博さん
博さん

shiro学习笔记：整合spring之拦截器链执行流程

一、环境准备

搭建好spring + shiro整合环境（本文环境Spring 4.3.10.RELEASE + Shiro 1.4.0）后，编写登录页面如下： 


登录页



${shiroLoginFailure}

	

		用户名：
 
		密码：
shiro拦截器部分配置： 
    
    
        
        
        
    
    
    
    
    
        
        
        
        
            
                
            
        
        
            
                /index.jsp = anon
                /unauthorized.jsp = anon
                /error.jsp = anon
                /login.jsp = authc
                /logout = logout
                /** = user
shiro拦截器树状结构如下图：

shiro学习笔记：整合spring之拦截器链执行流程_第1张图片

其中几个主要的拦截：OnceperRequestFilter、AbstractShiroFilter、AdviceFilter、PathMatchingFilter、AccessControlFilter、AuthenticationFilter、AuthorizationFilter等构成shiro的拦截器基本架构。

（-- 关于各shiro各个拦截器的简单介绍可参考博文：Apache Shiro学习笔记（六）Shiro Filter介绍）

二、初始化过程

启动项目时spring首先会通过doGetObjectFromFactoryBean()方法来初始化Shiro的拦截器入口工厂类，即org.apache.shiro.spring.web.ShiroFilterFactoryBean： 
/**
 * Obtain an object to expose from the given FactoryBean.
 * @param factory the FactoryBean instance
 * @param beanName the name of the bean
 * @return the object obtained from the FactoryBean
 * @throws BeanCreationException if FactoryBean object creation failed
 * @see org.springframework.beans.factory.FactoryBean#getObject()
 */
private Object doGetObjectFromFactoryBean(final FactoryBean factory, 
	final String beanName) throws BeanCreationException {
	Object object;
	try {
		if (System.getSecurityManager() != null) {
			AccessControlContext acc = getAccessControlContext();
			try {
				object = AccessController.doPrivileged(new PrivilegedExceptionAction() {
					@Override
					public Object run() throws Exception {
						return factory.getObject();
					}
				}, acc);
			} catch (PrivilegedActionException pae) {
				throw pae.getException();
			}
		} else {
			// 调用工厂方法生成实例
			object = factory.getObject();
		}
	} catch (FactoryBeanNotInitializedException ex) {
		throw new BeanCurrentlyInCreationException(beanName, ex.toString());
	} catch (Throwable ex) {
		throw new BeanCreationException(beanName, "FactoryBean threw exception on object creation", ex);
	}
	// Do not accept a null value for a FactoryBean that's not fully
	// initialized yet: Many FactoryBeans just return null then.
	if (object == null && isSingletonCurrentlyInCreation(beanName)) {
		throw new BeanCurrentlyInCreationException(beanName, "FactoryBean which is currently in creation returned null from getObject");
	}
	return object;
} 
   
  

    ShiroFilterFactoryBean提供的获取实例的工厂方法： 
   
/**
 * Lazily creates and returns a {@link AbstractShiroFilter} concrete instance via the
 * {@link #createInstance} method.
 *
 * @return the application's Shiro Filter instance used to filter incoming web requests.
 * @throws Exception if there is a problem creating the {@code Filter} instance.
 */
public Object getObject() throws Exception {
    if (instance == null) {
        instance = createInstance();
    }
    return instance;
}
 
  
 
  

    最终会通过调用ShiroFilterFactoryBean的createInstance(）方法初始化shiro拦截器入口类： 
   
protected AbstractShiroFilter createInstance() throws Exception {

    log.debug("Creating Shiro Filter instance.");
    // 获取的是配置的DefaultWebSecurityManager实例
    SecurityManager securityManager = getSecurityManager();
    if (securityManager == null) {
        String msg = "SecurityManager property must be set.";
        throw new BeanInitializationException(msg);
    }

    if (!(securityManager instanceof WebSecurityManager)) {
        String msg = "The security manager does not implement the WebSecurityManager interface.";
        throw new BeanInitializationException(msg);
    }
    // 创建负责维护URL模式与拦截器链关系的DefaultFilterChainManager实例
    FilterChainManager manager = createFilterChainManager();

    //Expose the constructed FilterChainManager by first wrapping it in a
    // FilterChainResolver implementation. The AbstractShiroFilter implementations
    // do not know about FilterChainManagers - only resolvers:
    // 创建shiro提供的唯一FilterChainResolver实现，用于解析访问路径所对应的拦截器链
    PathMatchingFilterChainResolver chainResolver = new PathMatchingFilterChainResolver();
    chainResolver.setFilterChainManager(manager);

    //Now create a concrete ShiroFilter instance and apply the acquired SecurityManager and built
    //FilterChainResolver.  It doesn't matter that the instance is an anonymous inner class
    //here - we're just using it because it is a concrete AbstractShiroFilter instance that accepts
    //injection of the SecurityManager and FilterChainResolver:
    // 最终返回的是SpringShiroFilter实例(ShiroFilterFactoryBean的内部类)
    return new SpringShiroFilter((WebSecurityManager) securityManager, chainResolver);
}
 
  
 
  

    接下来看看shiro在createFilterChainManager()方法如何创建FilterChainManager实例： 
   
protected FilterChainManager createFilterChainManager() {
    // 创建的是shiro默认的DefaultFilterChainManager实例(构造方法内初始化默认拦截器)
    DefaultFilterChainManager manager = new DefaultFilterChainManager();
    // 获取shiro默认的拦截器Map<拦截路径,拦截器>映射集合
    Map defaultFilters = manager.getFilters();
    // Apply global settings if necessary:(为默认拦截器设置通用属性例如loginUrl,unauthroizedUrl等)
    for (Filter filter : defaultFilters.values()) {
        applyGlobalPropertiesIfNecessary(filter);
    }
    // Apply the acquired and/or configured filters:获取配置文件中filters属性配置的拦截器Map集合
    Map filters = getFilters();
    // 处理自定义的拦截器
    if (!CollectionUtils.isEmpty(filters)) {
        for (Map.Entry entry : filters.entrySet()) {
            String name = entry.getKey();
            Filter filter = entry.getValue();
            applyGlobalPropertiesIfNecessary(filter);
            if (filter instanceof Nameable) {
                ((Nameable) filter).setName(name);
            }
            // 'init' argument is false, since Spring-configured filters should be initialized
            // in Spring (i.e. 'init-method=blah') or implement InitializingBean:
            // 将自定义拦截器加入FilterChainManager中的拦截器Map<拦截器名，拦截器实例>
            manager.addFilter(name, filter, false);
        }
    }
    // build up the chains:获取自定义拦截器链Map交由Manager管理(对应的配置文件属性是filterChainDefinitions)
    Map chains = getFilterChainDefinitionMap();
    if (!CollectionUtils.isEmpty(chains)) {
        for (Map.Entry entry : chains.entrySet()) {
            String url = entry.getKey();// 配置的URL
            String chainDefinition = entry.getValue();// 该URL对应的拦截器实例
            // 解析filterChainDefinitions配置：每一个配置的URL对应一个shiro代理拦截器链
            // 并将解析的每一个拦截器链交由DefaultFilterChainManager的Map管理
            manager.createChain(url, chainDefinition);
        }
    }
    return manager;
}
 
  
 
  

    shiro默认拦截器链管理器DefaultFilterChainManager的初始化构造方法： 
  
 
  
 
   
// DefaultFilterChainManager在初始化时添加默认拦截器
public DefaultFilterChainManager() {
    // 此处初始化拦截器Map<拦截器名称，拦截器实例>：这里保存所有的默认以及自定义的拦截器
    this.filters = new LinkedHashMap();
    // 此处初始化拦截器链Map<拦截器链名称(拦截路径)，拦截器集合>：这里保存所有自定义的拦截器链所对应的拦截器集合
    this.filterChains = new LinkedHashMap();
    addDefaultFilters(false);
}

// DefaultFilter是一个枚举类，定义了shiro的所有默认拦截器
protected void addDefaultFilters(boolean init) {
    for (DefaultFilter defaultFilter : DefaultFilter.values()) {
    	// 将所有默认拦截器加入filters集合中
        addFilter(defaultFilter.name(), defaultFilter.newInstance(), init, false);
    }
}
 
  
 
  

    启动时解析拦截器链定义的set方法： 
  
 
  
 
   
/**
 * A convenience method that sets the {@link #setFilterChainDefinitionMap(java.util.Map) filterChainDefinitionMap}
 * property by accepting a {@link java.util.Properties Properties}-compatible string (multi-line key/value pairs).
 * Each key/value pair must conform to the format defined by the
 * {@link FilterChainManager#createChain(String,String)} JavaDoc - each property key is an ant URL
 * path expression and the value is the comma-delimited chain definition.
 *
 * @param definitions a {@link java.util.Properties Properties}-compatible string (multi-line key/value pairs)
 *                    where each key/value pair represents a single urlPathExpression-commaDelimitedChainDefinition.
 */
// ShiroFilterFactoryBean的setFilterChainDefinitions方法：解析配置的"filterChainDefinitions"属性
public void setFilterChainDefinitions(String definitions) {
    Ini ini = new Ini();
    ini.load(definitions);
    //did they explicitly state a 'urls' section?  Not necessary, but just in case:
    Ini.Section section = ini.getSection(IniFilterChainResolverFactory.URLS);
    if (CollectionUtils.isEmpty(section)) {
        //no urls section.  Since this _is_ a urls chain definition property, just assume the
        //default section contains only the definitions:
        section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
    }
    // 最后解析为Map<拦截路径，拦截器链定义>并调用set方法初始化
    setFilterChainDefinitionMap(section);
}

/**
 * Sets the chainName-to-chainDefinition map of chain definitions to use for creating filter chains intercepted
 * by the Shiro Filter.  Each map entry should conform to the format defined by the
 * {@link FilterChainManager#createChain(String, String)} JavaDoc, where the map key is the chain name (e.g. URL
 * path expression) and the map value is the comma-delimited string chain definition.
 *
 * @param filterChainDefinitionMap the chainName-to-chainDefinition map of chain definitions to use for creating
 *                                 filter chains intercepted by the Shiro Filter.
 */
// ShiroFilterFactoryBean的set方法：初始化拦截器定义Map
public void setFilterChainDefinitionMap(Map filterChainDefinitionMap) {
    this.filterChainDefinitionMap = filterChainDefinitionMap;
}
 
  
 
  

    Shiro声明的默认拦截器枚举类： 
  
 
  
 
   
public enum DefaultFilter {
    anon(AnonymousFilter.class),
    authc(FormAuthenticationFilter.class),
    authcBasic(BasicHttpAuthenticationFilter.class),
    logout(LogoutFilter.class),
    noSessionCreation(NoSessionCreationFilter.class),
    perms(PermissionsAuthorizationFilter.class),
    port(PortFilter.class),
    rest(HttpMethodPermissionFilter.class),
    roles(RolesAuthorizationFilter.class),
    ssl(SslFilter.class),
    user(UserFilter.class);

    private final Class filterClass;

    private DefaultFilter(Class filterClass) {
        this.filterClass = filterClass;
    }

    public Filter newInstance() {
        return (Filter) ClassUtils.newInstance(this.filterClass);
    }

    public Class getFilterClass() {
        return this.filterClass;
    }

    public static Map createInstanceMap(FilterConfig config) {
        Map filters = new LinkedHashMap(values().length);
        for (DefaultFilter defaultFilter : values()) {
            Filter filter = defaultFilter.newInstance();
            if (config != null) {
                try {
                    filter.init(config);
                } catch (ServletException e) {
                    String msg = "Unable to correctly init default filter instance of type " + filter.getClass().getName();
                    throw new IllegalStateException(msg, e);
                }
            }
            filters.put(defaultFilter.name(), filter);
        }
    return filters;
    }
}
 
   
再看Shiro如何通过DefaultFilterChainManager的createChain方法初始化拦截器链：
 
   
/**
 * @param chainName 拦截器链名称，即拦截路径
 * @param chainDefinition 拦截器链定义，即配置的以逗号分割的拦截器定义字符串
 */
public void createChain(String chainName, String chainDefinition) {
    if (!StringUtils.hasText(chainName)) {
        throw new NullPointerException("chainName cannot be null or empty.");
    }
    if (!StringUtils.hasText(chainDefinition)) {
        throw new NullPointerException("chainDefinition cannot be null or empty.");
    }

    if (log.isDebugEnabled()) {
        log.debug("Creating chain [" + chainName + "] from String definition [" + chainDefinition + "]");
    }

    //parse the value by tokenizing it to get the resulting filter-specific config entries
    //
    //e.g. for a value of
    //
    //     "authc, roles[admin,user], perms[file:edit]"
    //
    // the resulting token array would equal
    //
    //     { "authc", "roles[admin,user]", "perms[file:edit]" }
    //
    // 参照以上英文，即以逗号分割解析拦截器链定义得到拦截器定义数组
    String[] filterTokens = splitChainDefinition(chainDefinition);
    //each token is specific to each filter.
    //strip the name and extract any filter-specific config between brackets [ ]
    for (String token : filterTokens) {
        // 解析拦截器定义(例如authc[bar,baz])得到拦截器名称及其参数的数组即：array[0]="authc",array[1]="bar,baz"
        String[] nameConfigPair = toNameConfigPair(token);
        // now we have the filter name, path and (possibly null) path-specific config.  Let's apply them:
        // 根据拦截器链名称(拦截URL)，拦截器名称，拦截器参数(可选)，初始化拦截器链
        addToChain(chainName, nameConfigPair[0], nameConfigPair[1]);
    }
}

// 初始化的重载方法如下：
public void addToChain(String chainName, String filterName, String chainSpecificFilterConfig) {
    if (!StringUtils.hasText(chainName)) {
        throw new IllegalArgumentException("chainName cannot be null or empty.");
    }
    // 从之前初始化的Map拦截器集合中获取拦截器实例
    Filter filter = getFilter(filterName);
    if (filter == null) {
        throw new IllegalArgumentException("There is no filter with name '" + filterName +
                "' to apply to chain [" + chainName + "] in the pool of available Filters.  Ensure a " +
                "filter with that name/path has first been registered with the addFilter method(s).");
    }
    // 应用当前拦截器参数配置
    applyChainConfig(chainName, filter, chainSpecificFilterConfig);
    // 确保拦截器链不为NULL，返回的是该拦截器链对应的拦截器List集合
    NamedFilterList chain = ensureChain(chainName);
    // 将当前拦截器加入拦截器List集合
    chain.add(filter);
}
 
   

     Shiro通过DefaultFilterChainManager的applyChainConfig()方法设置各个拦截器的配置参数： 
   
 
  
 
  
 
   
// DefaultFilterChainManager的applyChainConfig()方法
protected void applyChainConfig(String chainName, Filter filter, String chainSpecificFilterConfig) {
    if (log.isDebugEnabled()) {
        log.debug("Attempting to apply path [" + chainName + "] to filter [" + filter + "] " +
                "with config [" + chainSpecificFilterConfig + "]");
    }
    // 判断当前拦截器是否是PathConfigProcessor类型
    // shiro默认的拦截器中除logout外均继承至PathMatchingFilter,而PathMatchingFilter实现了接口PathConfigProcessor
    if (filter instanceof PathConfigProcessor) {
        // 调用当前拦截器实例的processPathConfig方法处理拦截路径参数配置
        ((PathConfigProcessor) filter).processPathConfig(chainName, chainSpecificFilterConfig);
    } else {
        if (StringUtils.hasText(chainSpecificFilterConfig)) {
            // 如果拦截器不属于PathConfigProcessor类型且配有参数则会抛出异常
            //they specified a filter configuration, but the Filter doesn't implement PathConfigProcessor
            //this is an erroneous config:
            String msg = "chainSpecificFilterConfig was specified, but the underlying " +
                    "Filter instance is not an 'instanceof' " +
                    PathConfigProcessor.class.getName() + ".  This is required if the filter is to accept " +
                    "chain-specific configuration.";
            throw new ConfigurationException(msg);
        }
    }
}
 
   

     执行拦截器自己的processPathConfig()方法： 
   
 
   
 
    
/**
 * Splits any comma-delmited values that might be found in the config argument and sets the resulting
 * String[] array on the appliedPaths internal Map.
 * 

 * That is:
 * 

 * String[] values = null;
 * if (config != null) {
 *     values = split(config);
 * }
 * 

 * this.{@link #appliedPaths appliedPaths}.put(path, values);
 * 

 *
 * @param path   the application context path to match for executing this filter.
 * @param config the specified for this particular filter only for the given path
 * @return this configured filter.
 */
// PathMatchingFilter的processPathConfig方法(实现PathConfigProcessor接口的方法)
public Filter processPathConfig(String path, String config) {
    String[] values = null;
    if (config != null) {
    	// 按照逗号分隔符继续分解配置参数
        values = split(config);
    }
    // 将<拦截路径-配置参数>放入当前拦截器实例的Map集合(继承至父类PathMatchingFilter的属性)
    // 当以后触发拦截器时即可根据拦截路径获取参数配置进行相关处理，如果没有配置则values存null
    this.appliedPaths.put(path, values);
    return this;
}

/**
 * A collection of path-to-config entries where the key is a path which this filter should process and
 * the value is the (possibly null) configuration element specific to this Filter for that specific path.
 * 

 * 
To put it another way, the keys are the paths (urls) that this Filter will process.
 * 
The values are filter-specific data that this Filter should use when processing the corresponding
 * key (path).  The values can be null if no Filter-specific config was specified for that url.
 */
// PathMatchingFilter的拦截路径参数配置Map<拦截路径，配置参数>集合
protected Map appliedPaths = new LinkedHashMap();
 
   
保险方法ensureChain()确保拦截器链不为空： 
  
 
  
 
   
// DefaultFilterChainManager的ensureChain方法
protected NamedFilterList ensureChain(String chainName) {
    // 根据拦截器链名称从拦截器链Map集合中获取对应的拦截器集合
    NamedFilterList chain = getChain(chainName);
    if (chain == null) {
        // 如果不存在则进行初始化
        chain = new SimpleNamedFilterList(chainName);
        this.filterChains.put(chainName, chain);
    }
    return chain;
}

public NamedFilterList getChain(String chainName) {
    return this.filterChains.get(chainName);
}
 
   
三、拦截过程浅析
 
   

     这里首先以访问工程路径为例，即http://127.0.0.1:8082/shiro02。在debug模式下，首先进入到拦截器的doFilter()方法，实际上这个拦截器实例就是上面提到的createInstance()方法创建的SpringShiroFilter拦截器实例，这个类继承至AbstractShiroFilter，是ShiroFilterFactoryBean的内部类，具体请参考上面的类结构图。 
   
 
  
 
  
 
   
/**
 * This {@code doFilter} implementation stores a request attribute for
 * "already filtered", proceeding without filtering again if the
 * attribute is already there.
 *
 * @see #getAlreadyFilteredAttributeName
 * @see #shouldNotFilter
 * @see #doFilterInternal
 */
// 当前进入的拦截方法是其父类OncePerRequestFilter的doFilter方法
public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
    // 获取当前拦截器实例的标识名称，用于标识其是否已经执行过
    String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
    // 判断如果已经当前拦截器已经执行过则执行下一个拦截器
    if ( request.getAttribute(alreadyFilteredAttributeName) != null ) {
        log.trace("Filter '{}' already executed.  Proceeding without invoking this filter.", getName());
        filterChain.doFilter(request, response);
    // 判断当前拦截器是否已经开启(配置文件可配,默认开启) (shouldNotFilter()方法已废弃返回值固定为false)
    } else //noinspection deprecation
        if (/* added in 1.2: */ !isEnabled(request, response) ||
            /* retain backwards compatibility: */ shouldNotFilter(request) ) {
        log.debug("Filter '{}' is not enabled for the current request.  Proceeding without invoking this filter.",
                getName());
        filterChain.doFilter(request, response);
    // 如果当前拦截器没有执行且设置为开启拦截，则进入拦截器方法
    } else {
        // Do invoke this filter...
        log.trace("Filter '{}' not yet executed.  Executing now.", getName());
        // 标识当前拦截器已经执行过
        request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
        try {
            // 执行过滤逻辑,这里调用的是其父类AbstractShiroFilter的方法
            doFilterInternal(request, response, filterChain);
        } finally {
            // Once the request has finished, we're done and we don't need to mark as 'already filtered' any more.
            request.removeAttribute(alreadyFilteredAttributeName);
        }
    }
}
下面进入doFilterInternal()方法： 
  
 
  
 
   
/**
 * {@code doFilterInternal} implementation that sets-up, executes, and cleans-up a Shiro-filtered request.  It
 * performs the following ordered operations:
 * 
    
 * 
  1. {@link #prepareServletRequest(ServletRequest, ServletResponse, FilterChain) Prepares}
 * the incoming {@code ServletRequest} for use during Shiro's processing
    2. 
 * 
  2. {@link #prepareServletResponse(ServletRequest, ServletResponse, FilterChain) Prepares}
 * the outgoing {@code ServletResponse} for use during Shiro's processing
    3. 
 * 
  3.  {@link #createSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) Creates} a
 * {@link Subject} instance based on the specified request/response pair.
    4. 
 * 
  4. Finally {@link Subject#execute(Runnable) executes} the
 * {@link #updateSessionLastAccessTime(javax.servlet.ServletRequest, javax.servlet.ServletResponse)} and
 * {@link #executeChain(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)}
 * methods
    5. 
 * 

 * 

 * The {@code Subject.}{@link Subject#execute(Runnable) execute(Runnable)} call in step #4 is used as an
 * implementation technique to guarantee proper thread binding and restoration is completed successfully.
 *
 * @param servletRequest  the incoming {@code ServletRequest}
 * @param servletResponse the outgoing {@code ServletResponse}
 * @param chain           the container-provided {@code FilterChain} to execute
 * @throws IOException                    if an IO error occurs
 * @throws javax.servlet.ServletException if an Throwable other than an IOException
 */
// 当前为SpringShiroFilter拦截器的父类AbstractShiroFilter的doFilterInternal方法
protected void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse, final FilterChain chain)
        throws ServletException, IOException {
    Throwable t = null;
    try {
        // Shiro在此对HttpServletRequest、HttpServletResponse进行封装
        final ServletRequest request = prepareServletRequest(servletRequest, servletResponse, chain);
        final ServletResponse response = prepareServletResponse(request, servletResponse, chain);
        // 创建subject实例
        final Subject subject = createSubject(request, response);
        // noinspection unchecked
        // 执行回调，最终执行的是下面的call()方法
        subject.execute(new Callable() {
            public Object call() throws Exception {
                // 更新session最后活动时间
                updateSessionLastAccessTime(request, response);
                // 执行拦截器链
                executeChain(request, response, chain);
                return null;
            }
        });
    } catch (ExecutionException ex) {
        t = ex.getCause();
    } catch (Throwable throwable) {
        t = throwable;
    }
    if (t != null) {
        if (t instanceof ServletException) {
            throw (ServletException) t;
        }
        if (t instanceof IOException) {
            throw (IOException) t;
        }
        //otherwise it's not one of the two exceptions expected by the filter method signature - wrap it in one:
        String msg = "Filtered request failed.";
        throw new ServletException(msg, t);
    }
}
 
   
/**
 * Executes a {@link FilterChain} for the given request.
 * 

 * This implementation first delegates to
 * {@link #getExecutionChain(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain) getExecutionChain}
 * to allow the application's Shiro configuration to determine exactly how the chain should execute.  The resulting
 * value from that call is then executed directly by calling the returned {@code FilterChain}'s
 * {@link FilterChain#doFilter doFilter} method.  That is:
 * 
 * FilterChain chain = {@link #getExecutionChain}(request, response, origChain);
 * chain.{@link FilterChain#doFilter doFilter}(request,response);

 *
 * @param request   the incoming ServletRequest
 * @param response  the outgoing ServletResponse
 * @param origChain the Servlet Container-provided chain that may be wrapped further by an application-configured
 *                  chain of Filters.
 * @throws IOException      if the underlying {@code chain.doFilter} call results in an IOException
 * @throws ServletException if the underlying {@code chain.doFilter} call results in a ServletException
 * @since 1.0
 */
// 当前为SpringShiroFilter拦截器的父类AbstractShiroFilter的executeChain方法
protected void executeChain(ServletRequest request, ServletResponse response, FilterChain origChain)
        throws IOException, ServletException {
    // 获取当前请求对应的拦截器链
    FilterChain chain = getExecutionChain(request, response, origChain);
    // 执行拦截器链
    chain.doFilter(request, response);
}
 
   
/**
 * Returns the {@code FilterChain} to execute for the given request.
 * 

 * The {@code origChain} argument is the
 * original {@code FilterChain} supplied by the Servlet Container, but it may be modified to provide
 * more behavior by pre-pending further chains according to the Shiro configuration.
 * 

 * This implementation returns the chain that will actually be executed by acquiring the chain from a
 * {@link #getFilterChainResolver() filterChainResolver}.  The resolver determines exactly which chain to
 * execute, typically based on URL configuration.  If no chain is returned from the resolver call
 * (returns {@code null}), then the {@code origChain} will be returned by default.
 *
 * @param request   the incoming ServletRequest
 * @param response  the outgoing ServletResponse
 * @param origChain the original {@code FilterChain} provided by the Servlet Container
 * @return the {@link FilterChain} to execute for the given request
 * @since 1.0
 */
// 当前为SpringShiroFilter拦截器的父类AbstractShiroFilter的getExecuteChain方法
protected FilterChain getExecutionChain(ServletRequest request, ServletResponse response, FilterChain origChain) {
    FilterChain chain = origChain;
    // 获取默认的拦截器链解析实例：即初始化时设置的PathMatchingFilterChainResolver实例
    FilterChainResolver resolver = getFilterChainResolver();
    if (resolver == null) {
        log.debug("No FilterChainResolver configured.  Returning original FilterChain.");
        return origChain;
    }
    // 通过PathMatchingFilterChainResolver解析当前访问路径获取对应的拦截器链
    FilterChain resolved = resolver.getChain(request, response, origChain);
    if (resolved != null) {
        log.trace("Resolved a configured FilterChain for the current request.");
        chain = resolved;
    } else {
        log.trace("No FilterChain configured for the current request.  Using the default.");
    }
    return chain;
}
接下来看看Shiro如何解析并获得指定的拦截器链： 
  
 
  
 
   
// 当前方法为PathMatchingFilterChainResolver的getChain方法
public FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain) {
    // 获取拦截器链管理器实例：即初始化时设置的DefaultFilterChainManager实例
    FilterChainManager filterChainManager = getFilterChainManager();
    if (!filterChainManager.hasChains()) {
        return null;
    }
    // 获取当前请求访问的URI路径
    String requestURI = getPathWithinApplication(request);
    //the 'chain names' in this implementation are actually path patterns defined by the user.  We just use them
    //as the chain name for the FilterChainManager's requirements
    // 遍历拦截器链管理器中所有的拦截器链
    for (String pathPattern : filterChainManager.getChainNames()) {
        // If the path does match, then pass on to the subclass implementation for specific checks:
        if (pathMatches(pathPattern, requestURI)) {
            if (log.isTraceEnabled()) {
                log.trace("Matched path pattern [" + pathPattern + "] for requestURI [" + requestURI + "].  " +
                        "Utilizing corresponding filter chain...");
            }
            // 如果当前访问URI路径与配置的拦截器链的拦截路径匹配则返回代理后的拦截器链
            return filterChainManager.proxy(originalChain, pathPattern);
        }
    }
    return null;
}
再来看Shiro如何对拦截器链进行代理： 
  
 
  
 
   
/**
 * @param original 原始拦截器链
 * @param chainName 拦截器链名称(实际就是拦截路径)
 */
// 当前为DefaultFilterChainManager的proxy方法
public FilterChain proxy(FilterChain original, String chainName) {
    // 获取指定拦截路径对应的拦截器集合
    NamedFilterList configured = getChain(chainName);
    if (configured == null) {
        String msg = "There is no configured chain under the name/key [" + chainName + "].";
        throw new IllegalArgumentException(msg);
    }
    // 返回代理后的拦截器链
    return configured.proxy(original);
}

// DefaultFilterChainManager的getChain方法
public NamedFilterList getChain(String chainName) {
    // filterChains就是一个Map属性
    // NamedFilterList是Shiro存放拦截器链的继承List接口的集合
    return this.filterChains.get(chainName);
}
NamedFilterList接口声明了2个方法：getName()和proxy() 如下： 
  
 
  
 
   
/**
 * A {@code NamedFilterList} is a {@code List} of {@code Filter} instances that is uniquely identified by a
 * {@link #getName() name}.  It has the ability to generate new {@link FilterChain} instances reflecting this list's
 * filter order via the {@link #proxy proxy} method.
 *
 * @since 1.0
 */
public interface NamedFilterList extends List {

    /**
     * Returns the configuration-unique name assigned to this {@code Filter} list.
     *
     * @return the configuration-unique name assigned to this {@code Filter} list.
     */
    String getName();

    /**
     * Returns a new {@code FilterChain} instance that will first execute this list's {@code Filter}s (in list order)
     * and end with the execution of the given {@code filterChain} instance.
     *
     * @param filterChain the {@code FilterChain} instance to execute after this list's {@code Filter}s have executed.
     * @return a new {@code FilterChain} instance that will first execute this list's {@code Filter}s (in list order)
     *         and end with the execution of the given {@code filterChain} instance.
     */
    FilterChain proxy(FilterChain filterChain);
}
Shiro提供了NamedFilterList接口的通用实现SimpleNamedFilterList，所以最后实际调用的是该类的proxy()方法： 
  
 
  
 
   
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.shiro.web.filter.mgt;

import org.apache.shiro.util.StringUtils;
import org.apache.shiro.web.servlet.ProxiedFilterChain;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import java.util.*;

/**
 * Simple {@code NamedFilterList} implementation that is supported by a backing {@link List} instance and a simple
 * {@link #getName() name} property. All {@link List} method implementations are immediately delegated to the
 * wrapped backing list.
 *
 * @since 1.0
 */
public class SimpleNamedFilterList implements NamedFilterList {

    private String name;
    private List backingList;

    /**
     * Creates a new {@code SimpleNamedFilterList} instance with the specified {@code name}, defaulting to a new
     * {@link ArrayList ArrayList} instance as the backing list.
     *
     * @param name the name to assign to this instance.
     * @throws IllegalArgumentException if {@code name} is null or empty.
     */
    public SimpleNamedFilterList(String name) {
        this(name, new ArrayList());
    }

    /**
     * Creates a new {@code SimpleNamedFilterList} instance with the specified {@code name} and {@code backingList}.
     *
     * @param name        the name to assign to this instance.
     * @param backingList the list instance used to back all of this class's {@link List} method implementations.
     * @throws IllegalArgumentException if {@code name} is null or empty.
     * @throws NullPointerException     if the backing list is {@code null}.
     */
    public SimpleNamedFilterList(String name, List backingList) {
        if (backingList == null) {
            throw new NullPointerException("backingList constructor argument cannot be null.");
        }
        this.backingList = backingList;
        setName(name);
    }

    protected void setName(String name) {
        if (!StringUtils.hasText(name)) {
            throw new IllegalArgumentException("Cannot specify a null or empty name.");
        }
        this.name = name;
    }

    public String getName() {
        return name;
    }

    // 具体代理拦截器链的方法
    public FilterChain proxy(FilterChain orig) {
        return new ProxiedFilterChain(orig, this);
    }

    public boolean add(Filter filter) {
        return this.backingList.add(filter);
    }

    public void add(int index, Filter filter) {
        this.backingList.add(index, filter);
    }

    public boolean addAll(Collection c) {
        return this.backingList.addAll(c);
    }

    public boolean addAll(int index, Collection c) {
        return this.backingList.addAll(index, c);
    }

    public void clear() {
        this.backingList.clear();
    }

    public boolean contains(Object o) {
        return this.backingList.contains(o);
    }

    public boolean containsAll(Collection c) {
        return this.backingList.containsAll(c);
    }

    public Filter get(int index) {
        return this.backingList.get(index);
    }

    public int indexOf(Object o) {
        return this.backingList.indexOf(o);
    }

    public boolean isEmpty() {
        return this.backingList.isEmpty();
    }

    public Iterator iterator() {
        return this.backingList.iterator();
    }

    public int lastIndexOf(Object o) {
        return this.backingList.lastIndexOf(o);
    }

    public ListIterator listIterator() {
        return this.backingList.listIterator();
    }

    public ListIterator listIterator(int index) {
        return this.backingList.listIterator(index);
    }

    public Filter remove(int index) {
        return this.backingList.remove(index);
    }

    public boolean remove(Object o) {
        return this.backingList.remove(o);
    }

    public boolean removeAll(Collection c) {
        return this.backingList.removeAll(c);
    }

    public boolean retainAll(Collection c) {
        return this.backingList.retainAll(c);
    }

    public Filter set(int index, Filter filter) {
        return this.backingList.set(index, filter);
    }

    public int size() {
        return this.backingList.size();
    }

    public List subList(int fromIndex, int toIndex) {
        return this.backingList.subList(fromIndex, toIndex);
    }

    public Object[] toArray() {
        return this.backingList.toArray();
    }

    public  T[] toArray(T[] a) {
        //noinspection SuspiciousToArrayCall
        return this.backingList.toArray(a);
    }
}
可以看到执行proxy()方法后实际返回的是Shiro提供的ProxiedFilterChain实例，该类如下： 
  
 
  
 
   
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.shiro.web.servlet;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.*;
import java.io.IOException;
import java.util.List;

/**
 * A proxied filter chain is a {@link FilterChain} instance that proxies an original {@link FilterChain} as well
 * as a {@link List List} of other {@link Filter Filter}s that might need to execute prior to the final wrapped
 * original chain.  It allows a list of filters to execute before continuing the original (proxied)
 * {@code FilterChain} instance.
 *
 * @since 0.9
 */
public class ProxiedFilterChain implements FilterChain {

    //TODO - complete JavaDoc

    private static final Logger log = LoggerFactory.getLogger(ProxiedFilterChain.class);

    private FilterChain orig;// 原始拦截器链
    private List filters;// 原始拦截器链对应的拦截器集合
    private int index = 0;// 当前拦截器索引

    // 构造拦截器链代理实例
    public ProxiedFilterChain(FilterChain orig, List filters) {
        if (orig == null) {
            throw new NullPointerException("original FilterChain cannot be null.");
        }
        this.orig = orig;
        this.filters = filters;
        this.index = 0;
    }

    // 这个方法在拦截器链执行过程中被递归调用
    public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
        if (this.filters == null || this.filters.size() == this.index) {
            //we've reached the end of the wrapped chain, so invoke the original one:
            if (log.isTraceEnabled()) {
                log.trace("Invoking original filter chain.");
            }
            this.orig.doFilter(request, response);
        } else {
            if (log.isTraceEnabled()) {
                log.trace("Invoking wrapped filter at index [" + this.index + "]");
            }
            this.filters.get(this.index++).doFilter(request, response, this);
        }
    }
}
回归主线，在过取代理拦截器链后，返回executeChain方法，开始执行拦截过滤：chain.doFilter()，这个chain既然是代理拦截器链，调用的doFilter方法就是上面提到的ProxiedFilterChain的doFilter方法。这里的filters对应的就是当前拦截器链对应的拦截器集合，在DefaultFilterChainManager中的getChain方法中设置，DefaultFilterChainManager的拦截器映射集合在解析配置文件时进行初始化。由于访问路径为"http://127.0.0.1:8080/shiro02/"，则匹配的拦截器链就是配置的"/**=user"，所以当前拦截器链的拦截器集合中只有一个拦截器：UserFilter，执行如下代码即遍历拦截器集合递归调用拦截器的拦截方法： 
  
 
  
 
   
this.filters.get(this.index++).doFilter(request, response, this);
首先调用UserFilter的doFilter()方法，由Shiro拦截器类继承结构图可知，这里调用的实际是其父类OncePerRequestFilter的doFilter方法，又好像回到了初次执行SpringShiroFilter的doFilter()方法的时候，具体代码参考以上。首先判断如果没有执行过并且设置开启拦截，才执行doFilterInternal()方法，然后标记为执行过，一次请求完成后清除是否已执行标记。不同的是UserFilter调用的是其父类AdviceFilter的doFilterInternal()方法。 
  
 
  
 
   
/**
 * Actually implements the chain execution logic, utilizing
 * {@link #preHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse) pre},
 * {@link #postHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse) post}, and
 * {@link #afterCompletion(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Exception) after}
 * advice hooks.
 *
 * @param request  the incoming ServletRequest
 * @param response the outgoing ServletResponse
 * @param chain    the filter chain to execute
 * @throws ServletException if a servlet-related error occurs
 * @throws IOException      if an IO error occurs
 */
// AdviceFilter的doFilterInternal()方法
public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
        throws ServletException, IOException {

    Exception exception = null;

    try {
        // 前置处理：这里调用的是其父类PathMatchingFilter重写的perHandle()
        boolean continueChain = preHandle(request, response);
        if (log.isTraceEnabled()) {
            log.trace("Invoked preHandle method.  Continuing chain?: [" + continueChain + "]");
        }
        // 判断是否执行拦截器链的下一个拦截器
        if (continueChain) {
            executeChain(request, response, chain);
        }
        // 后置处理：调用的是AdviceFilter的postHandle()（无具体实现）
        postHandle(request, response);
        if (log.isTraceEnabled()) {
            log.trace("Successfully invoked postHandle method");
        }

    } catch (Exception e) {
        exception = e;
    } finally {
        cleanup(request, response, exception);
    }
}
 
   
/**
 * Implementation that handles path-matching behavior before a request is evaluated.  If the path matches and
 * the filter
 * {@link #isEnabled(javax.servlet.ServletRequest, javax.servlet.ServletResponse, String, Object) isEnabled} for
 * that path/config, the request will be allowed through via the result from
 * {@link #onPreHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Object) onPreHandle}.  If the
 * path does not match or the filter is not enabled for that path, this filter will allow passthrough immediately
 * to allow the {@code FilterChain} to continue executing.
 * 

 * In order to retain path-matching functionality, subclasses should not override this method if at all
 * possible, and instead override
 * {@link #onPreHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Object) onPreHandle} instead.
 *
 * @param request  the incoming ServletRequest
 * @param response the outgoing ServletResponse
 * @return {@code true} if the filter chain is allowed to continue to execute, {@code false} if a subclass has
 *         handled the request explicitly.
 * @throws Exception if an error occurs
 */
// PathMatchingFilter的perHandle()方法
protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
    // 这里判断拦截链初始化时为当前拦截器(UserFilter)初始化的Map<拦截路径，配置参数>是否为NULL
    if (this.appliedPaths == null || this.appliedPaths.isEmpty()) {
        if (log.isTraceEnabled()) {
            log.trace("appliedPaths property is null or empty.  This Filter will passthrough immediately.");
        }
        return true;
    }
    // 遍历当前拦截器(UserFilter)的Map<拦截路径，配置参数>集合
    for (String path : this.appliedPaths.keySet()) {
        // If the path does match, then pass on to the subclass implementation for specific checks
        //(first match 'wins'):
        // 如果能够匹配到当前访问的路径则进行拦截处理
        if (pathsMatch(path, request)) {
            log.trace("Current requestURI matches pattern '{}'.  Determining filter chain execution...", path);
            // 这里获取当前拦截器为该拦截路径配置的拦截器参数(没有为null)
            Object config = this.appliedPaths.get(path);
            // 返回给isFilterChainContinued()方法处理
            return isFilterChainContinued(request, response, path, config);
        }
    }
    //no path matched, allow the request to go through: 当前拦截器没有匹配则放行到下一个拦截器
    return true;
}
 
   
/**
 * Simple method to abstract out logic from the preHandle implementation - it was getting a bit unruly.
 *
 * @since 1.2
 */
// PathMatchingFilter的isFilterChainContinued()方法
@SuppressWarnings({"JavaDoc"})
private boolean isFilterChainContinued(ServletRequest request, ServletResponse response,
                                       String path, Object pathConfig) throws Exception {
    // 这里调用的是PathMatchingFilter的isEnabled：判断当前拦截器是否开启
    // 最后调用的是父类OncePerRequestFilter的isEnabled()方法，判断属性enabled==true/false(可配置)
    // 子类可重写此方法，根据拦截器配置参数决定是否开启当前拦截器
    if (isEnabled(request, response, path, pathConfig)) { //isEnabled check added in 1.2
        if (log.isTraceEnabled()) {
            log.trace("Filter '{}' is enabled for the current request under path '{}' with config [{}].  " +
                    "Delegating to subclass implementation for 'onPreHandle' check.",
                    new Object[]{getName(), path, pathConfig});
        }
        //The filter is enabled for this specific request, so delegate to subclass implementations
        //so they can decide if the request should continue through the chain or not:
        // 这里又返回给子类让其自己去处理，调用的是AccessControlFilter的onPreHandle方法
        return onPreHandle(request, response, pathConfig);
    }

    if (log.isTraceEnabled()) {
        log.trace("Filter '{}' is disabled for the current request under path '{}' with config [{}].  " +
                "The next element in the FilterChain will be called immediately.",
                new Object[]{getName(), path, pathConfig});
    }
    //This filter is disabled for this specific request,
    //return 'true' immediately to indicate that the filter will not process the request
    //and let the request/response to continue through the filter chain:
    // 当前拦截器没有开启执行拦截器链的下一个拦截器
    return true;
}

/**
 * Path-matching version of the parent class's
 * {@link #isEnabled(javax.servlet.ServletRequest, javax.servlet.ServletResponse)} method, but additionally allows
 * for inspection of any path-specific configuration values corresponding to the specified request.  Subclasses
 * may wish to inspect this additional mapped configuration to determine if the filter is enabled or not.
 * 

 * This method's default implementation ignores the {@code path} and {@code mappedValue} arguments and merely
 * returns the value from a call to {@link #isEnabled(javax.servlet.ServletRequest, javax.servlet.ServletResponse)}.
 * It is expected that subclasses override this method if they need to perform enable/disable logic for a specific
 * request based on any path-specific config for the filter instance.
 *
 * @param request     the incoming servlet request
 * @param response    the outbound servlet response
 * @param path        the path matched for the incoming servlet request that has been configured with the given {@code mappedValue}.
 * @param mappedValue the filter-specific config value mapped to this filter in the URL rules mappings for the given {@code path}.
 * @return {@code true} if this filter should filter the specified request, {@code false} if it should let the
 *         request/response pass through immediately to the next element in the {@code FilterChain}.
 * @throws Exception in the case of any error
 * @since 1.2
 */
// PathMatchingFilter的isEnabled()方法
@SuppressWarnings({"UnusedParameters"})
protected boolean isEnabled(ServletRequest request, ServletResponse response, String path, Object mappedValue)
        throws Exception {
    // 这里调用其父类OncePerRequestFilter的isEnabled()方法
    return isEnabled(request, response);
}
 
   
/**
 * Returns true if
 * {@link #isAccessAllowed(ServletRequest,ServletResponse,Object) isAccessAllowed(Request,Response,Object)},
 * otherwise returns the result of
 * {@link #onAccessDenied(ServletRequest,ServletResponse,Object) onAccessDenied(Request,Response,Object)}.
 *
 * @return true if
 *         {@link #isAccessAllowed(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Object) isAccessAllowed},
 *         otherwise returns the result of
 *         {@link #onAccessDenied(javax.servlet.ServletRequest, javax.servlet.ServletResponse) onAccessDenied}.
 * @throws Exception if an error occurs.
 */
// AccessControlFilter的onPreHandle方法
public boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
    // 方法isAccessAllowed()和onAccessDenied()在AccessControlFilter中均是抽象方法
    // 这里调用的是子类实现的方法isAccessAllowed()和onAccessDenied()
    return isAccessAllowed(request, response, mappedValue) || onAccessDenied(request, response, mappedValue);
}
分析到这，其实最终调用了子类(当前为UserFilter)实现的isAccessAllowed() || onAccessDenied() 的结果，UserFilter源码： 
  
 
  
 
   
/**
* Filter that allows access to resources if the accessor is a known user, which is defined as
* having a known principal.  This means that any user who is authenticated or remembered via a
* 'remember me' feature will be allowed access from this filter.
* 

* If the accessor is not a known user, then they will be redirected to the {@link #setLoginUrl(String) loginUrl}

*
* @since 0.9
*/
public class UserFilter extends AccessControlFilter {

    /**
     * Returns true if the request is a
     * {@link #isLoginRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse) loginRequest} or
     * if the current {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) subject}
     * is not null, false otherwise.
     *
     * @return true if the request is a
     * {@link #isLoginRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse) loginRequest} or
     * if the current {@link #getSubject(javax.servlet.ServletRequest, javax.servlet.ServletResponse) subject}
     * is not null, false otherwise.
     */
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        // 如果是登录请求则允许通过：调用的是其父类AccessControlFilter的isLoginRequest()方法
        if (isLoginRequest(request, response)) {
            return true;
        } else {
            // 注意：如果session超时，此处获取subject对象时会抛出UnknownSessionException
            Subject subject = getSubject(request, response);
            // If principal is not null, then the user is known and should be allowed access.
            // 否则判断用户是否已经登录(Rememer me)
            return subject.getPrincipal() != null;
        }
    }

    /**
     * This default implementation simply calls
     * {@link #saveRequestAndRedirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse) saveRequestAndRedirectToLogin}
     * and then immediately returns false, thereby preventing the chain from continuing so the redirect may
     * execute.
     */
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        // 调用父类AccessControlFilter的saveRequestAndRedirectToLogin方法保存被拒绝的请求并重定向到登录页，登录成功后再执行
        saveRequestAndRedirectToLogin(request, response);
        return false;
    }
}
显然isAccessAllowed()方法返回结果为false，然后执行onAccessDenied()方法，这里调用了父类AccessControlFilter的saveRequestAndRedirectToLogin方法，用于保存被拦截的请求待登录成功后执行。 
  
 
  
 
   
/**
 * Convenience method for subclasses to use when a login redirect is required.
 * 

 * This implementation simply calls {@link #saveRequest(javax.servlet.ServletRequest) saveRequest(request)}
 * and then {@link #redirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse) redirectToLogin(request,response)}.
 *
 * @param request  the incoming ServletRequest
 * @param response the outgoing ServletResponse
 * @throws IOException if an error occurs.
 */
// AccessControlFilter类的saveRequestAndRedirectToLogin方法
protected void saveRequestAndRedirectToLogin(ServletRequest request, ServletResponse response) throws IOException {
    saveRequest(request);
    redirectToLogin(request, response);
}

/**
 * Convenience method merely delegates to
 * {@link WebUtils#saveRequest(javax.servlet.ServletRequest) WebUtils.saveRequest(request)} to save the request
 * state for reuse later.  This is mostly used to retain user request state when a redirect is issued to
 * return the user to their originally requested url/resource.
 * 

 * If you need to save and then immediately redirect the user to login, consider using
 * {@link #saveRequestAndRedirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
 * saveRequestAndRedirectToLogin(request,response)} directly.
 *
 * @param request the incoming ServletRequest to save for re-use later (for example, after a redirect).
 */
// AccessControlFilter类的saveRequest方法
protected void saveRequest(ServletRequest request) {
    // 保存请求
    WebUtils.saveRequest(request);
}

/**
 * Convenience method for subclasses that merely acquires the {@link #getLoginUrl() getLoginUrl} and redirects
 * the request to that url.
 * 

 * N.B.  If you want to issue a redirect with the intention of allowing the user to then return to their
 * originally requested URL, don't use this method directly.  Instead you should call
 * {@link #saveRequestAndRedirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
 * saveRequestAndRedirectToLogin(request,response)}, which will save the current request state so that it can
 * be reconstructed and re-used after a successful login.
 *
 * @param request  the incoming ServletRequest
 * @param response the outgoing ServletResponse
 * @throws IOException if an error occurs.
 */
// AccessControlFilter类的redirectToLogin方法
protected void redirectToLogin(ServletRequest request, ServletResponse response) throws IOException {
    // 配置的重定向的登录地址
    String loginUrl = getLoginUrl();
    // 重定向到loginUrl
    WebUtils.issueRedirect(request, response, loginUrl);
}
请求重定向后，返回结果为return false，最后返回到AdviceFilter的doFilterInternal()方法，告诉拦截器链不再继续执行，本次请求拦截处理结束。具体拦截过程是嵌套调用的，即： 
  
 
  
 
   
 
  
 
  
 
   SpringShiroFilter intercept start .. 
  
 
  
 
   匹配当前请求路径的拦截器链开始执行.. 
  
 
  
 
   UserFilter intercept start .. 
  
 
  
 
   if(userFilter.doFilter return true ){ 
  
 
  
 
    nextFilter intercept start ..
 
  
 
  
 
    if(nextFilter.doFilter retrun true) 
  
 
  
 
     ... 
  
 
  
 
    nextFilter intercpt end ..
 
  
 
  
 
   }else { 
  
 
  
 
    终止拦截器执行!!
 
  
 
  
 
   } 
  
 
  
 
   UserFilter intercept end .. 
 
  
 
  
 
   
 
    匹配当前请求路径的拦截器链结束执行.. 
   
 
    
   
 
    SpringShiroFilter intercept end .. 
   
 
   
 
    
 
   
 
   
 
    由于进行了请求重定向，地址：http://127.0.0.1:8080/shiro02/login.jsp，此时会再次进入shiro拦截器链，根据以上配置/login.jsp对应的拦截器链为：authc（表单登录拦截器），首先执行FormAuthenticationFilter的doFilter()方法(继承至父类OncePerRequestFilter的方法)，再执行父类AdviceFilter的doFilterInternal方法，与上面提到的UserFilter类似。最终同样会通过父类AccessControlFilter的onPreHandle()方法类决定是否继续拦截器链的执行： 
   
 
  
 
  
 
    
   
public boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
    return isAccessAllowed(request, response, mappedValue) || onAccessDenied(request, response, mappedValue);
}
 
  
 
  

    只不过isAccessAllowed()与onAccessDenied()方法的具体实现与UserFilter的有所不同，isAccessAllowed()调用的是FormAuthenticationFilter其父类AuthenticatingFilter的实现，而onAccessDenied()则是FormAuthenticationFilter自己实现： 
   
 
   
/**
 * Determines whether the current subject should be allowed to make the current request.
 * 

 * The default implementation returns true if the user is authenticated.  Will also return
 * true if the {@link #isLoginRequest} returns false and the "permissive" flag is set.
 *
 * @return true if request should be allowed access
 */
// AuthenticatingFilter的isAccessAllowed方法
@Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
    // 首先调用父类isAccessAllowed方法判断是否已经登录认证
    // 再判断如果是非登录请求并且拦截器配置为不拦截所有请求
    return super.isAccessAllowed(request, response, mappedValue) ||
            (!isLoginRequest(request, response) && isPermissive(mappedValue));
}

/**
 * Returns true if the mappedValue contains the {@link #PERMISSIVE} qualifier.
 *
 * @return true if this filter should be permissive
 */
// AuthenticatingFilter的isPermissive方法
protected boolean isPermissive(Object mappedValue) {
    if(mappedValue != null) {
        String[] values = (String[]) mappedValue;
        return Arrays.binarySearch(values, PERMISSIVE) >= 0;
    }
    return false;
}
 
   
// FormAuthenticationFilter的onAccessDenied()方法
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    // 判断如果是登录请求
    if (isLoginRequest(request, response)) {
        // 判断如果是POST请求则执行表单登录操作
        if (isLoginSubmission(request, response)) {
            if (log.isTraceEnabled()) {
                log.trace("Login submission detected.  Attempting to execute login.");
            }
            // 调用父类AuthenticatingFilter的executeLogin
            return executeLogin(request, response);
        // 如果是GET请求则不进行拦截即显示登录页
        } else {
            if (log.isTraceEnabled()) {
                log.trace("Login page view.");
            }
            //allow them to see the login page ;)
            return true;
        }
    } else {
        if (log.isTraceEnabled()) {
            log.trace("Attempting to access a path which requires authentication.  Forwarding to the " +
                    "Authentication url [" + getLoginUrl() + "]");
        }
        // 调用父类AccessControlFilter的saveRequestAndRedirectToLogin方法保存请求
        saveRequestAndRedirectToLogin(request, response);
        return false;
    }
}

/**
 * This default implementation merely returns true if the request is an HTTP POST,
 * false otherwise. Can be overridden by subclasses for custom login submission detection behavior.
 *
 * @param request  the incoming ServletRequest
 * @param response the outgoing ServletResponse.
 * @return true if the request is an HTTP POST, false otherwise.
 */
// FormAuthenticationFilter的isLoginSubmission方法
@SuppressWarnings({"UnusedDeclaration"})
protected boolean isLoginSubmission(ServletRequest request, ServletResponse response) {
    return (request instanceof HttpServletRequest) && WebUtils.toHttp(request).getMethod().equalsIgnoreCase(POST_METHOD);
}
由此可知，isAccessAllowed返回false，onAccessDenied返回true，最终拦截器链返回结果为true，即浏览器显示登录页login.jsp，后续执行流程与上面UserFilter一致。 
  
 
  
 
   
 
   

     当在登录页提交登录表单时，实际上是POST请求的"http://127.0.0.1:8080/shiro02/login.jsp"，并且请求体内携带登录参数。 
   
 
   

     因为表单action是空串，所以默认请求的是当前页面地址，如果表单action不为空串，则登录请求将不会被shiro拦截器处理。 
   
 
   
由于是POST请求访问的loginUrl，则在表单拦截器的onAccessDenied()方法中会执行父类的executeLogin()进行登录：
 
   
// AuthenticatingFilter的executeLogin方法
protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
    // 调用FormAuthenticationFilter的创建登录请求token方法
    AuthenticationToken token = createToken(request, response);
    if (token == null) {
        String msg = "createToken method implementation returned null. A valid non-null AuthenticationToken " +
                "must be created in order to execute a login attempt.";
        throw new IllegalStateException(msg);
    }
    try {
        Subject subject = getSubject(request, response);
        // 交给securityManager进行登录处理
        subject.login(token);
        // FormAuthenticationFilter重写的登录成功回调方法
        return onLoginSuccess(token, subject, request, response);
    } catch (AuthenticationException e) {
        // FormAuthenticationFilter重写的登录失败回调方法
        return onLoginFailure(token, e, request, response);
    }
}

// FormAuthenticationFilter重写的onLoginSuccess方法
protected boolean onLoginSuccess(AuthenticationToken token, Subject subject,
                                 ServletRequest request, ServletResponse response) throws Exception {
    // 登录成功重定向(调用父类AuthenticationFilter的issueSuccessRedirect方法)
    issueSuccessRedirect(request, response);
    //we handled the success redirect directly, prevent the chain from continuing:
    return false;
}

// FormAuthenticationFilter重写的onLoginFailure方法
protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e,
                                 ServletRequest request, ServletResponse response) {
    if (log.isDebugEnabled()) {
        log.debug( "Authentication exception", e );
    }
    // 保存登录失败信息，可在jsp使用EL表达式获取
    setFailureAttribute(request, e);
    //login failed, let request continue back to the login page:
    return true;
}

protected void setFailureAttribute(ServletRequest request, AuthenticationException ae) {
    String className = ae.getClass().getName();
    // 保存键值对(键默认为"shiroLoginFailure")
    request.setAttribute(getFailureKeyAttribute(), className);
}
 
   
/**
 * Redirects to user to the previously attempted URL after a successful login.  This implementation simply calls
 * {@link org.apache.shiro.web.util.WebUtils WebUtils}.{@link WebUtils#redirectToSavedRequest(javax.servlet.ServletRequest, javax.servlet.ServletResponse, String) redirectToSavedRequest}
 * using the {@link #getSuccessUrl() successUrl} as the {@code fallbackUrl} argument to that call.
 *
 * @param request  the incoming request
 * @param response the outgoing response
 * @throws Exception if there is a problem redirecting.
 */
// AuthenticationFilter的issueSuccessRedirect方法
protected void issueSuccessRedirect(ServletRequest request, ServletResponse response) throws Exception {
    // 重定向到之前保存的请求地址如果没有则重定向到配置的successUrl(默认为"/", 可配置)
    WebUtils.redirectToSavedRequest(request, response, getSuccessUrl());
}
这样，登录成功就会终止拦截器链的执行重定向到successUrl，登录失败就继续拦截器链的执行返回到登录页。本文测试工程没有配置successUrl，所以登录成功后会重定向到"/"，此时再次进入shiro拦截器链"/**=user"，即只会执行UserFilter拦截器，在UserFilter的isAccessAllowed中会判断是否已登录认证，很明显结果为true(刚刚认证成功)，继续执行shiro代理拦截器链(如果还有shiro拦截器)以及其他拦截器链(spring、tomcat等)，这里将执行springMVC的拦截器，测试工程在springMVC配置文件配置了访问路径"/"跳转到"index.jsp"，故最终跳转到index.jsp完成登录请求。springMVC配置如下： 
  
 
  
 
   


 
   

 
  
 
  

                            
                        
                    
                    
                    

                    
                    
                    

                
                

                    
                

            
        
    
    

        
你可能感兴趣的:(Shiro)

        

            

                
    
                    
  • SpringSecurity初学总结
                        weixin_66442229
spring
                        
    springSecurity安全框架基于Java的安全框架主要有:SpringSecurity和Shiro介绍基础概念安全框架是对用户访问权限的控制,保证应用的安全性。其主要的工作是用户认证和用户授权|鉴权主要应用于Spring的企业应用系统,提供声明式的安全访问控制解决方案。它提供了一组可以在Spring应用上下文中配置的Bean能很好的结合Spring的DI依赖注入和AOP面向切面编程功能应用
    
                    
    • 
                    
  • 关于项目中使用shiro进行安全管理的总结
                        一颗大青柠
JavaShirojavaspring
                        
    关于项目中使用shiro进行安全管理的总结关于SpringBoot下使用shiro进行用户认证与权限管理对于安全框架有一定了解的开发者一定对于shiro这款安全框架有一定的了解，这里我们不再对该框架进行其设计与知识的介绍，仅对于我的个人项目中所使用到的进行一个总结，并放上代码。使用该框架的第一步，进行配置：packagecom.libvirtjava.demo.vm.util.config;imp
    
                    
    • 
                    
  • Apache Shiro安全框架(2)-用户认证
                        heyrian
Javashiro
                        
    身份认证在shiro中用户需要提供用户的principals（身份）和credentials（证明）来证明该用户属于当前系统用户。常见的认证方式即用户名/密码。在解释身份认证之前，我们先来看看shiro中的Subject和Realm,这是身份认证的两个关键的概念。Subjectsubject代表当前用户，内部主要维护当前用户信息。shiro中所有的subject都交给SecurityManager
    
                    
    • 
                    
  • 毕设/私活/bigold必备项目，一个挣钱的免费的全开源标准前后端分离后台管理权限系统【springboot+vue+redis+Spring Security】脚手架搭建：若依Ruo框架具体使用教程
                        南北极之间
前端开发springbootvuespringboot+vue免费后台管理系统毕业私活后台权限系统
                        
    【建议收藏】毕设/私活/大佬必备，一个挣钱的标准开源前后端分离【springboot+vue+redis+SpringSecurity】脚手架一个免费的开源后台管理系统：若依框架（具体使用教程：具体怎样下载？怎样使用？怎样配置后台接口地址？超详细）简介RuoYi是一个JavaEE企业级快速开发平台，基于经典技术组合（SpringBoot、ApacheShiro、MyBatis、Thymeleaf、
    
                    
    • 
                    
  • 解锁Apache Shiro：新手友好的安全框架指南(一)——整体架构与身份认证_apache shiro的配置包括安全管理器(2)
                        2401_84281748
程序员apache安全架构
                        
    ApacheShiro是一个功能强大且易于使用的Java安全框架，它执行身份验证、授权、加密和会话管理，可用于保护任何应用程序——从命令行应用程序、移动应用程序到最大的web和企业应用程序。Shiro提供了应用程序安全API来执行以下方面：Authentication（认证）：验证用户身份，即用户登录。Authorization（授权）：访问控制Cryptography（密码学）：保护或隐藏私密数
    
                    
    • 
                    
  • springmvc用配置类替换xml配置
                        码里法
其他javamvcspring
                        
    ssm基础项目整合前言xml配置mybatis.xmlspingmvc.xmlweb.xml配置类jdbc配置类mybatis配置SpringConfig配置SpringMvcConfig配置shiro配置WebInit前言其实这中间用配置类，发现问题还挺多的，所以记录一下，尤其是针对shiro的配置。xml配置mybatis.xmlArchetypeCreatedWebApplicationdi
    
                    
    • 
                    
  • （shiro加密）2019-03-27
                        _麻辣香锅不要辣

                        
    参考：spring-shiro的密码加密配置凭证匹配器@BeanpublicHashedCredentialsMatcherhashedCredentialsMatcher(){HashedCredentialsMatcherhashedCredentialsMatcher=newHashedCredentialsMatcher();hashedCredentialsMatcher.setHash
    
                    
    • 
                    
  • shiro 采用redis共享session，出现反序列化错误的排查过程
                        nightseventhunit
redisjava数据库
                        
    这是一个老系统改造的过程，该老系统采用的框架是#jfinal#shiroredis,采用outh2协议的方式，对多个子系统之间进行单点登录，以实现系统之间的session，由于速度方面的影响，现在要改造成多个系统之间共享session，并采用redis集群的方式。说明一下当前项目的整体运行环境，此项目的多个子系统都在同一个域名下，通过上下文不同来区分子系统。以下将记录整个改造过程，采用jfinal
    
                    
    • 
                    
  • springboot+shiro前后端分离过程中跨域问题、sessionId问题、302鉴权失败问题
                        DN金猿
springboot后端javashiro前后端分离
                        
    近期项目需要前后端分离，由于前后端分离后原来的适用的shiro配置无法满足现有系统要求。同时在前后端项目分离的项目中存在的跨域问题，cookies不再使用，通过token方式实现用户登陆鉴权。下面记录在整个过程中涉及的几个大问题：1、跨域问题2、sessionId问题3、302鉴权问题1、springboot跨域问题解决packagenet.sinorock.aj.common.config;im
    
                    
    • 
                    
  • Shiro实现登录认证以及整合到Springboot3
                        LIPAH
web安全springboot
                        
    一、概念介绍ApacheShiro是一个强大灵活的开源安全框架，提供授权、会话管理以及密码加密等功能。与SpringSecurity对比劣势：SpringSecurity基于Spring开发，项目若使用Spring作为基础，配合SpringSecurity做权限更加方便，而Shiro需要和Spring进行整合开发SpringSecurity功能比Shiro更加丰富些，例如安全维护方面SpringS
    
                    
    • 
                    
  • springboot整合shiro安全框架
                        heromps
Springboot安全apache
                        
    shiro快速开始1.导入依赖org.apache.shiroshiro-core1.8.0org.slf4jjcl-over-slf4j1.7.21org.slf4jslf4j-log4j121.7.21log4jlog4j1.2.17org.apache.shiroshiro-core1.8.02.配置文件shiro.ini[users]#user'root'withpassword'secr
    
                    
    • 
                    
  • mac解决mysql 1055问题
                        nitricoxide

                        
    首遇报错mac本地安装的mysql执行带groupby的语句时，出现了如下报错1055-Expression#1ofSELECTlistisnotinGROUPBYclauseandcontainsnonaggregatedcolumn'yyhd_shiro.ar.roleName'whichisnotfunctionallydependentoncolumnsinGROUPBYclause;th
    
                    
    • 
                    
  • Spring Boot + Mybatis + Shiro 后台权限管理系统
                        chuxia_vlog

                        
    平台简介一直想做一款后台管理系统，看了很多优秀的开源项目但是发现没有合适的。于是利用空闲休息时间开始自己写了一套后台系统。如此有了若依。她可以用于所有的Web应用程序，如网站管理后台，网站会员中心，CMS，CRM，OA。所有前端后台代码封装过后十分精简易上手，出错概率低。同时支持移动客户端访问。系统会陆续更新一些实用功能。性别男，若依是给还没有出生女儿取的名字（寓意：你若不离不弃，我必生死相依）若
    
                    
    • 
                    
  • 00后会自动化就想拿20K？不，你还差点远呢···
                        v_648374
自动化运维
                        
    等你搭建好公司的自动化生态，你还是不满足，我为什么不把这些东西可视化管理呢？做个平台？管理用例，管理任务，管理测试报告？我还可以把公司的一些部署任务也集成过来？想法很好！此时的你已经不仅仅是一名优秀的自动化工程师了，已经迈向了测试开发的道路！开始学习，了解了测试框架httprunner，开发框架django/flask/springboot，懂得了接口开发的流程，了解了mybatis,shiro,
    
                    
    • 
                    
  • Spring Security与Apache Shiro：Java安全框架的比较
                        Lill_bin
javajavaspringapache分布式安全后端开发语言
                        
    引言在Java企业级应用开发中，安全性是一个不可忽视的重要方面。随着Web应用的复杂性日益增加，选择合适的安全框架对于保护应用免受未授权访问和其他安全威胁至关重要。SpringSecurity和ApacheShiro是两个广泛使用的Java安全框架，它们提供了认证(Authentication)和授权(Authorization)的功能。本文将对这两个框架进行比较，探讨它们的设计理念、核心特性以及
    
                    
    • 
                    
  • 【Apache】漏洞
                        B1ackMa9ic
apache网络安全web安全网络攻击模型
                        
    文章目录Apache漏洞1.ApacheHTTPD多后缀解析漏洞2.ApacheSSI远程命令执行漏洞3.ApacheHTTP路径穿越漏洞4.ApacheHTTPSSRF漏洞5.Apachelog4j26.ApacheshiroApache漏洞1.ApacheHTTPD多后缀解析漏洞主要利用方式：文件类型欺骗：构造example.php.jpg的文件（只要一个文件含有.php后缀的文件即将被识别成
    
                    
    • 
                    
  • 请简单介绍一下Shiro框架是什么？Shiro在Java安全领域的主要作用是什么？Shiro主要提供了哪些安全功能？
                        AaronWang94
shirojavajava安全开发语言
                        
    请简单介绍一下Shiro框架是什么？Shiro框架是一个强大且灵活的开源安全框架，为Java应用程序提供了全面的安全解决方案。它主要用于身份验证、授权、加密和会话管理等功能，可以轻松地集成到任何JavaWeb应用程序中，并提供了易于理解和使用的API，使开发人员能够快速实现安全特性。Shiro的核心组件包括Subject、SecurityManager和Realms。Subject代表了当前与应用
    
                    
    • 
                    
  • shiro 整合 spring 实战及源码详解
                        老马啸西风
java
                        
    序言前面我们学习了如下内容：5分钟入门shiro安全框架实战笔记shiro整合spring实战及源码详解相信大家对于shiro已经有了最基本的认识，这一节我们一起来学习写如何将shiro与spring进行整合。spring整合maven依赖org.apache.shiroshiro-spring1.7.0org.springframeworkspring-context4.3.13.RELEASE
    
                    
    • 
                    
  • shrio跳转操作 + ajax
                        月1.2.3
springbootajax
                        
    使用shiro框架的时候，在session过期之后实现跳转到登录界面，ajax操作不会直接跳转而是返回一个登录页面的html，并且不会进入controller逻辑，需要找到对应的方法进行重写，对ajax进行处理（FormAuthenticationFilter中的redirectToLogin方法重写）。
    
                    
    • 
                    
  • XMall 开源商城 SQL注入漏洞复现(CVE-2024-24112)
                        OidBoy_G
漏洞复现web安全安全sql
                        
    0x01产品简介XMall开源电商商城是开发者Exrick的一款基于SOA架构的分布式电商购物商城前后端分离前台商城:Vue全家桶后台管理:Dubbo/SSM/Elasticsearch/Redis/MySQL/ActiveMQ/Shiro/Zookeeper等。0x02漏洞概述XMall开源商城/item/list、/item/listSearch、/sys/log、/order/list、/m
    
                    
    • 
                    
  • shiro入门实战笔记（1）--理论篇
                        y-yg
Shiroshiro入门javaapache权限控制
                        
    从这篇文章开始，将学习Apacheshiro的相关内容。由于博主也是刚刚开始学习相关的基本内容，网上已经有系列文章讲解shiro，这里博主推荐一个：开涛的博客，《跟我学shiro》。博主也是跟着这个系列的文章学习shiro的相关内容。以下的文章，各位读者请权当是学习笔记，因此对于想了解更多内容的读者，请移步到上面的文章中，在参考资料里，博主也会附上链接。第一篇，我们参考官方文档，以及上面文章的翻译
    
                    
    • 
                    
  • Shiro-05-5 分钟入门 shiro 安全框架实战笔记
                        老马啸西风
web安全java安全架构开发语言哈希算法
                        
    序言大家好，我是老马。前面我们学习了web安全之SpringSecurity入门教程这次我们来一起学习下另一款java安全框架shiro。什么是ApacheShiro？ApacheShiro是一个功能强大且易于使用的Java安全框架，它为开发人员提供了一种直观而全面的解决方案，用于身份验证，授权，加密和会话管理。实际上，它可以管理应用程序安全性的所有方面，同时尽可能避免干扰。它建立在可靠的界面驱动
    
                    
    • 
                    
  • 使用shiro进行登录密码安全验证
                        Asparrow
Shiro安全框架学shiro安全springboot
                        
    使用shiro进行登录密码安全验证使用框架版本SpringBoot1.5.3.RELEASEshiro-spring1.2.5shiro-ehcache1.2.5Shiro配置ShiroConfig中shiroFilter/***ShiroFilter*注意这里参数中的StudentService和IScoreDao只是一个例子，因为我们在这里可以用这样的方式获取到相关访问数据库的对象，*然后读取
    
                    
    • 
                    
  • JAVA后端主流开发框架
                        理查德.克莱德曼
JavaWebSpringBootjava后端开发语言
                        
    项目介绍一款Java语言基于SpringBoot2.x、Layui、Thymeleaf、MybatisPlus、Shiro、MySQL等框架精心打造的一款模块化、插件化、高性能的前后端分离架构敏捷开发框架，可用于快速搭建后台管理系统，本着简化开发、提升开发效率的初衷，框架自研了一套个性化的组件，实现了可插拔的组件式开发方式：单图上传、多图上传、下拉选择、开关按钮、单选按钮、多选按钮、图片裁剪、富文
    
                    
    • 
                    
  • shiro登陆时密码加盐哈希实现和简单原理
                        ignoHH
javashirospringbootjavashiro密码学
                        
    shiro登陆时密码加盐哈希实现版权声明：本文为博主原创文章，遵循CC4.0BY-SA版权协议，转载请附上原文出处链接和本声明。本文链接：https://blog.csdn.net/wy862740672/article/details/109818314实现废话不多说，开搞。此篇采用SHA-256哈希算法，采用其他算法只需要更改算法名字段。1.在shiro配置中添加对于HashedCredent
    
                    
    • 
                    
  • 详解Springboot整合Shiro加盐加散列实现登陆注册小案例
                        鱼小洲
技术杂谈shiromybatishashspringbootboot-shiro
                        
    前言Springboot和Shiro的基本介绍我就不多说了，能看到这篇文章的相信也都会用。这篇文章主要是分享一下我在学习Shiro和Springboot的整合的小阶段。目前是复习，很感谢B站的up主——编程不良人的视频让我有了一个学习Shiro的基本方向。目前是实现了用户认证的功能。依赖整合的时候使用的是jsp，其实和thymeleaf一个道理，而且不涉及到作用域传值。我们需要导入的依赖有：mys
    
                    
    • 
                    
  • Shiro-09-Session Management 会话管理
                        老马啸西风
web安全哈希算法密码学算法java安全
                        
    会话管理ApacheShiro在安全性框架世界中提供了一些独特的功能：适用于任何应用程序的完整的企业级Session解决方案，从最简单的命令行和智能手机应用程序到最大的群集企业Web应用程序。这对许多应用程序都有很大的影响-在Shiro之前，如果需要会话支持，则需要将应用程序部署在Web容器中或使用EJB状态会话Bean。Shiro的Session支持比这两种机制中的任何一种都更易于使用和管理，并
    
                    
    • 
                    
  • Shiro-10-Cryptography 编码加密
                        老马啸西风
web安全java安全架构开发语言哈希算法
                        
    编码/加密在涉及到密码存储问题上，应该加密/生成密码摘要存储，而不是存储明文密码。比如之前的600wcsdn账号泄露对用户可能造成很大损失，因此应加密/生成不可逆的摘要方式存储。编码/解码Shiro提供了base64和16进制字符串编码/解码的API支持，方便一些编码解码操作。Shiro内部的一些数据的存储/表示都使用了base64和16进制字符串。Stringstr="hello";String
    
                    
    • 
                    
  • Shiro学习（三）之MD5+随机盐salt+Hash散列认证
                        Solitude_dong
Shiroshiro
                        
    MD5:加密算法不可逆（只能根据明文生成密文；如果内容相同，不论执行多少次md5生成结果始终一致），通常和随机盐配合使用一般用来加密或签名签名：也称为校验和，就是用来判断两个内容是否一致eg:tomcat.ziptomcat.md5.fdfd…看是否下载完整，就可以点击tomcat.md5.看生成的签名和tomcat生成的是否一致两个文件是否一致？a.txt和bb.txt分别md5看签名是否一致破
    
                    
    • 
                    
  • [开发框架]-shiro-入门
                        Pacifica_
java数据库web安全shiro
                        
    权限管理概述权限管理实现对用户访问系统的控制，以及按照安全规则或安全策略控制用户可以访问而且只能访问自己被授权的资源。也就是说，权限管理包括用户身份认证(登录)和授权(资源的访问权限)两部分shiro中的详细架构：shiro中的认证认证过程中的关键对象1.Subject，主体。访问系统的用户，主体可以是用户，程序等，进行认证的都称为主体2.Principal，身份信息，是主体进行身份认证的标识，标
    
                    
    • 
                                
  • 对股票分析时要注意哪些主要因素？
                                    会飞的奇葩猪
股票 分析 云掌股吧
                                    
     
　　众所周知，对散户投资者来说，股票技术分析是应战股市的核心武器，想学好股票的技术分析一定要知道哪些是重点学习的，其实非常简单，我们只要记住三个要素：成交量、价格趋势、振荡指标。 
 
    一、成交量 
 
　　大盘的成交量状态。成交量大说明市场的获利机会较多，成交量小说明市场的获利机会较少。当沪市的成交量超过150亿时是强市市场状态，运用技术找综合买点较准；
    
                                
    • 
                                
  • 【Scala十八】视图界定与上下文界定
                                    bit1129
scala
                                    
    Context Bound，上下文界定，是Scala为隐式参数引入的一种语法糖，使得隐式转换的编码更加简洁。 
  
隐式参数 
首先引入一个泛型函数max，用于取a和b的最大值 
  def max[T](a: T, b: T) = {
    if (a > b) a else b
  } 
 因为T是未知类型，只有运行时才会代入真正的类型，因此调用a > 
    
                                
    • 
                                
  • C语言的分支——Object-C程序设计阅读有感
                                    darkblue086
applec框架cocoa
                                    
    自从1972年贝尔实验室Dennis Ritchie开发了C语言，C语言已经有了很多版本和实现，从Borland到microsoft还是GNU、Apple都提供了不同时代的多种选择，我们知道C语言是基于Thompson开发的B语言的，Object-C是以SmallTalk-80为基础的。和C++不同的是，Object C并不是C的超集，因为有很多特性与C是不同的。 
Object-C程序设计这本书
    
                                
    • 
                                
  • 去除浏览器对表单值的记忆
                                    周凡杨
html记忆autocompleteform浏览
                                    
      
                                   &n
    
                                
    • 
                                
  • java的树形通讯录
                                    g21121
java
                                    
    最近用到企业通讯录，虽然以前也开发过，但是用的是jsf，拼成的树形，及其笨重和难维护。后来就想到直接生成json格式字符串，页面上也好展现。 
	// 首先取出每个部门的联系人
			for (int i = 0; i < depList.size(); i++) {
				List<Contacts> list = getContactList(depList.get(i
    
                                
    • 
                                
  • Nginx安装部署
                                    510888780
nginxlinux
                                    
    Nginx ("engine x") 是一个高性能的 HTTP 和 反向代理 服务器，也是一个 IMAP/POP3/SMTP 代理服务器。 Nginx 是由 Igor Sysoev 为俄罗斯访问量第二的 Rambler.ru 站点开发的，第一个公开版本0.1.0发布于2004年10月4日。其将源代码以类BSD许可证的形式发布，因它的稳定性、丰富的功能集、示例配置文件和低系统资源
    
                                
    • 
                                
  • java servelet异步处理请求
                                    墙头上一根草
ｊａｖａ异步返回ｓｅｒｖｌｅｔ
                                    
    servlet3.0以后支持异步处理请求，具体是使用AsyncContext ，包装httpservletRequest以及httpservletResponse具有异步的功能， 
   
  
  final AsyncContext ac = request.startAsync(request, response); 
  ac.s
    
                                
    • 
                                
  • 我的spring学习笔记8-Spring中Bean的实例化
                                    aijuans
Spring 3
                                    
    在Spring中要实例化一个Bean有几种方法： 
 
1、最常用的（普通方法） 
 
 
<bean id="myBean" class="www.6e6.org.MyBean" /> 
 
使用这样方法，按Spring就会使用Bean的默认构造方法，也就是把没有参数的构造方法来建立Bean实例。 
 
（有构造方法的下个文细说） 
 
2、还
    
                                
    • 
                                
  • 为Mysql创建最优的索引
                                    annan211
mysql索引
                                    
    


	索引对于良好的性能非常关键，尤其是当数据规模越来越大的时候，索引的对性能的影响越发重要。
	索引经常会被误解甚至忽略，而且经常被糟糕的设计。
	索引优化应该是对查询性能优化最有效的手段了，索引能够轻易将查询性能提高几个数量级，最优的索引会比
	较好的索引性能要好2个数量级。
	
	1 索引的类型
	  (1) B-Tree
	    不出意外，这里提到的索引都是指 B-
    
                                
    • 
                                
  • 日期函数
                                    百合不是茶
oraclesql日期函数查询
                                    
      
ORACLE日期时间函数大全

   TO_DATE格式(以时间:2007-11-02   13:45:25为例)
   
        Year:      
        yy two digits 两位年                显示值:07
        yyy three digits 三位年                显示值:007
   
    
                                
    • 
                                
  • 线程优先级
                                    bijian1013
javathread多线程java多线程
                                    
    多线程运行时需要定义线程运行的先后顺序。 
线程优先级是用数字表示，数字越大线程优先级越高，取值在1到10，默认优先级为5。 
实例： 
package com.bijian.study;

/**
 * 因为在代码段当中把线程B的优先级设置高于线程A,所以运行结果先执行线程B的run()方法后再执行线程A的run()方法
 * 但在实际中，JAVA的优先级不准，强烈不建议用此方法来控制执
    
                                
    • 
                                
  • 适配器模式和代理模式的区别
                                    bijian1013
java设计模式
                                    
    一.简介        适配器模式：适配器模式（英语：adapter pattern）有时候也称包装样式或者包装。将一个类的接口转接成用户所期待的。一个适配使得因接口不兼容而不能在一起工作的类工作在一起，做法是将类别自己的接口包裹在一个已存在的类中。      &nbs
    
                                
    • 
                                
  • 【持久化框架MyBatis3三】MyBatis3 SQL映射配置文件
                                    bit1129
Mybatis3
                                    
     SQL映射配置文件一方面类似于Hibernate的映射配置文件，通过定义实体与关系表的列之间的对应关系。另一方面使用<select>,<insert>,<delete>，<update>元素定义增删改查的SQL语句， 
这些元素包含三方面内容 
1. 要执行的SQL语句 
2. SQL语句的入参，比如查询条件 
3. SQL语句的返回结果
    
                                
    • 
                                
  • oracle大数据表复制备份个人经验
                                    bitcarter
oracle大表备份大表数据复制
                                    
    前提： 
   数据库仓库A（就拿oracle11g为例）中有两个用户user1和user2,现在有user1中有表ldm_table1,且表ldm_table1有数据5千万以上，ldm_table1中的数据是从其他库B（数据源）中抽取过来的，前期业务理解不够或者需求有变，数据有变动需要重新从B中抽取数据到A库表ldm_table1中。 
    
    
                                
    • 
                                
  • HTTP加速器varnish安装小记
                                    ronin47
http varnish 加速
                                    
    上午共享的那个varnish安装手册，个人看了下，有点不知所云，好吧~看来还是先安装玩玩！ 
苦逼公司服务器没法连外网，不能用什么wget或yum命令直接下载安装，每每看到别人博客贴出的在线安装代码时，总有一股羡慕嫉妒“恨”冒了出来。。。好吧，既然没法上外网，那只能麻烦点通过下载源码来编译安装了！ 
Varnish 3.0.4下载地址： http://repo.varnish-cache.org/
    
                                
    • 
                                
  • java-73-输入一个字符串，输出该字符串中对称的子字符串的最大长度
                                    bylijinnan
java
                                    
    

public class LongestSymmtricalLength {

	/*
	 * Q75题目：输入一个字符串，输出该字符串中对称的子字符串的最大长度。
	 * 比如输入字符串“google”，由于该字符串里最长的对称子字符串是“goog”，因此输出4。
	 */
	
	public static void main(String[] args) {
		Str
    
                                
    • 
                                
  • 学习编程的一点感想
                                    Cb123456
编程感想Gis
                                    
           写点感想，总结一些，也顺便激励一些自己.现在就是复习阶段，也做做项目. 
  
   本专业是GIS专业，当初觉得本专业太水，靠这个会活不下去的，所以就报了培训班。学习的时候，进入状态很慢，而且当初进去的时候，已经上到Java高级阶段了，所以.....，呵呵，之后有点感觉了，不过，还是不好好写代码，还眼高手低的，有
    
                                
    • 
                                
  • [能源与安全]美国与中国
                                    comsci
能源
                                    
     
 
     现在有一个局面：地球上的石油只剩下N桶，这些油只够让中国和美国这两个国家中的一个顺利过渡到宇宙时代，但是如果这两个国家为争夺这些石油而发生战争，其结果是两个国家都无法平稳过渡到宇宙时代。。。。而且在战争中，剩下的石油也会被快速消耗在战争中，结果是两败俱伤。。。 
 
 
      在这个大
    
                                
    • 
                                
  • SEMI-JOIN执行计划突然变成HASH JOIN了 的原因分析
                                    cwqcwqmax9
oracle
                                    
    甲说： 
A B两个表总数据量都很大，在百万以上。 
idx1  idx2字段表示是索引字段 
A B 两表上都有 
col1字段表示普通字段 
 
select xxx from A 
where A.idx1 between mmm and nnn 
     and exists (select 1 from B where B.idx2 =
    
                                
    • 
                                
  • SpringMVC-ajax返回值乱码解决方案
                                    dashuaifu
AjaxspringMVCresponse中文乱码
                                    
      
SpringMVC-ajax返回值乱码解决方案 
  
一：（自己总结，测试过可行） 
ajax返回如果含有中文汉字，则使用：（如下例：） 
@RequestMapping(value="/xxx.do")       public @ResponseBody void getPunishReasonB
    
                                
    • 
                                
  • Linux系统中查看日志的常用命令
                                    dcj3sjt126com
OS
                                    
    因为在日常的工作中，出问题的时候查看日志是每个管理员的习惯，作为初学者，为了以后的需要，我今天将下面这些查看命令共享给各位 
cat 
tail -f 
日 志 文 件 说 明 
/var/log/message 系统启动后的信息和错误日志，是Red Hat Linux中最常用的日志之一 
/var/log/secure 与安全相关的日志信息 
/var/log/maillog 与邮件相关的日志信
    
                                
    • 
                                
  • [应用结构]应用
                                    dcj3sjt126com
PHPyii2
                                    
    应用主体 
应用主体是管理 Yii 应用系统整体结构和生命周期的对象。 每个Yii应用系统只能包含一个应用主体，应用主体在 入口脚本中创建并能通过表达式 \Yii::$app 全局范围内访问。 
 
 补充: 当我们说"一个应用"，它可能是一个应用主体对象，也可能是一个应用系统，是根据上下文来决定[译：中文为避免歧义，Application翻译为应
    
                                
    • 
                                
  • assertThat用法
                                    eksliang
JUnitassertThat
                                    
    junit4.0  assertThat用法 
一般匹配符1、assertThat( testedNumber, allOf( greaterThan(8), lessThan(16) ) ); 
注释： allOf匹配符表明如果接下来的所有条件必须都成立测试才通过，相当于“与”（&&） 
2、assertThat( testedNumber, anyOf( g
    
                                
    • 
                                
  • android点滴2
                                    gundumw100
应用服务器android网络应用OSHTC
                                    
    如何让Drawable绕着中心旋转？ 
 

Animation a = new RotateAnimation(0.0f, 360.0f,
Animation.RELATIVE_TO_SELF, 0.5f, Animation.RELATIVE_TO_SELF,0.5f);
a.setRepeatCount(-1);
a.setDuration(1000);
 
 
如何控制Andro
    
                                
    • 
                                
  • 超简洁的CSS下拉菜单
                                    ini
htmlWeb工作html5css
                                    
    效果体验：http://hovertree.com/texiao/css/3.htmHTML文件： 
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>简洁的HTML+CSS下拉菜单-HoverTree</title>
    
                                
    • 
                                
  • kafka consumer防止数据丢失
                                    kane_xie
kafkaoffset commit
                                    
    kafka最初是被LinkedIn设计用来处理log的分布式消息系统，因此它的着眼点不在数据的安全性（log偶尔丢几条无所谓），换句话说kafka并不能完全保证数据不丢失。 
  
尽管kafka官网声称能够保证at-least-once，但如果consumer进程数小于partition_num，这个结论不一定成立。 
  
考虑这样一个case，partiton_num=2
    
                                
    • 
                                
  • @Repository、@Service、@Controller 和 @Component
                                    mhtbbx
DAOspringbeanprototype
                                    
    @Repository、@Service、@Controller 和 @Component 将类标识为Bean 
Spring 自 2.0 版本开始，陆续引入了一些注解用于简化 Spring 的开发。@Repository注解便属于最先引入的一批，它用于将数据访问层 (DAO 层 ) 的类标识为 Spring Bean。具体只需将该注解标注在 DAO类上即可。同时，为了让 Spring 能够扫描类
    
                                
    • 
                                
  • java 多线程高并发读写控制 误区
                                    qifeifei
java thread
                                    
    先看一下下面的错误代码，对写加了synchronized控制，保证了写的安全，但是问题在哪里呢？ 
public class testTh7 {
	private String data;
	public String read(){
		System.out.println(Thread.currentThread().getName() + "read data " 
    
                                
    • 
                                
  • mongodb replica set(副本集)设置步骤
                                    tcrct
javamongodb
                                    
    网上已经有一大堆的设置步骤的了，根据我遇到的问题，整理一下，如下： 
 
首先先去下载一个mongodb最新版，目前最新版应该是2.6 
 

cd /usr/local/bin
wget http://fastdl.mongodb.org/linux/mongodb-linux-x86_64-2.6.0.tgz
tar -zxvf  mongodb-linux-x86_64-2.6.0.t
    
                                
    • 
                                
  • rust学习笔记
                                    wudixiaotie
学习笔记
                                    
    1.rust里绑定变量是let，默认绑定了的变量是不可更改的，所以如果想让变量可变就要加上mut。 
let x = 1; let mut y = 2; 
2.match 相当于erlang中的case，但是case的每一项后都是分号，但是rust的match却是逗号。 
3.match 的每一项最后都要加逗号，但是最后一项不加也不会报错，所有结尾加逗号的用法都是类似。 
4.每个语句结尾都要加分
    
                                
    •