm);
  27.         return securityManager;
  28.     }
  29.     //创建自定义Realm
  30.     @Bean
  31.     public Realm getRealm() {
  32.         CustomerRealm realm = new CustomerRealm();
  33.         HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
  34.         //设置使用MD5加密算法
  35.         credentialsMatcher.setHashAlgorithmName("md5");
  36.         //散列次数
  37.         credentialsMatcher.setHashIterations(1024);
  38.         realm.setCredentialsMatcher(credentialsMatcher);
  39.         return realm;
  40.     }

授权实现

  1. @Override
  2.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
  3.         String principal = (String) principalCollection.getPrimaryPrincipal();
  4.         if ("zhangsan".equals(principal)) {
  5.             SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
  6.             info.addRole("admin");
  7.             info.addRole("user");
  8.             info.addStringPermission("user:find:*");
  9.             info.addStringPermission("admin:*");
  10.             return info;
  11.         }
  12.         return null;
  13.     }
  1. <%@page contentType="text/html;UTF-8" pageEncoding="UTF-8" isErrorPage="false" %>
  2. <%@taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
  3. <!doctype html>
  4. <html lang="en">
  5. <head>
  6.     <meta charset="UTF-8">
  7.     <meta name="viewport"
  8.           content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  9.     <meta http-equiv="X-UA-Compatible" content="ie=edge">
  10.     <title>Document</title>
  11. </head>
  12. <body>
  13. <%--受限资源--%>
  14. <h1>系统主页</h1>
  15. <a href="${pageContext.request.contextPath}/user/logout">退出登录</a>
  16. <ul>
  17.     <shiro:hasRole name="user">
  18.         <li><a href="#">用户管理</a></li>
  19.         <ul>
  20.             <shiro:hasPermission name="user:save:*">
  21.                 <li><a href="#">增加</a></li>
  22.             </shiro:hasPermission>
  23.             <shiro:hasPermission name="user:delete:*">
  24.             <li><a href="#">删除</a></li>
  25.             </shiro:hasPermission>
  26.             <shiro:hasPermission name="user:update:*">
  27.             <li><a href="#">修改</a></li>
  28.             </shiro:hasPermission>
  29.             <shiro:hasPermission name="user:find:*">
  30.             <li><a href="#">查询</a></li>
  31.             </shiro:hasPermission>
  32.         </ul>
  33.     </shiro:hasRole>
  34.     <shiro:hasRole name="admin">
  35.         <li><a href="#">商品管理</a></li>
  36.         <li><a href="#">订单管理</a></li>
  37.         <li><a href="#">物流管理</a></li>
  38.     </shiro:hasRole>
  40. </ul>
  41. </body>
  42. </html>
  43. 在html中
  44. <!DOCTYPE html>
  45. <html lang="en" xmlns:th="http://www.thymeleaf.org"
  46.       xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">
  48. <head>
  49.     <title>首页</title>
  50. </head>
  51. <body>
  52. <h1>首页</h1>
  53. <hr>
  54. <ul>
  55.     <li><a href="user/index">个人中心</a></li>
  56.     <li><a href="vip/index">会员中心</a></li>
  57.     <p shiro:hasPermission="svip"><li>这是svip能看到的p标签</li></p>
  58.     <shiro:hasPermission name="svip"><li>这是svip能看到的</li></shiro:hasPermission>
  59.     <li><a href="logout">退出登录</a></li>
  60. </ul>
  61. </body>
  62. </html>
  1. @Controller
  2. @RequestMapping("order")
  3. public class OrderController {
  4.     @RequestMapping("save")
  5.     public String save() {
  6.         //基于角色
  7.         //获取主体对象
  8.         Subject subject = SecurityUtils.getSubject();
  9.         //代码方式
  10.         if (subject.hasRole("admin")) {
  11.             System.out.println("保存订单!");
  12.         }else{
  13.             System.out.println("无权访问!");
  14.         }
  15.         System.out.println("进入save方法============");
  16.         return "redircet:/index.jsp";
  17.     }
  18. }
  1. @Controller
  2. @RequestMapping("order")
  3. public class OrderController {
  5.     @RequiresRoles(value={"admin","user"})//用来判断角色  同时具有 admin user
  6.     @RequiresPermissions("user:update:01") //用来判断权限字符串
  7.     @RequestMapping("save")
  8.     public String save(){
  9.         System.out.println("进入方法");
  10.         return "redirect:/index.jsp";
  11.     }
  13. }

缓存

redis+shiro

  1. import org.apache.shiro.cache.Cache;
  2. import org.apache.shiro.cache.CacheException;
  3. import org.apache.shiro.cache.CacheManager;
  5. //自定义shiro缓存管理器
  6. public class RedisCacheManager implements CacheManager {
  7.     //参数1:认证或者是授权缓存的统一名称
  8.     @Override
  9.     public <K, V> Cache<K, V> getCache(String cacheName) throws CacheException {
  10.         System.out.println(cacheName);
  11.         return new RedisCache<K,V>(cacheName);
  12.     }
  13. }
  1. //自定义redis缓存的实现
  2. public class RedisCache<k,v> implements Cache<k,v> {
  4.     private String cacheName;
  6.     public RedisCache() {
  7.     }
  9.     public RedisCache(String cacheName) {
  10.         this.cacheName = cacheName;
  11.     }
  13.     @Override
  14.     public v get(k k) throws CacheException {
  15.         return (v) getRedisTemplate().opsForHash().get(this.cacheName, k.toString());
  16.     }
  18.     @Override
  19.     public v put(k k, v v) throws CacheException {
  20.         System.out.println("put key: "+k);
  21.         System.out.println("put value:"+v);
  22.         getRedisTemplate().opsForHash().put(this.cacheName,k.toString(), v);
  23.         return null;
  24.     }
  26.     @Override
  27.     public v remove(k k) throws CacheException {
  28.         System.out.println("=============remove=============");
  29.         return (v) getRedisTemplate().opsForHash().delete(this.cacheName,k.toString());
  30.     }
  32.     @Override
  33.     public void clear() throws CacheException {
  34.         System.out.println("=============clear==============");
  35.         getRedisTemplate().delete(this.cacheName);
  36.     }
  38.     @Override
  39.     public int size() {
  40.         return getRedisTemplate().opsForHash().size(this.cacheName).intValue();
  41.     }
  43.     @Override
  44.     public Set<k> keys() {
  45.         return getRedisTemplate().opsForHash().keys(this.cacheName);
  46.     }
  48.     @Override
  49.     public Collection<v> values() {
  50.         return getRedisTemplate().opsForHash().values(this.cacheName);
  51.     }
  53.     private RedisTemplate getRedisTemplate(){
  54.         RedisTemplate redisTemplate = (RedisTemplate) ApplicationContextUtil.getBean("redisTemplate");
  55.         redisTemplate.setKeySerializer(new StringRedisSerializer());
  56.         redisTemplate.setHashKeySerializer(new StringRedisSerializer());
  57.         return redisTemplate;
  58.     }
  59. }
  1. import org.apache.shiro.codec.Base64;
  2. import org.apache.shiro.codec.CodecSupport;
  3. import org.apache.shiro.codec.Hex;
  4. import org.apache.shiro.util.ByteSource;
  6. import java.io.File;
  7. import java.io.InputStream;
  8. import java.io.Serializable;
  9. import java.util.Arrays;
  10. //自定义salt实现 实现序列化接口
  11. public class MyByteSource implements ByteSource, Serializable {
  12.     private  byte[] bytes;
  13.     private String cachedHex;
  14.     private String cachedBase64;
  16.     public MyByteSource(byte[] bytes) {
  17.         this.bytes = bytes;
  18.     }
  20.     public MyByteSource(char[] chars) {
  21.         this.bytes = CodecSupport.toBytes(chars);
  22.     }
  24.     public MyByteSource(String string) {
  25.         this.bytes = CodecSupport.toBytes(string);
  26.     }
  28.     public MyByteSource(ByteSource source) {
  29.         this.bytes = source.getBytes();
  30.     }
  32.     public MyByteSource(File file) {
  33.         this.bytes = (new MyByteSource.BytesHelper()).getBytes(file);
  34.     }
  36.     public MyByteSource(InputStream stream) {
  37.         this.bytes = (new MyByteSource.BytesHelper()).getBytes(stream);
  38.     }
  40.     public static boolean isCompatible(Object o) {
  41.         return o instanceof byte[] || o instanceof char[] || o instanceof String || o instanceof ByteSource || o instanceof File || o instanceof InputStream;
  42.     }
  44.     public byte[] getBytes() {
  45.         return this.bytes;
  46.     }
  48.     public boolean isEmpty() {
  49.         return this.bytes == null || this.bytes.length == 0;
  50.     }
  52.     public String toHex() {
  53.         if (this.cachedHex == null) {
  54.             this.cachedHex = Hex.encodeToString(this.getBytes());
  55.         }
  57.         return this.cachedHex;
  58.     }
  60.     public String toBase64() {
  61.         if (this.cachedBase64 == null) {
  62.             this.cachedBase64 = Base64.encodeToString(this.getBytes());
  63.         }
  65.         return this.cachedBase64;
  66.     }
  68.     public String toString() {
  69.         return this.toBase64();
  70.     }
  72.     public int hashCode() {
  73.         return this.bytes != null && this.bytes.length != 0 ? Arrays.hashCode(this.bytes) : 0;
  74.     }
  76.     public boolean equals(Object o) {
  77.         if (o == this) {
  78.             return true;
  79.         } else if (o instanceof ByteSource) {
  80.             ByteSource bs = (ByteSource)o;
  81.             return Arrays.equals(this.getBytes(), bs.getBytes());
  82.         } else {
  83.             return false;
  84.         }
  85.     }
  87.     private static final class BytesHelper extends CodecSupport {
  88.         private BytesHelper() {
  89.         }
  91.         public byte[] getBytes(File file) {
  92.             return this.toBytes(file);
  93.         }
  95.         public byte[] getBytes(InputStream stream) {
  96.             return this.toBytes(stream);
  97.         }
  98.     }
  99. }

验证码

  1. import javax.imageio.ImageIO;
  2. import java.awt.*;
  3. import java.awt.geom.AffineTransform;
  4. import java.awt.image.BufferedImage;
  5. import java.io.File;
  6. import java.io.FileOutputStream;
  7. import java.io.IOException;
  8. import java.io.OutputStream;
  9. import java.util.Arrays;
  10. import java.util.Random;
  12. /**
  13.  *@创建人  cx
  14.  *@创建时间  2018/11/27 17:36
  15.  *@描述   验证码生成
  16.  */
  17. public class VerifyCodeUtils{
  19.     //使用到Algerian字体，系统里没有的话需要安装字体，字体只显示大写，去掉了1,0,i,o几个容易混淆的字符
  20.     public static final String VERIFY_CODES = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
  21.     private static Random random = new Random();
  24.     /**
  25.      * 使用系统默认字符源生成验证码
  26.      * @param verifySize    验证码长度
  27.      * @return
  28.      */
  29.     public static String generateVerifyCode(int verifySize){
  30.         return generateVerifyCode(verifySize, VERIFY_CODES);
  31.     }
  32.     /**
  33.      * 使用指定源生成验证码
  34.      * @param verifySize    验证码长度
  35.      * @param sources   验证码字符源
  36.      * @return
  37.      */
  38.     public static String generateVerifyCode(int verifySize, String sources){
  39.         if(sources == null || sources.length() == 0){
  40.             sources = VERIFY_CODES;
  41.         }
  42.         int codesLen = sources.length();
  43.         Random rand = new Random(System.currentTimeMillis());
  44.         StringBuilder verifyCode = new StringBuilder(verifySize);
  45.         for(int i = 0; i < verifySize; i++){
  46.             verifyCode.append(sources.charAt(rand.nextInt(codesLen-1)));
  47.         }
  48.         return verifyCode.toString();
  49.     }
  51.     /**
  52.      * 生成随机验证码文件,并返回验证码值
  53.      * @param w
  54.      * @param h
  55.      * @param outputFile
  56.      * @param verifySize
  57.      * @return
  58.      * @throws IOException
  59.      */
  60.     public static String outputVerifyImage(int w, int h, File outputFile, int verifySize) throws IOException{
  61.         String verifyCode = generateVerifyCode(verifySize);
  62.         outputImage(w, h, outputFile, verifyCode);
  63.         return verifyCode;
  64.     }
  66.     /**
  67.      * 输出随机验证码图片流,并返回验证码值
  68.      * @param w
  69.      * @param h
  70.      * @param os
  71.      * @param verifySize
  72.      * @return
  73.      * @throws IOException
  74.      */
  75.     public static String outputVerifyImage(int w, int h, OutputStream os, int verifySize) throws IOException{
  76.         String verifyCode = generateVerifyCode(verifySize);
  77.         outputImage(w, h, os, verifyCode);
  78.         return verifyCode;
  79.     }
  81.     /**
  82.      * 生成指定验证码图像文件
  83.      * @param w
  84.      * @param h
  85.      * @param outputFile
  86.      * @param code
  87.      * @throws IOException
  88.      */
  89.     public static void outputImage(int w, int h, File outputFile, String code) throws IOException{
  90.         if(outputFile == null){
  91.             return;
  92.         }
  93.         File dir = outputFile.getParentFile();
  94.         if(!dir.exists()){
  95.             dir.mkdirs();
  96.         }
  97.         try{
  98.             outputFile.createNewFile();
  99.             FileOutputStream fos = new FileOutputStream(outputFile);
  100.             outputImage(w, h, fos, code);
  101.             fos.close();
  102.         } catch(IOException e){
  103.             throw e;
  104.         }
  105.     }
  107.     /**
  108.      * 输出指定验证码图片流
  109.      * @param w
  110.      * @param h
  111.      * @param os
  112.      * @param code
  113.      * @throws IOException
  114.      */
  115.     public static void outputImage(int w, int h, OutputStream os, String code) throws IOException{
  116.         int verifySize = code.length();
  117.         BufferedImage image = new BufferedImage(w, h, BufferedImage.TYPE_INT_RGB);
  118.         Random rand = new Random();
  119.         Graphics2D g2 = image.createGraphics();
  120.         g2.setRenderingHint(RenderingHints.KEY_ANTIALIASING,RenderingHints.VALUE_ANTIALIAS_ON);
  121.         Color[] colors = new Color[5];
  122.         Color[] colorSpaces = new Color[] { Color.WHITE, Color.CYAN,
  123.                 Color.GRAY, Color.LIGHT_GRAY, Color.MAGENTA, Color.ORANGE,
  124.                 Color.PINK, Color.YELLOW };
  125.         float[] fractions = new float[colors.length];
  126.         for(int i = 0; i < colors.length; i++){
  127.             colors[i] = colorSpaces[rand.nextInt(colorSpaces.length)];
  128.             fractions[i] = rand.nextFloat();
  129.         }
  130.         Arrays.sort(fractions);
  132.         g2.setColor(Color.GRAY);// 设置边框色
  133.         g2.fillRect(0, 0, w, h);
  135.         Color c = getRandColor(200, 250);
  136.         g2.setColor(c);// 设置背景色
  137.         g2.fillRect(0, 2, w, h-4);
  139.         //绘制干扰线
  140.         Random random = new Random();
  141.         g2.setColor(getRandColor(160, 200));// 设置线条的颜色
  142.         for (int i = 0; i < 20; i++) {
  143.             int x = random.nextInt(w - 1);
  144.             int y = random.nextInt(h - 1);
  145.             int xl = random.nextInt(6) + 1;
  146.             int yl = random.nextInt(12) + 1;
  147.             g2.drawLine(x, y, x + xl + 40, y + yl + 20);
  148.         }
  150.         // 添加噪点
  151.         float yawpRate = 0.05f;// 噪声率
  152.         int area = (int) (yawpRate * w * h);
  153.         for (int i = 0; i < area; i++) {
  154.             int x = random.nextInt(w);
  155.             int y = random.nextInt(h);
  156.             int rgb = getRandomIntColor();
  157.             image.setRGB(x, y, rgb);
  158.         }
  160.         shear(g2, w, h, c);// 使图片扭曲
  162.         g2.setColor(getRandColor(100, 160));
  163.         int fontSize = h-4;
  164.         Font font = new Font("Algerian", Font.ITALIC, fontSize);
  165.         g2.setFont(font);
  166.         char[] chars = code.toCharArray();
  167.         for(int i = 0; i < verifySize; i++){
  168.             AffineTransform affine = new AffineTransform();
  169.             affine.setToRotation(Math.PI / 4 * rand.nextDouble() * (rand.nextBoolean() ? 1 : -1), (w / verifySize) * i + fontSize/2, h/2);
  170.             g2.setTransform(affine);
  171.             g2.drawChars(chars, i, 1, ((w-10) / verifySize) * i + 5, h/2 + fontSize/2 - 10);
  172.         }
  174.         g2.dispose();
  175.         ImageIO.write(image, "jpg", os);
  176.     }
  178.     private static Color getRandColor(int fc, int bc) {
  179.         if (fc > 255)
  180.             fc = 255;
  181.         if (bc > 255)
  182.             bc = 255;
  183.         int r = fc + random.nextInt(bc - fc);
  184.         int g = fc + random.nextInt(bc - fc);
  185.         int b = fc + random.nextInt(bc - fc);
  186.         return new Color(r, g, b);
  187.     }
  189.     private static int getRandomIntColor() {
  190.         int[] rgb = getRandomRgb();
  191.         int color = 0;
  192.         for (int c : rgb) {
  193.             color = color << 8;
  194.             color = color | c;
  195.         }
  196.         return color;
  197.     }
  199.     private static int[] getRandomRgb() {
  200.         int[] rgb = new int[3];
  201.         for (int i = 0; i < 3; i++) {
  202.             rgb[i] = random.nextInt(255);
  203.         }
  204.         return rgb;
  205.     }
  207.     private static void shear(Graphics g, int w1, int h1, Color color) {
  208.         shearX(g, w1, h1, color);
  209.         shearY(g, w1, h1, color);
  210.     }
  212.     private static void shearX(Graphics g, int w1, int h1, Color color) {
  214.         int period = random.nextInt(2);
  216.         boolean borderGap = true;
  217.         int frames = 1;
  218.         int phase = random.nextInt(2);
  220.         for (int i = 0; i < h1; i++) {
  221.             double d = (double) (period >> 1)
  222.                     * Math.sin((double) i / (double) period
  223.                     + (6.2831853071795862D * (double) phase)
  224.                     / (double) frames);
  225.             g.copyArea(0, i, w1, 1, (int) d, 0);
  226.             if (borderGap) {
  227.                 g.setColor(color);
  228.                 g.drawLine((int) d, i, 0, i);
  229.                 g.drawLine((int) d + w1, i, w1, i);
  230.             }
  231.         }
  233.     }
  235.     private static void shearY(Graphics g, int w1, int h1, Color color) {
  237.         int period = random.nextInt(40) + 10; // 50;
  239.         boolean borderGap = true;
  240.         int frames = 20;
  241.         int phase = 7;
  242.         for (int i = 0; i < w1; i++) {
  243.             double d = (double) (period >> 1)
  244.                     * Math.sin((double) i / (double) period
  245.                     + (6.2831853071795862D * (double) phase)
  246.                     / (double) frames);
  247.             g.copyArea(i, 0, 1, h1, 0, (int) d);
  248.             if (borderGap) {
  249.                 g.setColor(color);
  250.                 g.drawLine(i, (int) d, i, 0);
  251.                 g.drawLine(i, (int) d + h1, i, h1);
  252.             }
  254.         }
  256.     }
  257.     public static void main(String[] args) throws IOException {
  258.         //获取验证码
  259.         String s = generateVerifyCode(4);
  260.         //将验证码放入图片中
  261.         outputImage(260,60,new File("/Users/chenyannan/Desktop/安工资料/aa.jpg"),s);
  262.         System.out.println(s);
  263.     }
  264. }
  1. @RequestMapping("getImage")
  2. public void getImage(HttpSession session, HttpServletResponse response) throws IOException {
  3.   //生成验证码
  4.   String code = VerifyCodeUtils.generateVerifyCode(4);
  5.   //验证码放入session
  6.   session.setAttribute("code",code);
  7.   //验证码存入图片
  8.   ServletOutputStream os = response.getOutputStream();
  9.   response.setContentType("image/png");
  10.   VerifyCodeUtils.outputImage(220,60,os,code);
  11. }
  1. @RequestMapping("login")
  2. public String login(String username, String password,String code,HttpSession session) {
  3.     //比较验证码
  4.     String codes = (String) session.getAttribute("code");
  5.     try {
  6.         if (codes.equalsIgnoreCase(code)){
  7.             //获取主体对象
  8.             Subject subject = SecurityUtils.getSubject();
  9.                 subject.login(new UsernamePasswordToken(username, password));
  10.                 return "redirect:/index.jsp";
  11.         }else{
  12.             throw new RuntimeException("验证码错误!");
  13.         }
  14.     } catch (UnknownAccountException e) {
  15.         e.printStackTrace();
  16.         System.out.println("用户名错误!");
  17.     } catch (IncorrectCredentialsException e) {
  18.         e.printStackTrace();
  19.         System.out.println("密码错误!");
  20.     }catch (Exception e){
  21.         e.printStackTrace();
  22.         System.out.println(e.getMessage());
  23.     }
  24.     return "redirect:/login.jsp";
  25. }