问题情景:
在使用Apache Shiro进行权限管理和认证时,返回一堆信息,如下
解决方案:
不希望异常信息中的trace被返回给前端或者用户,希望展示友好的错误信息而非详细的堆栈跟踪
可以在JwtFilter的preHandle加如下处理
@Override
protected boolean preHandle(ServletRequest servletRequest, ServletResponse response) throws Exception {
HttpServletRequest httpRequest = WebUtils.toHttp(servletRequest);
HttpServletResponse httpResponse = WebUtils.toHttp(response);
if (httpRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
httpResponse.setHeader("Access-Control-Allow-Credentials", "true");
httpResponse.setHeader("Access-control-Allow-Origin", httpRequest.getHeader("Origin"));
httpResponse.setHeader("Access-Control-Allow-Methods", "GET,PUT,DELETE,UPDATE,OPTIONS");
httpResponse.setHeader("Access-Control-Allow-Headers", httpRequest.getHeader("Access-Control-Request-Headers"));
System.out.println(httpRequest.getHeader("Origin"));
System.out.println(httpRequest.getMethod());
System.out.println(httpRequest.getHeader("Access-Control-Request-Headers"));
httpResponse.setStatus(HttpStatus.OK.value());
return false;
}
HttpServletRequest request = (HttpServletRequest) servletRequest;
String token = request.getHeader("token");
if (token != null) {
try {
// Map<String, Claim> claimMap = JwtUtils.verifyToken(token);
// String authToken = claimMap.get("token").asString();
JwtToken jwtToken = new JwtToken(token);
Subject subject = SecurityUtils.getSubject();
subject.login(jwtToken);
return true;
} catch (Exception e) {
e.printStackTrace();
response.getWriter().print(JSON.toJSONString(new Result<>().setCode(402).setMsg("token失效,请重新登录")));
}
}
return false;
}
效果如下