1、首先说问题吧,springboot整合swagger+shiro在访问 http://localhost:8080/swagger-ui.html 时被拦截了,但是配置的拦截链是放行的,好像没有起作用,拦截器配置代码如下
@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") SecurityManager securityManager,
@Qualifier("jwtFilter") JWTFilter jwtFilter) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
//
Map<String, Filter> filters = new LinkedHashMap<>();
filters.put("jwtFilter", jwtFilter);
shiroFilterFactoryBean.setFilters(filters);
//拦截链
Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
//Swagger2的所有请求都不需要拦截
filterChainDefinitionMap.put("/swagger/**", "anon");
filterChainDefinitionMap.put("/v2/api-docs", "anon");
filterChainDefinitionMap.put("/swagger-ui.html", "anon");
filterChainDefinitionMap.put("/swagger-resources/**", "anon");
filterChainDefinitionMap.put("/webjars/**", "anon");
filterChainDefinitionMap.put("/favicon.ico", "anon");
filterChainDefinitionMap.put("/captcha.jpg", "anon");
filterChainDefinitionMap.put("/csrf", "anon");
filterChainDefinitionMap.put("/configuration/security", "anon");
filterChainDefinitionMap.put("/configuration/ui", "anon");
filterChainDefinitionMap.put("/**", "jwtFilter");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return shiroFilterFactoryBean;
}
从上面的配置中我们可以发现,我们对静态资源进行了优先配置,因为是LinkedHashMap.所以是有序的,但是在实际测试过程中,发现swagger的资源需要认证之后才能访问,
这个和我们的配置逻辑不符,.
那么最关键的问题来了
为什么 请求会进入到 jwtFilter 这个filter?
@Bean
public JWTFilter jwtFilter() {
return new JWTFilter();
}
因为我们将这个filter配置成bean ,让spring自动加载,这个filter 会被spring加入到filterchain 中.通过日志我们可以看到