shiro 会话超时302问题

  产生异常的状况：nginx配置了https，可是nginx转发请求到web应用走的http，会话超时，shiro会重定向到登陆页，这时重定向的是http地址，好比http://xxxxx/login/index ，浏览器会阻止这样的请求(从https页面发起http请求是非法的)。

1. 重写shiro的FormAuthenticationFilter

public class MyShiroAuthcFilter extends FormAuthenticationFilter {

	public MyShiroAuthcFilter(String loginUrl) {
		super();
		setLoginUrl(loginUrl);
	}

	@Override
	protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
		if (isLoginRequest(request, response)) {
			return super.onAccessDenied(request, response);
		} else {
			if (isAjax((HttpServletRequest) request)) { // 处理ajax请求
				HttpServletResponse httpServletResponse = WebUtils.toHttp(response);
				httpServletResponse.addHeader("REQUIRE_AUTH", "true"); // ajax全局设置中有用
				httpServletResponse.setStatus(HttpStatus.UNAUTHORIZED.value()); // 改变302状态码
			} else {
				saveRequest(request);
				request.getRequestDispatcher(getLoginUrl()).forward(request, response);
				// 因为是nginx转发的，redirect 302会重定向到http协议，不是浏览器指望的https
				// saveRequestAndRedirectToLogin(request, response);
			}
			return false;
		}
	}

	private boolean isAjax(HttpServletRequest request) {
		String requestedWithHeader = request.getHeader("X-Requested-With");
		return "XMLHttpRequest".equals(requestedWithHeader);
	}
}

shiro的filter配置

@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
	String loginUrl = "/login/index";
	ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();

	Map<String, Filter> filters = shiroFilter.getFilters();
	filters.put("anon", new AnonymousFilter());
	filters.put("authc", new MyShiroAuthcFilter(loginUrl));

	Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
	filterChainDefinitionMap.put("/supervisor/**", "authc");
	filterChainDefinitionMap.put("/**", "anon");

	shiroFilter.setSecurityManager(securityManager);
	shiroFilter.setLoginUrl(loginUrl);
	shiroFilter.setUnauthorizedUrl("/login/unauthorized");
	shiroFilter.setFilters(filters);
	shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap);

	return shiroFilter;
}

2. ajax全局设置

$.ajaxSetup({
    complete: function (xhr, status) {
    	if (xhr.getResponseHeader('REQUIRE_AUTH') == 'true') {
    		alert("未登陆或登陆超时!");
    		window.top.location.href = getHost() + '/login/index';
    		return;
    	}
	}
});

3. /login/index页面处理

<script type="text/javascript">
	// 使登陆页出如今“顶级”窗口，调整浏览器的url地址，上面的filter是forward到登陆页的
	if(window.top != window.self || location.pathname != '/login/index') {
	window.top.location = getHost() + '/login/index';
	}
</script>