Java安全框架——Apache Shiro（十八）

持续创作，加速成长！这是我参与「掘金日新计划 · 10 月更文挑战」的第10天，点击查看活动详情

【1.4】案例

【1.4.1】创建项目

拷贝shiro-day01-07web新建shiro-day01-08web-java

【1.4.2】修改shiro.ini

#声明自定义的realm，且为安全管理器指定realms

[main]

definitionRealm=com.itheima.shiro.realm.DefinitionRealm

securityManager.realms=$definitionRealm

#用户退出后跳转指定JSP页面

logout.redirectUrl=/login.jsp

#若没有登录，则被authc过滤器重定向到login.jsp页面

authc.loginUrl = /login.jsp

[urls]

/login=anon

#发送/home请求需要先登录

#/home= authc

#发送/order/list请求需要先登录

#/order-list = roles[admin]

#提交代码需要order:add权限

#/order-add = perms["order:add"]

#更新代码需要order:del权限

#/order-del = perms["order:del"]

#发送退出请求则用退出过滤器

/logout = logout

【1.4.3】登录相关

修改HomeServlet的doPost方法

package com.itheima.shiro.web;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @Description：系统home页面
 */
@WebServlet(urlPatterns = "/home")
public class HomeServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        doPost(req, resp);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        //通过subjectd对象去判断是否登录
        Subject subject = SecurityUtils.getSubject();
        boolean flag  = subject.isAuthenticated();
        if (flag){
            resp.sendRedirect("home.jsp");
        }else {
            req.getRequestDispatcher("/login").forward(req, resp);
        }
    }
}

访问http://localhost:8080/platform/home 进行debug

此时我们通过subject.isAuthenticated()判断是否登录，如果登录则重定向到home.jsp,如果没有登录则转发到/login对应的servlet

【1.4.4】角色相关

修改OrderListServlet的doPost方法，判断是否有admin角色，如果有则转发order-list.jsp,没有则转发/login

package com.itheima.shiro.web;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * @Description：订单列表
 */
@WebServlet(urlPatterns = "/order-list")
public class OrderListServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        doPost(req, resp);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        Subject subject = SecurityUtils.getSubject();
        //判断当前角色
        boolean flag = subject.hasRole("admin");
        if (flag){
            req.getRequestDispatcher("order-list.jsp").forward(req, resp);
        }else {
            req.getRequestDispatcher("/login").forward(req, resp);
        }
    }
}

访问http://localhost:8080/platform/order-list

因为此时我未登录，也就是说当前没有admin角色，这是通过subject.hasRole("admin")返回未false