SessionManager支持token认证

1.定义一个SessionManager类

建立一个类，继承AuthorizingRealm ，而后在doGetAuthenticationInfo中重写认证的方法

/**
 * 重写 SessionId 获取方式
 * @param request 请求
 * @param response 响应
 * @return id
 */
@Override
protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
    String id = WebUtils.toHttp( request ).getHeader( AUTHORIZATION );
    //若是请求头中有 Authorization 则其值为sessionId
    if (!StringUtils.isEmpty( id )) {
        request.setAttribute( REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE );
        request.setAttribute( ShiroHttpServletRequest.REFERENCED_SESSION_ID, id );
        request.setAttribute( ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE );
        return id;
    } else {
        //不然按默认规则从cookie取sessionId
        return super.getSessionId( request, response );
    }
}