`
suichangkele
  • 浏览: 200375 次
  • 性别: Icon_minigender_1
  • 来自: 北京
社区版块
存档分类
最新评论

shiro学习17-shiro提供的filter-AbstractShiroFilter

阅读更多

这个类是上面的OncePerRequestFilter的子类,实现了其doInternalFilter方法,所有的业务逻辑在里面实现。这个类也是一个抽象类,但是没有任何的抽象方法,所以只要集成他就可以直接使用了。

这是一个及其重要的类,shiro集成spring的ShiroFilterFactoryBean返回给spring context中的bean就是他,在ShiroFilterFactoryBean类中,getObject方法就是返回给spring context的bean,里面返回的就是AbstractShiroFilter类,具体的实现是org.apache.shiro.spring.web.ShiroFilterFactoryBean.SpringShiroFilter这个类,在构造方法中将SecurityManager和FilterChainResolver类传入到AbstractShiroFilter中。

private static final class SpringShiroFilter extends AbstractShiroFilter {
 
        protected SpringShiroFilter(WebSecurityManager webSecurityManager, FilterChainResolver resolver) {
            super();
            if (webSecurityManager == null) {
                throw new IllegalArgumentException("WebSecurityManager property cannot be null.");
            }
            setSecurityManager(webSecurityManager);
            if (resolver != null) {
                setFilterChainResolver(resolver);
            }
        }
}

 

在这个类中将filterChainResolver传入进去,filterChainResolver里面有一个属性FilterChainManager,这里面有一个属性filterChains就表示我们在shiroFilterFactoryBean中配置的所有的路径(也可以说是filter的名字)+filter,在filterChainResolver还有一个属性pathMatcher,用来将访问的url和我们匹配的filter的名字像匹配,决定都是调用哪些filter,也就是一个filterChain

 

我们再来看一下AbstractShiroFilter中的 doFilterInternal方法

protected void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse, final FilterChain chain)
            throws ServletException, IOException {
        Throwable t = null;
        try {
            final ServletRequest request = prepareServletRequest(servletRequest, servletResponse, chain);
            final ServletResponse response = prepareServletResponse(request, servletResponse, chain);
            final Subject subject = createSubject(request, response);
            //noinspection unchecked
            subject.execute(new Callable() {
                public Object call() throws Exception {
                    updateSessionLastAccessTime(request, response);
                    executeChain(request, response, chain);//最后调用的是这个方法,
                    return null;
                }
            });
        } catch (ExecutionException ex) {
            t = ex.getCause();
        } catch (Throwable throwable) {
            t = throwable;
        }
        if (t != null) {
            if (t instanceof ServletException) {
                throw (ServletException) t;
            }
            if (t instanceof IOException) {
                throw (IOException) t;
            }
            //otherwise it's not one of the two exceptions expected by the filter method signature - wrap it in one:
            String msg = "Filtered request failed.";
            throw new ServletException(msg, t);
        }
    }

 

executeChain方法如下:

 

 

protected void executeChain(ServletRequest request, ServletResponse response, FilterChain origChain)
            throws IOException, ServletException {
        FilterChain chain = getExecutionChain(request, response, origChain);//调用这个方法获得此次访问应该调用的filter链。
        chain.doFilter(request, response);
}

 

getExecutionChain的代码如下:

 

protected FilterChain getExecutionChain(ServletRequest request, ServletResponse response, FilterChain origChain) {
        FilterChain chain = origChain;
        FilterChainResolver resolver = getFilterChainResolver();//他是根据配置的filterChainResolver来获得匹配的filterChain。这里的origChain就是我们在web.xml里面配置的那个DelegatingFilter,就是用来调用shiro的所有请求的代理filter,所有访问shiro的filter都是由它获得。
        if (resolver == null) {
            log.debug("No FilterChainResolver configured.  Returning original FilterChain.");
            return origChain;
        }
        FilterChain resolved = resolver.getChain(request, response, origChain);
        if (resolved != null) {
            log.trace("Resolved a configured FilterChain for the current request.");
            chain = resolved;
        } else {
            log.trace("No FilterChain configured for the current request.  Using the default.");
        }
        return chain;
    }
 

 

 

通过这个方法我们基本就知道了shiro的处理请求的流程,当某个请求来了之后,他是通过调用配置的ChainResolver调用匹配的路径,如果找到了对应的路径就执行配置的路径后面的所有的filter。另外ShiroFilterFactoryBean向spring context中传入的bean不是传入的自身,而是传入的org.apache.shiro.spring.web.ShiroFilterFactoryBean.SpringShiroFilter这个类,传入的类(也就是spring中的ObjectType)是SpringShiroFilter.class;也不是他自身。

分享到:
评论

相关推荐

    shiro(shiro-all-1.8.0.jar)

    shiro(shiro-all-1.8.0.jar)

    shiro-core-1.4.0-API文档-中文版.zip

    赠送jar包:shiro-core-1.4.0.jar; 赠送原API文档:shiro-core-1.4.0-javadoc.jar; 赠送源代码:shiro-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-core-1.4.0.pom; 包含翻译后的API文档:shiro-core...

    shiro-attack-4.7.0-SNAPSHOT-all.zip

    标题提到的"shiro-attack-4.7.0-SNAPSHOT-all.zip"很可能是针对Apache Shiro的安全测试工具或者漏洞利用工具包,其主要目的是帮助开发者检测和防范Shiro框架相关的安全问题。 描述中的"序列化验证工具"可能是指该...

    shiro-config-core-1.4.0-API文档-中文版.zip

    赠送jar包:shiro-config-core-1.4.0.jar; 赠送原API文档:shiro-config-core-1.4.0-javadoc.jar; 赠送源代码:shiro-config-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-config-core-1.4.0.pom; ...

    shiro-jar.zip

    shiro-all-1.7.1.jar,shiro-aspectj-1.7.1.jar,shiro-cache-1.7.1.jar,shiro-config-core-1.7.1.jar,shiro-config-ogdl-1.7.1.jar,shiro-core-1.7.1.jar,shiro-crypto-cipher-1.7.1.jar,shiro-crypto-core-1.7.1.jar...

    shiro-jar-1.7.0.zip相关资源包

    解决:升級1.7后附件...shiro-cas-1.7.0.jar shiro-core-1.7.0.jar shiro-ehcache-1.7.0.jar shiro-spring-1.7.0.jar shiro-web-1.7.0.jar CustomShiroFilterFactoryBean.java spring-context-shiro.xml 修改说明.txt

    shiro-ehcache-1.4.0-API文档-中文版.zip

    赠送jar包:shiro-ehcache-1.4.0.jar; 赠送原API文档:shiro-ehcache-1.4.0-javadoc.jar; 赠送源代码:shiro-ehcache-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-ehcache-1.4.0.pom; 包含翻译后的API文档...

    shiro-crypto-core-1.4.0-API文档-中文版.zip

    赠送jar包:shiro-crypto-core-1.4.0.jar; 赠送原API文档:shiro-crypto-core-1.4.0-javadoc.jar; 赠送源代码:shiro-crypto-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-crypto-core-1.4.0.pom; ...

    shiro-crypto-cipher-1.4.0-API文档-中文版.zip

    赠送jar包:shiro-crypto-cipher-1.4.0.jar; 赠送原API文档:shiro-crypto-cipher-1.4.0-javadoc.jar; 赠送源代码:shiro-crypto-cipher-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-crypto-cipher-1.4.0....

    shiro-crypto-core-1.4.0-API文档-中英对照版.zip

    赠送jar包:shiro-crypto-core-1.4.0.jar; 赠送原API文档:shiro-crypto-core-1.4.0-javadoc.jar; 赠送源代码:shiro-crypto-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-crypto-core-1.4.0.pom; ...

    shiro-core-1.3.2-API文档-中文版.zip

    赠送jar包:shiro-core-1.3.2.jar; 赠送原API文档:shiro-core-1.3.2-javadoc.jar; 赠送源代码:shiro-core-1.3.2-sources.jar; 包含翻译后的API文档:shiro-core-1.3.2-javadoc-API文档-中文(简体)版.zip ...

    shiro-config-core-1.4.0-API文档-中英对照版.zip

    赠送jar包:shiro-config-core-1.4.0.jar; 赠送原API文档:shiro-config-core-1.4.0-javadoc.jar; 赠送源代码:shiro-config-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-config-core-1.4.0.pom; ...

    shiro-config-ogdl-1.4.0-API文档-中英对照版.zip

    赠送jar包:shiro-config-ogdl-1.4.0.jar; 赠送原API文档:shiro-config-ogdl-1.4.0-javadoc.jar; 赠送源代码:shiro-config-ogdl-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-config-ogdl-1.4.0.pom; ...

    shiro-cas-1.2.3-API文档-中文版.zip

    赠送jar包:shiro-cas-1.2.3.jar; 赠送原API文档:shiro-cas-1.2.3-javadoc.jar; 赠送源代码:shiro-cas-1.2.3-sources.jar; 赠送Maven依赖信息文件:shiro-cas-1.2.3.pom; 包含翻译后的API文档:shiro-cas-...

    shiro-core-1.7.1 jar

    shiro shiro-core-1.7.1 jar shiro漏洞

    shiro-cas-1.2.3-API文档-中英对照版.zip

    赠送jar包:shiro-cas-1.2.3.jar; 赠送原API文档:shiro-cas-1.2.3-javadoc.jar; 赠送源代码:shiro-cas-1.2.3-sources.jar; 赠送Maven依赖信息文件:shiro-cas-1.2.3.pom; 包含翻译后的API文档:shiro-cas-...

    shiro-cache-1.4.0-API文档-中文版.zip

    赠送jar包:shiro-cache-1.4.0.jar; 赠送原API文档:shiro-cache-1.4.0-javadoc.jar; 赠送源代码:shiro-cache-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-cache-1.4.0.pom; 包含翻译后的API文档:shiro-...

    shiro-cache-1.4.0-API文档-中英对照版.zip

    赠送jar包:shiro-cache-1.4.0.jar; 赠送原API文档:shiro-cache-1.4.0-javadoc.jar; 赠送源代码:shiro-cache-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-cache-1.4.0.pom; 包含翻译后的API文档:shiro-...

    shiro-1.7.1.zip

    2. **shiro-web-1.7.1.jar**: 这个模块专门用于Web应用的安全性,提供了过滤器(Filter)来拦截HTTP请求,实现登录、登出、权限检查等功能。例如,Shiro的RememberMe服务、Session管理以及CSRF防护等功能都在这个...

    shiro源码(shiro-root-1.8.0-source-release.zip)

    Apache Shiro 是一个强大且易用的Java安全框架,提供了认证、授权、加密和会话管理功能,可以非常轻松地开发出足够安全的应用程序。它既适用于传统的Web应用,也适用于现代的Java EE和Android应用。现在我们来深入...

Global site tag (gtag.js) - Google Analytics