慕课中Shiro安全框架入门代码

package com.imooc.controller; import com.imooc.entity.User; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.authz.annotation.RequiresPermissions; import org.apache.shiro.authz.annotation.RequiresRoles; import org.apache.shiro.subject.Subject; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.ResponseBody; /** * Created by zhengjunhang on 2018/5/2. */ @Controller public class UserController { // 1. 代码实现认证授权 @RequestMapping(value = "/subLogin", method = RequestMethod.POST, produces = "application/json;charset=utf-8") @ResponseBody public String subLogin(User user) { Subject subject = SecurityUtils.getSubject(); UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword()); try { token.setRememberMe(user.isRememberMe()); subject.login(token); if (subject.isAuthenticated()) { System.out.println("登录成功"); if (subject.hasRole("admin")) { System.out.println("有admin角色"); subject.checkPermissions("user:add","user:update"); System.out.println("有user:add和user:update权限"); } } } catch (Exception e) { return e.getMessage(); } return "认证授权成功"; } // 2. 注解实现认证授权（个人推荐） // 成功测试 // @RequiresRoles("admin")表示主体只有具备admin角色才能访问该方法 @RequiresRoles("admin") @RequestMapping(value = "/testRole", method = RequestMethod.GET) // @Responsebody注解表示该方法的返回的结果直接写入HTTP响应正文（ResponseBody）中 @ResponseBody public String testRole() { return "testRole Success"; } // @RequiresPermissions("user:add","user:update")表示主体只有具备"user:add"权限才能访问该方法 @RequiresPermissions("user:add") @RequestMapping(value = "/testPermission", method = RequestMethod.GET) @ResponseBody public String testPermission() { return "testPermission Success"; } // 失败测试 @RequiresRoles("admin1") @RequestMapping(value = "/testRole1", method = RequestMethod.GET) @ResponseBody public String testRole1() { return "testRole1 Success"; } @RequiresPermissions("user:add1") @RequestMapping(value = "/testPermission1", method = RequestMethod.GET) @ResponseBody public String testPermission1() { return "testPermission1 Success"; } // 3. shiro过滤器实现认证授权（spring.xml文件中设置） // 系统自带过滤器 // 成功测试 @RequestMapping(value = "/testRole2", method = RequestMethod.GET) @ResponseBody public String testRole2() { return "testRole2 Success"; } @RequestMapping(value = "/testPermission2", method = RequestMethod.GET) @ResponseBody public String testPermission2() { return "testPermission2 Success"; } // 失败测试 @RequestMapping(value = "/testRole3", method = RequestMethod.GET) @ResponseBody public String testRole3() { return "testRole3 Success"; } @RequestMapping(value = "/testPermission3", method = RequestMethod.GET) @ResponseBody public String testPermission3() { return "testPermission3 Success"; } // 自定义过滤器 @RequestMapping(value = "/testRole4", method = RequestMethod.GET) @ResponseBody public String testRole4() { return "testRole4 Success"; } }