之前已经在几个项目中使用过shiro，可以说对shiro已经有了一定的了解，但是最近在处理一个shiro项目的问题时却遇到了空前的挑战。
问题描述：用户登录后用户用着用着就突然自动退出了，而且没有任何规律，有的测试同事反馈一天也不会出现1次，但是有的时候却发现经常自动退出，完全没有看出来任何规律。
问题分析处理步骤：
1、检查httpwatch请求记录；
发现有的时候用户的sessionid突然就变了；
2、怀疑是nginx配置问题(由于新参与这个项目，环境啥的都不了解)
经和运维沟通了解到当前系统是单点、而且nginx已经配置了会话保持，也就是说不存在乱跳的问题。
3、检查了几遍代码理论上程序不会造成这个问题，苦逼啊。然后就在系统中添加了session监控日志；
在程序入口中添加注解：@ServletComponentScan
@WebListener
@Log
public class SessionListener implements HttpSessionListener {
public void sessionCreated(HttpSessionEvent arg0) {
// TODO Auto-generated method stub
log.info("createSession:"+arg0.getSession().getId());
}
public void sessionDestroyed(HttpSessionEvent arg0) {
log.info("destoryedSession:"+arg0.getSession().getId());
}
}经检测发现有的会话几分钟就过期了，之前session使用的系统默认的超时时间，虽然感觉不应该是session会话时间配置的问题，但是还是抱着试试看的态度改了下；最后事实证明的确没卵关系。
4、奇怪的问题又发生了，有的时候用户的sessionid虽然没有变，但是session里边的用户信息却丢失了，我靠瞬间凌乱了。后来同事提醒是不是会话污染导致的，然后又是一顿折腾。
在shiroconfig类中配置会话（这里只列出部分代码，后边会给出完整代码）：
@Bean(name = "sessionIdCookie")
public SimpleCookie getSessionIdCookie() {
SimpleCookie cookie = new SimpleCookie("mysid");
cookie.setHttpOnly(true);
cookie.setMaxAge(-1);
return cookie;
}
@Bean(name = "sessionManager")
public SessionManager getSessionManage() {
DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
sessionManager.setGlobalSessionTimeout(3600000);
sessionManager.setSessionValidationScheduler(getExecutorServiceSessionValidationScheduler());
sessionManager.setSessionValidationSchedulerEnabled(true);
sessionManager.setDeleteInvalidSessions(true);
sessionManager.setSessionIdCookieEnabled(true);
sessionManager.setSessionIdCookie(getSessionIdCookie());
// EnterpriseCacheSessionDAO cacheSessionDAO = new RedisSessionDAO();
sessionManager.setCacheManager(redisCacheManager());
sessionManager.setSessionDAO(redisSessionDAO());
// -----可以添加session 创建、删除的监听器
return sessionManager;
}经测试然而并没有什么卵用，坑爹啊。
5、和原来集成过shiro的项目比对，发现原来的使用的是war包部署，但是这个项目使用的是jar包部署，因此怀疑是不是spring boot内嵌的tomcat容器有啥问题，当跟领导表示要试试修改下容器的时候直接被否了，因此就没有进行测试【个人感觉这种可能性也是存在的，如果以后有也人遇到这种问题可以试试这个方案】。
6、绞尽乳汁的思考问题的可能性，有那么些时刻感觉自己真是黔驴技穷了，这个问题会不会自己处理不了给领导留下不好的印象【刚入职，很尴尬啊】。到此这个问题我已经出来了将近一周了。
6、仔细思考问题的可能原因，既然会话仍在session里边会有问题，那放在别的地方呢？然后就想到了放在redis中试试，说干就干，以下为完整代码。
spring boot+redis+shrio+会话
ShiroConfiguration2
package com.liao.configuration;
import com.liao.shiro.*;
import com.liao.util.PasswordHelper;
import lombok.Data;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.session.mgt.ExecutorServiceSessionValidationScheduler;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.core.RedisTemplate;
import java.util.LinkedHashMap;
import java.util.Map;
@Data
@Configuration
public class ShiroConfiguration2 {
@Autowired
private RedisTemplate redisTemplate;
private static final Logger logger = LoggerFactory.getLogger(ShiroConfiguration.class);
public RedisSessionDAO redisSessionDAO(){
RedisSessionDAO sessionDAO=new RedisSessionDAO();
sessionDAO.redisTemplate=redisTemplate;
return sessionDAO;
}
@Bean
public RedisCacheManager redisCacheManager() {
RedisCacheManager manager=new RedisCacheManager();
manager.setRedisTemplate(redisTemplate);
return manager;
}
@Bean(name = "myShiroRealm")
public MyShiroRealm myShiroRealm(RedisCacheManager redisCacheManager) {
MyShiroRealm realm = new MyShiroRealm();
realm.setCacheManager(redisCacheManager);
return realm;
}
/**
*在此重点说明这个方法，如果不设置为静态方法会导致bean对象无法注入进来，
*我被这个问题坑的想死的心都有了，晚上感到4点多
*我是在这篇博客里找到答案的：
*http://blog.youkuaiyun.com/wuxuyang_7788/article/details/70141812
*/
@Bean(name = "lifecycleBeanPostProcessor")
public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
return new LifecycleBeanPostProcessor();
}
@Bean
public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator();
daap.setProxyTargetClass(true);
return daap;
}
@Bean(name = "securityManager")
public DefaultWebSecurityManager securityManager(MyShiroRealm myShiroRealm) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(myShiroRealm);
securityManager.setSessionManager(getSessionManage());
securityManager.setCacheManager(redisCacheManager());
//配置记住我
securityManager.setRememberMeManager(getCookieRememberMeManager());
return securityManager;
}
@Bean(name = "sessionManager")
public SessionManager getSessionManage() {
DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
sessionManager.setGlobalSessionTimeout(3600000);
sessionManager.setSessionValidationScheduler(getExecutorServiceSessionValidationScheduler());
sessionManager.setSessionValidationSchedulerEnabled(true);
sessionManager.setDeleteInvalidSessions(true);
sessionManager.setSessionIdCookieEnabled(true);
sessionManager.setSessionIdCookie(getSessionIdCookie());
// EnterpriseCacheSessionDAO cacheSessionDAO = new RedisSessionDAO();
sessionManager.setCacheManager(redisCacheManager());
sessionManager.setSessionDAO(redisSessionDAO());
// -----可以添加session 创建、删除的监听器
return sessionManager;
}
@Bean(name = "sessionValidationScheduler")
public ExecutorServiceSessionValidationScheduler getExecutorServiceSessionValidationScheduler() {
ExecutorServiceSessionValidationScheduler scheduler = new ExecutorServiceSessionValidationScheduler();
scheduler.setInterval(900000);
return scheduler;
}
@Bean
public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();
aasa.setSecurityManager(securityManager);
return aasa;
}
/**
* 加载shiroFilter权限控制规则
*
*/
private void loadShiroFilterChain(ShiroFilterFactoryBean shiroFilterFactoryBean) {
/// 下面这些规则配置最好配置到配置文件中 ///
Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
// authc：该过滤器下的页面必须验证后才能访问，它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter
// // anon：它对应的过滤器里面是空的,什么都没做
// logger.info("##################从数据库读取权限规则，加载到shiroFilter中##################");
// filterChainDefinitionMap.put("/user/edit/**", "authc,perms[user:edit]");// 这里为了测试，固定写死的值，也可以从数据库或其他配置中读取
filterChainDefinitionMap.put("/user/login", "anon");
filterChainDefinitionMap.put("/user/logout", "anon");
filterChainDefinitionMap.put("/user/authcode", "anon");
filterChainDefinitionMap.put("/user/admin", "anon");
//filterChainDefinitionMap.put("/user/**", "authc");// 这里为了测试，只限制/user，实际开发中请修改为具体拦截的请求规则
//这个配置可以理解为拦截，authFilter主要用于拦截未登录请求，主动返回规范JSON;user标识如果启用了记住我，则自动登录
filterChainDefinitionMap.put("/**", "authFilter,user");//anon 可以理解为不拦截
//filterChainDefinitionMap.put("/**", "anon");//anon 可以理解为不拦截
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
//shiroFilterFactoryBean.getFilters().put("jCaptchaValidate", getJCaptchaValidateFilter());
}
@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new MShiroFilterFactoryBean();
// 必须设置 SecurityManager
shiroFilterFactoryBean.setSecurityManager(securityManager);
// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
shiroFilterFactoryBean.setLoginUrl("/pyramid/user/nologin");
// 登录成功后要跳转的连接
shiroFilterFactoryBean.setSuccessUrl("/user");
shiroFilterFactoryBean.setUnauthorizedUrl("/403");
shiroFilterFactoryBean.getFilters().put("authFilter",new AuthcFilter());
loadShiroFilterChain(shiroFilterFactoryBean);
return shiroFilterFactoryBean;
}
/**
* @return
*/
@Bean(name = "credentialsMatcher")
public HashedCredentialsMatcher getHashedCredentialsMatcher() {
HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
hashedCredentialsMatcher.setHashAlgorithmName(PasswordHelper.algorithmName);
hashedCredentialsMatcher.setHashIterations(PasswordHelper.hashIterations);
hashedCredentialsMatcher.setStoredCredentialsHexEncoded(true);
return hashedCredentialsMatcher;
}
@Bean(name = "rememberMeCookie")
public SimpleCookie getRememberMeCookie() {
SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
simpleCookie.setHttpOnly(true);
simpleCookie.setMaxAge(2592000);//30天
return simpleCookie;
}
@Bean(name = "sessionIdCookie")
public SimpleCookie getSessionIdCookie() {
SimpleCookie cookie = new SimpleCookie("mysid");
cookie.setHttpOnly(true);
cookie.setMaxAge(-1);
return cookie;
}
@Bean(name = "rememberMeManager")
public CookieRememberMeManager getCookieRememberMeManager() {
CookieRememberMeManager cookieRememberMeManager =
new CookieRememberMeManager();
cookieRememberMeManager.setCipherKey(
org.apache.shiro.codec.Base64.decode("4AvVhmFLUs0KTA3Kprsdag=="));
cookieRememberMeManager.setCookie(getRememberMeCookie());
return cookieRememberMeManager;
}
}MyShiroRealm
package com.liao.shiro;
import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
import org.apache.commons.lang3.builder.ToStringStyle;
import org.apache.shiro.authc.*;
import org.apache.shiro.authc.credential.CredentialsMatcher;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import javax.annotation.PostConstruct;
import java.util.HashSet;
import java.util.stream.Collectors;
@Component
public class MyShiroRealm extends AuthorizingRealm {
private static final Logger logger = LoggerFactory.getLogger(MyShiroRealm.class);
@Autowired
private HashedCredentialsMatcher hashedCredentialsMatcher;
/**
* 权限认证，为当前登录的Subject授予角色和权限
*
* @see {}经测试：本例中该方法的调用时机为需授权资源被访问时
* @see {}经测试：并且每次访问需授权资源时都会执行该方法中的逻辑，这表明本例中默认并未启用AuthorizationCache
* @see {}经测试：如果连续访问同一个URL（比如刷新），该方法不会被重复调用，Shiro有一个时间间隔（也就是cache时间，在ehcache-shiro.xml中配置），超过这个时间间隔再刷新页面，该方法会被执行
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
logger.info("##################执行Shiro权限认证##################");
//在此加入自己逻辑即可
}
/**
* 登录认证
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken authenticationToken) throws AuthenticationException {
//UsernamePasswordToken对象用来存放提交的登录信息
UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
//不做过多说明 加入验证逻辑即可
}
@PostConstruct
public void initCredentialsMatcher() {
setCredentialsMatcher(hashedCredentialsMatcher);
}
@Override
public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
super.setCredentialsMatcher(credentialsMatcher);
}
@Override
public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
super.clearCachedAuthorizationInfo(principals);
}
@Override
public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
super.clearCachedAuthenticationInfo(principals);
}
@Override
public void clearCache(PrincipalCollection principals) {
super.clearCache(principals);
}
public void clearAllCachedAuthorizationInfo() {
getAuthorizationCache().clear();
}
public void clearAllCachedAuthenticationInfo() {
getAuthenticationCache().clear();
}
public void clearAllCache() {
clearAllCachedAuthenticationInfo();
clearAllCachedAuthorizationInfo();
}
}ShiroCache
package com.liao.shiro;
import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
import org.springframework.data.redis.core.RedisTemplate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Set;
import java.util.concurrent.TimeUnit;
/**
* @author liao
* @Time 2017/8/8
*/
@SuppressWarnings("unchecked")
public class ShiroCache <K, V> implements Cache<K, V> {
private static final String REDIS_SHIRO_CACHE = "shiro-cache:";
private String cacheKey;
private RedisTemplate<K, V> redisTemplate;
private long globExpire = 60;
@SuppressWarnings("rawtypes")
public ShiroCache(String name, RedisTemplate client) {
this.cacheKey = REDIS_SHIRO_CACHE + name + ":";
this.redisTemplate = client;
}
@Override
public V get(K key) throws CacheException {
// System.out.println("|"+getCacheKey(key)+"|");
// if(redisTemplate.boundValueOps(getCacheKey(key))==null||"".equals(redisTemplate.boundValueOps(getCacheKey(key)))){
// return null;
// }
// System.out.println("|"+redisTemplate.boundValueOps(getCacheKey(key))+"|");
redisTemplate.boundValueOps(getCacheKey(key)).expire(globExpire, TimeUnit.MINUTES);
return redisTemplate.boundValueOps(getCacheKey(key)).get();
}
@Override
public V put(K key, V value) throws CacheException {
V old = get(key);
redisTemplate.boundValueOps(getCacheKey(key)).set(value);
return old;
}
@Override
public V remove(K key) throws CacheException {
V old = get(key);
redisTemplate.delete(getCacheKey(key));
return old;
}
@Override
public void clear() throws CacheException {
redisTemplate.delete(keys());
}
@Override
public int size() {
return keys().size();
}
@Override
public Set<K> keys() {
return redisTemplate.keys(getCacheKey("*"));
}
@Override
public Collection<V> values() {
Set<K> set = keys();
List<V> list = new ArrayList<>();
for (K s : set) {
list.add(get(s));
}
return list;
}
private K getCacheKey(Object k) {
return (K) (this.cacheKey + k);
}
}
RedisCacheManager
package com.liao.shiro;
import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
import org.apache.shiro.cache.CacheManager;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
/**
* @author liao
* @Time 2017/8/8
*/
@Component
public class RedisCacheManager implements CacheManager {
@Resource
private RedisTemplate<String, Object> redisTemplate;
@Override
public <K, V> Cache<K, V> getCache(String name) throws CacheException {
return new ShiroCache<K, V>(name, redisTemplate);
}
public RedisTemplate<String, ?> getRedisTemplate() {
return redisTemplate;
}
public void setRedisTemplate(RedisTemplate<String, Object> redisTemplate) {
this.redisTemplate = redisTemplate;
}
}
RedisSessionDAO
package com.liao.shiro;
import org.liao.session.Session;
import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
import java.io.Serializable;
import java.util.concurrent.TimeUnit;
/**
* @author liao
* @Time 2017/8/8
*/
@Component
public class RedisSessionDAO extends EnterpriseCacheSessionDAO {
private static Logger logger = LoggerFactory.getLogger(RedisSessionDAO.class);
// session 在redis过期时间是60分钟60*60
private static int expireTime = 3600;
private static String prefix = "shiro-session:";
@Resource
public RedisTemplate<String, Object> redisTemplate;
// 创建session，保存到数据库
@Override
protected Serializable doCreate(Session session) {
Serializable sessionId = super.doCreate(session);
logger.debug("创建session:{}", session.getId());
redisTemplate.opsForValue().set(prefix + sessionId.toString(), session);
return sessionId;
}
// 获取session
@Override
protected Session doReadSession(Serializable sessionId) {
logger.debug("获取session:{}", sessionId);
// 先从缓存中获取session，如果没有再去数据库中获取
Session session = super.doReadSession(sessionId);
if (session == null) {
session = (Session) redisTemplate.opsForValue().get(prefix + sessionId.toString());
}
return session;
}
// 更新session的最后一次访问时间
@Override
protected void doUpdate(Session session) {
super.doUpdate(session);
logger.debug("获取session:{}", session.getId());
String key = prefix + session.getId().toString();
if (!redisTemplate.hasKey(key)) {
redisTemplate.opsForValue().set(key, session);
}
redisTemplate.expire(key, expireTime, TimeUnit.SECONDS);
}
// 删除session
@Override
protected void doDelete(Session session) {
logger.debug("删除session:{}", session.getId());
super.doDelete(session);
redisTemplate.delete(prefix + session.getId().toString());
}
}
ShiroUser
package com.lenovo.pyramid.shiro;
import java.io.Serializable;
import java.util.Objects;
/**
* 自定义Authentication对象，使得Subject除了携带用户的登录名外还可以携带更多信息.
*/
public class ShiroUser implements Serializable {
private static final long serialVersionUID = -1373760761780840081L;
public String loginName;
public String name;
public Long userId;
public ShiroUser(String loginName, String name,Long userId) {
this.loginName = loginName;
this.name = name;
this.userId = userId;
}
public String getName() {
return name;
}
/**
* 本函数输出将作为默认的<shiro:principal/>输出.
*/
@Override
public String toString() {
return loginName;
}
/**
* 重载hashCode,只计算loginName;
*/
@Override
public int hashCode() {
return Objects.hashCode(loginName);
}
/**
* 重载equals,只计算loginName;
*/
@Override
public boolean equals(Object obj) {
if (this == obj) {
return true;
}
if (obj == null) {
return false;
}
if (getClass() != obj.getClass()) {
return false;
}
ShiroUser other = (ShiroUser) obj;
if (loginName == null) {
if (other.loginName != null) {
return false;
}
} else if (!loginName.equals(other.loginName)) {
return false;
}
return true;
}
} 经过一顿折腾终于完事了，测试了一天问题没有再复现【当然还需要再测试几天】。
重要事情说三遍ShiroConfiguration2 中getLifecycleBeanPostProcessor 方法一定要设置为静态方法
引用领导的一句话做下总结：
没有解决不了的问题，在你尝试走完所有道路之前，问题肯定是能处理的。
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
