| @@ -0,0 +1,58 @@ | |||
| package com.simple.config; | |||
| import java.io.IOException; | |||
| import java.util.Optional; | |||
| import javax.servlet.Filter; | |||
| import javax.servlet.FilterChain; | |||
| import javax.servlet.FilterConfig; | |||
| import javax.servlet.ServletException; | |||
| import javax.servlet.ServletRequest; | |||
| import javax.servlet.ServletResponse; | |||
| import javax.servlet.http.HttpServletRequest; | |||
| import javax.servlet.http.HttpServletResponse; | |||
| /** | |||
| * 前后端分离RESTful接口过滤器 | |||
| * | |||
| * @author xuguoqin | |||
| * | |||
| */ | |||
| public class RestFilter implements Filter { | |||
| @Override | |||
| public void init(FilterConfig filterConfig) throws ServletException { | |||
| } | |||
| @Override | |||
| public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) | |||
| throws IOException, ServletException { | |||
| HttpServletRequest req = null; | |||
| if (request instanceof HttpServletRequest) { | |||
| req = (HttpServletRequest) request; | |||
| } | |||
| HttpServletResponse res = null; | |||
| if (response instanceof HttpServletResponse) { | |||
| res = (HttpServletResponse) response; | |||
| } | |||
| if (req != null && res != null) { | |||
| //设置允许传递的参数 | |||
| res.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization"); | |||
| //设置允许带上cookie | |||
| res.setHeader("Access-Control-Allow-Credentials", "true"); | |||
| String origin = Optional.ofNullable(req.getHeader("Origin")).orElse(req.getHeader("Referer")); | |||
| //设置允许的请求来源 | |||
| res.setHeader("Access-Control-Allow-Origin", origin); | |||
| //设置允许的请求方法 | |||
| res.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, PUT, DELETE, OPTIONS"); | |||
| } | |||
| chain.doFilter(request, response); | |||
| } | |||
| @Override | |||
| public void destroy() { | |||
| } | |||
| } | |||
| @@ -1,7 +1,13 @@ | |||
| package com.simple.config; | |||
| import com.simple.service.MallPermissionService; | |||
| import com.simple.shiro.MyShiroRealm; | |||
| import java.util.HashMap; | |||
| import java.util.LinkedHashMap; | |||
| import java.util.Map; | |||
| import javax.servlet.ServletRequest; | |||
| import javax.servlet.ServletResponse; | |||
| import javax.servlet.http.HttpServletRequest; | |||
| import org.apache.shiro.authc.credential.HashedCredentialsMatcher; | |||
| import org.apache.shiro.mgt.SecurityManager; | |||
| import org.apache.shiro.spring.LifecycleBeanPostProcessor; | |||
| @@ -18,8 +24,11 @@ import org.springframework.beans.factory.annotation.Value; | |||
| import org.springframework.context.annotation.Bean; | |||
| import org.springframework.context.annotation.Configuration; | |||
| import java.util.LinkedHashMap; | |||
| import java.util.Map; | |||
| import com.simple.service.MallPermissionService; | |||
| import com.simple.shiro.MyShiroRealm; | |||
| import javax.servlet.Filter; | |||
| /** | |||
| * Created by yangqj on 2017/4/23. | |||
| @@ -72,11 +81,14 @@ public class ShiroConfig { | |||
| public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager){ | |||
| System.out.println("ShiroConfiguration.shirFilter()"); | |||
| ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); | |||
| // 必须设置 SecurityManager | |||
| shiroFilterFactoryBean.setSecurityManager(securityManager); | |||
| Map<String, Filter> filters = new LinkedHashMap<String, Filter>(); | |||
| filters.put("token", new ShiroLoginFilter()); | |||
| filters.put("corsFilter", new RestFilter()); | |||
| shiroFilterFactoryBean.setFilters(filters); | |||
| // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面 | |||
| shiroFilterFactoryBean.setLoginUrl("/login"); | |||
| // shiroFilterFactoryBean.setLoginUrl("/login"); | |||
| // 登录成功后要跳转的链接 | |||
| shiroFilterFactoryBean.setSuccessUrl("/usersPage"); | |||
| @@ -109,7 +121,8 @@ public class ShiroConfig { | |||
| filterChainDefinitionMap.put("/swagger-resources/**","anon"); | |||
| filterChainDefinitionMap.put("/webjars/**","anon"); | |||
| filterChainDefinitionMap.put("/wxMsgCallback/**","anon"); | |||
| filterChainDefinitionMap.put("/**", "authc"); | |||
| // filterChainDefinitionMap.put("/role/**", "corsFilter,token"); | |||
| filterChainDefinitionMap.put("/**", "corsFilter,token,authc"); | |||
| // filterChainDefinitionMap.put("/**", "anon"); | |||
| @@ -118,6 +131,18 @@ public class ShiroConfig { | |||
| } | |||
| public static boolean isAjax(ServletRequest request){ | |||
| String header = ((HttpServletRequest) request).getHeader("X-Requested-With"); | |||
| if("XMLHttpRequest".equalsIgnoreCase(header)){ | |||
| System.out.println( "当前请求为Ajax请求"); | |||
| return Boolean.TRUE; | |||
| } | |||
| System.out.println( "当前请求非Ajax请求"); | |||
| return Boolean.FALSE; | |||
| } | |||
| @Bean | |||
| public SecurityManager securityManager(){ | |||
| DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); | |||
| @@ -0,0 +1,31 @@ | |||
| package com.simple.config; | |||
| import javax.servlet.ServletRequest; | |||
| import javax.servlet.ServletResponse; | |||
| import javax.servlet.http.HttpServletRequest; | |||
| import org.apache.shiro.web.filter.authc.FormAuthenticationFilter; | |||
| import com.alibaba.fastjson.JSON; | |||
| import com.simple.common.ResultData; | |||
| public class ShiroLoginFilter extends FormAuthenticationFilter { | |||
| @Override | |||
| protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { | |||
| response.setCharacterEncoding("UTF-8"); | |||
| response.setContentType("application/json"); | |||
| ResultData resultData = new ResultData(ResultData.UNLOGIN,"用户未登录"); | |||
| response.getWriter().write(JSON.toJSONString(resultData)); | |||
| return false; | |||
| } | |||
| /** | |||
| * 判断ajax请求 | |||
| * @param request | |||
| * @return | |||
| */ | |||
| boolean isAjax(HttpServletRequest request){ | |||
| return (request.getHeader("X-Requested-With") != null && "XMLHttpRequest".equals( request.getHeader("X-Requested-With").toString()) ) ; | |||
| } | |||
| } | |||
| @@ -20,7 +20,7 @@ import com.simple.service.MallPermissionService; | |||
| /** | |||
| * Created by yangqj on 2017/4/30. | |||
| */ | |||
| @Service | |||
| //@Service | |||
| public class ShiroService { | |||
| @Autowired | |||
| private ShiroFilterFactoryBean shiroFilterFactoryBean; | |||