之前要先了解Session的来源Shiro session和Spring session一样吗？
创建Subject的位置
AbstractShiroFilter . doFilterInternal(ServletRequest, ServletResponse, FilterChain)
第一次创建Session
AbstractShiroFilter . doFilterInternal(ServletRequest, ServletResponse, FilterChain) ->ProxiedFilterChain . doFilter(ServletRequest, ServletResponse) ->OncePerRequestFilter . doFilter(ServletRequest, ServletResponse, FilterChain) ->AdviceFilter . doFilterInternal(ServletRequest, ServletResponse, FilterChain) ->AbstractShiroFilter. doFilterInternal()->PathMatchingFilter .preHandle(ServletRequest, ServletResponse)->PathMatchingFilter. isFilterChainContinued(ServletRequest, ServletResponse, String, Object)->AccessControlFilter .onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) ->AccessControlFilter .onAccessDenied(ServletRequest request, ServletResponse response, Object mappedValue) ->UserFilter. onAccessDenied(ServletRequest request, ServletResponse response) ->AccessControlFilter .saveRequestAndRedirectToLogin (ServletRequest request, ServletResponse response) ->AccessControlFilter. saveRequest(ServletRequest request)->WebUtils. aveRequest(ServletRequest request)-> DelegatingSubject. getSession()->SessionsSecurityManager.start(SessionContext)->AbstractNativeSessionManager. start(SessionContext)
此处没有什么过多说明，跟踪代码就能发现！