Loading...
My Blog 我的工作和学习笔记

Apache Shiro配置shiroFilter过滤url鉴权引起错误问题的处理

Apache框架笔记 2015/12/27 Spring MVC , Apache Shiro

Apache Shiro配置shiroFilter拦截url登录于鉴权引起的错误问题处理

<!-- Shiro Filter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/login" />
        <property name="successUrl" value="/system/main" />
        <property name="unauthorizedUrl" value="/login" />
        <property name="filterChainDefinitions">
            <value>
            /console/toSignin = anon
            /console/signin = anon
            /console/validateCode = anon
            
            /console/** = authc
            
            /blog/article/input** = authc
            /blog/tag** = authc
            /blog/channel** = authc
            
            /todo/input** = authc
            /todo/edit** = authc
            /todoitem/input** = authc
            
            </value>
        </property>
</bean>

在上述配置中加authc的url,如果用户没登陆,便会跳转到loginUrl进行登陆。

如果通过在方法上加注解@RequiresAuthentication去实现url的鉴权,则存在如下问题:

1. 如果用户没登陆系统,系统给出如下异常:

org.apache.shiro.authz.UnauthenticatedException: The current Subject is not authenticated.  Access denied.

而不会跳转到loginUrl登陆。

2.如果是用户已经登陆,但是没某个url操作的权限,则需要在方法上加注解@RequiresPermissions(value="user:create")让其具有权限才能执行,否则抛出如下异常:

org.apache.shiro.authz.UnauthorizedException: Subject does not have permission [user:create]

而不会跳转到loginUrl登陆。


为了对这些异常进行拦截处理,可以通过如下方法

1、编写Spring MVC拦截器进行拦截

2、配置Spring MVC全局错误拦截


这里进行Spring MVC全局错误拦截:

<!-- 全局错误拦截配置 -->

<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="exceptionMappings">
            <props>
            <!-- 登录错误 -->
            <prop key="org.apache.shiro.authz.UnauthenticatedException">redirect:/login</prop>
            <!-- 授权错误 -->
                <prop key="org.apache.shiro.authz.UnauthorizedException">/base/error/403</prop>
            </props>
        </property>
        <!-- 默认错误 -->
        <property name="defaultErrorView" value="/base/error/500"/>
</bean>


参考文档

http://wenku.baidu.com/view/97f5868b76eeaeaad1f33065.html


Spring MVC项目添加Spring mobile支持

Spring专题 2015/12/18 Spring MVC , Spring Framework



1、添加jar包支持

//Spring mobile

compile 'org.springframework.mobile:spring-mobile-device:1.1.3.RELEASE'


2、Spring MVC配置文件添加如下内容 
<mvc:interceptors>
 <!-- On pre-handle, resolve the device that originated the web request -->
 <mvc:interceptor>
  <mvc:mapping path="/mobile/**"/>
    <bean class="org.springframework.mobile.device.DeviceResolverHandlerInterceptor" />
   </mvc:interceptor> 
</mvc:interceptors> 

<mvc:annotation-driven>
 <mvc:argument-resolvers>
     <bean class="org.springframework.mobile.device.DeviceWebArgumentResolver" />
 </mvc:argument-resolvers>
</mvc:annotation-driven>


3、控制器代码

@Controller

@RequestMapping("/mobile")

public class MobileController {

 

    @RequestMapping("")

    public String mobile(Device device,Model model) {

        String message = "";

        if (device.isMobile()) {

        System.out.println(message = "Hello mobile user!");

        } else if (device.isTablet()) {

        System.out.println(message = "Hello tablet user!");

        } else {

        System.out.println(message = "Hello desktop user!");

        }

        model.addAttribute("message", message);

        return "mobile/mobile";

    }

}

 


更多详细配置请看:http://projects.spring.io/spring-mobile/