shiro:
 loginUrl: /myController/login
 
或者
 
shiro.loginUrl=/myController/login

登录认证

后端接口服务实现

创建库表

CREATE DATABASE IF NOT EXISTS `shirodb` CHARACTER SET utf8mb4;
USE `shirodb`;
CREATE TABLE `user` (
 `id` BIGINT(20) NOT NULL AUTO_INCREMENT COMMENT '编号',
 `name` VARCHAR(30) DEFAULT NULL COMMENT '用户名',
 `pwd` VARCHAR(50) DEFAULT NULL COMMENT '密码',
 `rid` BIGINT(20) DEFAULT NULL COMMENT '角色编号',
 PRIMARY KEY (`id`)
) ENGINE=INNODB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8 COMMENT='用户表';

创建实体

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
 
@Data
@NoArgsConstructor
@AllArgsConstructor
public class User {
    private Integer id;
    private String name;
    private String pwd;
    private Integer rid;
}

import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.example.demo.model.User;
import org.springframework.stereotype.Repository;
 
@Repository
public interface UserMapper extends BaseMapper<User> {
}

import com.example.demo.model.User;
 
public interface UserService {
 //用户登录
 User getUserInfoByName(String name);
}

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.example.demo.mapper.UserMapper;
import com.example.demo.model.User;
import com.example.demo.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
 
@Service
public class UserServiceImpl implements UserService {
  @Autowired
  private UserMapper userMapper;
  @Override
  public User getUserInfoByName(String name) {
     QueryWrapper wrapper = new QueryWrapper<>();
     wrapper.eq("name",name);
     User user = userMapper.selectOne(wrapper);
     return user;
  }
}

import com.example.demo.model.User;
import com.example.demo.service.UserService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
 
@Component
public class MyRealm extends AuthorizingRealm {
     @Autowired
     private UserService userService;
     //自定义授权方法
     @Override
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
         return null;
     }
     //自定义登录认证方法
     @Override
     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
          //1 获取用户身份信息
          String name = token.getPrincipal().toString();
          //2 调用业务层获取用户信息（数据库中）
          User user = userService.getUserInfoByName(name);
          //3 判断并将数据完成封装
          if(user!=null){
          AuthenticationInfo info = new SimpleAuthenticationInfo(
          token.getPrincipal(),
          user.getPwd(),
          ByteSource.Util.bytes("salt"),
          token.getPrincipal().toString()
          );
          return info;
          }
          return null;
     }
}

import com.example.demo.component.MyRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
 
@Configuration
public class ShiroConfig {
      @Autowired
      private MyRealm myRealm;
     
      //配置 SecurityManager
      @Bean
      public DefaultWebSecurityManager defaultWebSecurityManager() {
          //1 创建 defaultWebSecurityManager 对象
          DefaultWebSecurityManager defaultWebSecurityManager = new
                  DefaultWebSecurityManager();
          //2 创建加密对象，并设置相关属性
          HashedCredentialsMatcher matcher = new
                  HashedCredentialsMatcher();
          //2.1 采用 md5 加密
          matcher.setHashAlgorithmName("md5");
          //2.2 迭代加密次数
          matcher.setHashIterations(3);
          //3 将加密对象存储到 myRealm 中
          myRealm.setCredentialsMatcher(matcher);
          //4 将 myRealm 存入 defaultWebSecurityManager 对象
          defaultWebSecurityManager.setRealm(myRealm);
          //5 返回
          return defaultWebSecurityManager;
      }
     
      //配置 Shiro 内置过滤器拦截范围
      @Bean
      public DefaultShiroFilterChainDefinition shiroFilterChainDefinition() {
          DefaultShiroFilterChainDefinition definition = new DefaultShiroFilterChainDefinition();
          //设置不认证可以访问的资源
          definition.addPathDefinition("/myController/userLogin", "anon");
          definition.addPathDefinition("/login", "anon");
          //设置需要进行登录认证的拦截范围
          definition.addPathDefinition("/**", "authc");
          return definition;
      }
}

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
 
@Controller
@RequestMapping("myController")
public class MyController {
      @GetMapping("userLogin")
      @ResponseBody
      public String userLogin(String name,String pwd){
           //1 获取 Subject 对象
           Subject subject = SecurityUtils.getSubject();
           //2 封装请求数据到 token 对象中
           AuthenticationToken token = new UsernamePasswordToken(name,pwd);
           //3 调用 login 方法进行登录认证
           try {
              subject.login(token);
              return "登录成功";
           } catch (AuthenticationException e) {
              e.printStackTrace();
              System.out.println("登录失败");
              return "登录失败";
           }
      }
}

"en" xmlns:th="http://www.thymeleaf.org">
  "UTF-8">
  
Shiro 登录认证后主页面

登录用户为："${session.user}">

添加 controller 方法

//跳转登录页面
    @GetMapping("login")
    public String login(){
        return "login";
    }
    //登录认证
    @GetMapping("userLogin")
    public String userLogin(String name, String pwd, HttpSession session){
        //1 获取 Subject 对象
        Subject subject = SecurityUtils.getSubject();
        //2 封装请求数据到 token 对象中
        AuthenticationToken token = new UsernamePasswordToken(name,pwd);
        //3 调用 login 方法进行登录认证
        try {
            subject.login(token);
            session.setAttribute("user",token.getPrincipal().toString());
            return "main";
        } catch (AuthenticationException e) {
            e.printStackTrace();
            System.out.println("登录失败");
            return "登录失败";
        }
    }

import com.example.demo.component.MyRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
 
import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
 
@Configuration
public class ShiroConfig {
      @Autowired
      private MyRealm myRealm;
 
      //配置 SecurityManager
      @Bean
      public DefaultWebSecurityManager defaultWebSecurityManager() {
          //1 创建 defaultWebSecurityManager 对象
          DefaultWebSecurityManager defaultWebSecurityManager = new
                  DefaultWebSecurityManager();
          //2 创建加密对象，并设置相关属性
          HashedCredentialsMatcher matcher = new
                  HashedCredentialsMatcher();
          //2.1 采用 md5 加密
          matcher.setHashAlgorithmName("md5");
          //2.2 迭代加密次数
          matcher.setHashIterations(3);
          //3 将加密对象存储到 myRealm 中
          myRealm.setCredentialsMatcher(matcher);
          //4 将 myRealm 存入 defaultWebSecurityManager 对象
          defaultWebSecurityManager.setRealm(myRealm);
          //4.5 设置 rememberMe
          defaultWebSecurityManager.setRememberMeManager(rememberMeManager());
          //5 返回
          return defaultWebSecurityManager;
      }
    //cookie 属性设置
    public SimpleCookie rememberMeCookie(){
        SimpleCookie cookie = new SimpleCookie("rememberMe");
        //设置跨域
        //cookie.setDomain(domain);
        cookie.setPath("/");
        cookie.setHttpOnly(true);
        cookie.setMaxAge(30*24*60*60);
        return cookie;
    }
    //创建 Shiro 的 cookie 管理对象
    public CookieRememberMeManager rememberMeManager(){
        CookieRememberMeManager cookieRememberMeManager = new
                CookieRememberMeManager();
        cookieRememberMeManager.setCookie(rememberMeCookie());
 
        cookieRememberMeManager.setCipherKey("1234567890987654".getBytes());
        return cookieRememberMeManager;
    }
 
 
      //配置 Shiro 内置过滤器拦截范围
      @Bean
      public DefaultShiroFilterChainDefinition shiroFilterChainDefinition() {
          DefaultShiroFilterChainDefinition definition = new DefaultShiroFilterChainDefinition();
          //设置不认证可以访问的资源
          definition.addPathDefinition("/myController/userLogin", "anon");
          definition.addPathDefinition("/myController/login", "anon");
          definition.addPathDefinition("/login", "anon");
          //设置需要进行登录认证的拦截范围
          definition.addPathDefinition("/**", "authc");
          //添加存在用户的过滤器（rememberMe）
          definition.addPathDefinition("/**","user");
          return definition;
      }
 
}

//登录认证
    @GetMapping("userLogin")
    public String userLogin(String name, String pwd,@RequestParam(defaultValue =
            "false")boolean rememberMe, HttpSession session){
        //1 获取 Subject 对象
        Subject subject = SecurityUtils.getSubject();
        //2 封装请求数据到 token 对象中
        AuthenticationToken token = new UsernamePasswordToken(name,pwd,rememberMe);
        //3 调用 login 方法进行登录认证
        try {
            subject.login(token);
            session.setAttribute("user",token.getPrincipal().toString());
            return "main";
        } catch (AuthenticationException e) {
            e.printStackTrace();
            System.out.println("登录失败");
            return "登录失败";
        }
    }
    //登录认证验证 rememberMe
    @GetMapping("userLoginRm")
    public String userLogin(HttpSession session) {
        session.setAttribute("user","rememberMe");
        return "main";
    }

 
Shiro 登录认证
 
 
"/myController/userLogin">
 
用户名："text" name="name" value="">
 
密码："password" name="pwd" value="">
 
记住用户："checkbox" name="rememberMe" 
value="true">