shiro执行多个过滤器_如何在shiro中使用jwt做身份验证

filterMap.put("/sys/login","anon");
filterMap.put("/**","authc");

protected void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse, final FilterChain chain)
            throws ServletException, IOException {

        Throwable t = null;

        try {
            final ServletRequest request = prepareServletRequest(servletRequest, servletResponse, chain);
            final ServletResponse response = prepareServletResponse(request, servletResponse, chain);

            final Subject subject = createSubject(request, response);

            subject.execute(new Callable() {
                public Object call() throws Exception {
                    updateSessionLastAccessTime(request, response);
                    // 进入这个过滤器
                    executeChain(request, response, chain);
                    return null;
                }
            });

protected void executeChain(ServletRequest request, ServletResponse response, FilterChain origChain)
        throws IOException, ServletException {
    FilterChain chain = getExecutionChain(request, response, origChain);
    chain.doFilter(request, response);
}

protected void executeChain(ServletRequest request, ServletResponse response, FilterChain origChain)
        throws IOException, ServletException {
    FilterChain chain = getExecutionChain(request, response, origChain);
    chain.doFilter(request, response);// 现在单步进入这条语句
}

public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
       throws ServletException, IOException {

        Exception exception = null;

        try {
            boolean continueChain = preHandle(request, response); //现在进入这里

            if (continueChain) {
                executeChain(request, response, chain);
            }

        postHandle(request, response);

@Override
protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) {
    // Always return true since we allow access to anyone
    return true;
}
 

filtersMap.put("jwtAuth", new JWTFilter());
filterFactory.setFilters(filtersMap);

protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
    Subject subject = getSubject(request, response);
    return subject.isAuthenticated();
}

filterMap.put("/sys/**","noSessionCreation, anon");
filterMap.put("/**","noSessionCreation, jwtAuth");

@Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        // 从头信息中获取jwt token
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String token = httpRequest.getHeader("Authorization");
        if (token == null) {
            log.trace("token为空");
            return false;
        }
        Map<String, Object> principal;
        principal = JwtUtils.verifierToken(token);
        if (principal == null) {  // token验证失败, 在onAccessDenied中处理
            return false;
        } else {
            ShiroUtils.setPrincipal(principal);
            // 因为禁用了session, 所以只能自己手动在每次请求通过login方法初始化subject
            initSubject(new JWTUsernamePasswordToken(token));
            return true;
        }
    }

private void initSubject(JWTUsernamePasswordToken token) {
    SecurityUtils.getSubject().login(token);
}

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    if (authenticationToken instanceof JWTUsernamePasswordToken) {  // 仅用于给非匿名请求初始化subject
        JWTUsernamePasswordToken token = (JWTUsernamePasswordToken)authenticationToken;
        return new SimpleAuthenticationInfo(ShiroUtils.getPrincipal(), token.getCredentials(), this.getName());
    } else {  // 匿名请求走这里
        return new SimpleAuthenticationInfo(ShiroUtils.getPrincipal(), ShiroUtils.getCurUser().getPassword(), this.getName());
    }
}
 

@Override
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    // 因为全局@ExceptionHandler注解无法解析过滤器中的异常, 所以不能像下面这样在这里抛出			TokenEncodeException
    // throw new TokenDecodeException("token解析错误");
    // 而是通过重定向到自定义的url再处理错误
    redirectToLogin(request, response);
    return false;
}

@Slf4j
public class JWTFilter extends AccessControlFilter {
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        // 从头信息中获取jwt token
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String token = httpRequest.getHeader("Authorization");
        if (token == null) {
            log.trace("token为空");
            return false;
        }
        Map<String, Object> principal;
        principal = JwtUtils.verifierToken(token);
        if (principal == null) {  // token验证失败, 在onAccessDenied中处理
            return false;
        } else {
            ShiroUtils.setPrincipal(principal);
            // 因为禁用了session, 所以只能自己手动在每次请求通过login方法初始化subject
            initSubject(new JWTUsernamePasswordToken(token));
            return true;
        }
    }

    // 借助login初始化subject
    private void initSubject(JWTUsernamePasswordToken token) {
        SecurityUtils.getSubject().login(token);
    }

    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        // 因为全局@ExceptionHandler注解无法解析过滤器中的异常
        // 所以不能像下面这样在这里抛出TokenEncodeException
        // throw new TokenEncodeException("token解析错误");
        // 而是通过重定向到自定义的url再处理错误
        redirectToLogin(request, response);
        return false;
    }

    @Override
    protected void postHandle(ServletRequest request, ServletResponse response) throws Exception {
        log.trace("清理了ThreadLocal");
        ShiroUtils.cleanUp();
    }
}