为什么“/index”重定向到 shiro 中的 UnauthorizedUrl？答案

【问题标题】：Why the "/index" redirect to the UnauthorizedUrl in shiro?为什么“/index”重定向到 shiro 中的 UnauthorizedUrl？
【发布时间】：2018-01-14 00:02:04
【问题描述】：

我用springboot测试了shiro，但是不管像127.0.0.1:8080/index这样的url被重定向到UnauthorizedUrl("/error");

这是我的 ShiroConfig：

@Configuration
public class ShiroConfig {

    @Bean(name = "lifecycleBeanPostProcessor")
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public MyShiroRealm myShiroRealm(){
        MyShiroRealm myShiroRealm = new MyShiroRealm();
        myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return myShiroRealm;
    }

    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher(){
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("MD5");
        hashedCredentialsMatcher.setHashIterations(2);
        return hashedCredentialsMatcher;
    }

    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(myShiroRealm());
        //securityManager.setCacheManager(ehCacheManager());
        return securityManager;
    }

    @Bean
    public ShiroFilterFactoryBean shiroFilter() {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager());

        Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
        filterChainDefinitionMap.put("/index", "anon");

        filterChainDefinitionMap.put("/logout", "logout");

        filterChainDefinitionMap.put("/**", "authc");

        shiroFilterFactoryBean.setLoginUrl("/login");

        shiroFilterFactoryBean.setSuccessUrl("/welcome");
        //Unauthorized;
        shiroFilterFactoryBean.setUnauthorizedUrl("/error");        
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);       
        return shiroFilterFactoryBean;
    } 

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(){
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
        return authorizationAttributeSourceAdvisor;
    }

    @Bean
    @ConditionalOnMissingBean
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAAP = new DefaultAdvisorAutoProxyCreator();
        defaultAAP.setProxyTargetClass(true);
        return defaultAAP;
    }

    @Bean
    public PassThruAuthenticationFilter passThruAuthenticationFilter(){
        return new PassThruAuthenticationFilter();
    }
}

和王国

public class MyShiroRealm extends AuthorizingRealm {
    private static final  Logger LOGGER = Logger.getLogger(MyShiroRealm.class);
    @Resource 
    UserService userService;

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        LOGGER.info("AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) : "+principalCollection);
        String principal=(String) principalCollection.getPrimaryPrincipal();
        LOGGER.info(principal);
        User user=(User) userService.findUserByName(principal);
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        for(Role role:user.getRoles()){
            info.addRole(role.getName());
            for(Permission permission:role.getPermissions()){
                info.addStringPermission(permission.getName());
            }
        }
        return info;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        LOGGER.info("AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) : "+authenticationToken);
        String name=((UsernamePasswordToken)authenticationToken).getUsername();
        User user=userService.findUserByName(name);
        if (user != null) {
          Session session = SecurityUtils.getSubject().getSession();
          session.setAttribute("user", user);
          return new SimpleAuthenticationInfo(name,user.getPassword(),getName());
      } else {
          return null;
      }
    }
}

application.properties 中的属性

#thymeleaf
spring.thymeleaf.cache=false

#hibernate
spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQL5InnoDBDialect

spring.jpa.show-sql= true
#html

spring.mvc.view.prefix=/

spring.mvc.view.suffix=.html

没有给出数据库属性。 Tomcat的服务器端口是8080。

资源目录： dir of resource

当我访问“127.0.0.1:8080/index”时，它会重定向到由

设置的“错误”页面

  shiroFilterFactoryBean.setUnauthorizedUrl("/error");.

当给定“/login”控制器方法时，它会重定向到登录页面。

我很困惑，找不到解决办法。

更新

将 index.html 移动到模板目录并创建 @RequestMapping("/index") 方法后，我在浏览器中获取索引。（如果 index.html 在静态目录中，则 @RequestMapping("/ index") 方法不起作用。）我怎样才能得到静态的html？

【问题讨论】：

标签： spring-boot shiro

【解决方案1】：

正如我测试的那样，对于静态文件夹中的资源，例如 "/css/**","/index.html" ，

如果我们想在不被shiro拦截的情况下访问它们，

全名喜欢

 "127.0.0.1:8080/css/a.css" or "127.0.0.1:8080/index.html",

应该使用，

filterChainDefinitionMap 应该设置为哪个

    filterChainDefinitionMap.put("/index.html", "anon");

    filterChainDefinitionMap.put("/css/**", "anon");

【讨论】：