Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API,您可以快速、轻松地获得任何应用程序,从最小的移动应用程序到最大的网络和企业应用程序。

创建一个简单的helloworld

创建maven工程，jar类型
添加shiro的jar包

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

</dependency>

</dependency>

</dependencies>

在src/main/resources下创建

Shiro学习笔记

log4j.properties直接拷贝其他工程

shiro.ini的配置如下

[users] //说明是用户信息

king=123 //是以键值对出现

wang=1234

创建HelloWorld.java

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.config.IniSecurityManagerFactory;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.subject.Subject;

import org.apache.shiro.util.Factory;

public class HelloWorld {

public static void main(String[] args) {

//读取配置文件，初始化SecurityManager工厂

Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");

//获取SecurityManager实例

SecurityManager securityManager = factory.getInstance();

//把SecurityManager实例绑定到SecurityUtils

SecurityUtils.setSecurityManager(securityManager);

//获取当前执行的用户

Subject currentUser = SecurityUtils.getSubject();

//创建token令牌，用户名/密码

UsernamePasswordToken token = new UsernamePasswordToken("wang", "1234");

try {

//身份验证

currentUser.login(token);

System.out.println("身份认证成功！");

}catch(AuthenticationException e) {

e.printStackTrace();

System.out.println("身份认证失败！");

}

//退出登录

currentUser.logout();

}

Subject认证主体

Subject认证主体包含两个信息

Principals:身份，可以是用户名，邮件，手机号码等等，用来标识一个登陆主体身份

Credentials:凭证，常见的有密码，数字证书等等。

Realm & JDBC Realm

Realm：意思是域，shiro从Realm中获取验证数据

Realm有很多种类，例如常见的jdbc realm, jndi realm, text realm(上面那个helloworld用的就是)

测试jdbc_realm使用C3P0连接数据库进行认证

创建maven工程，jar类型
在pom.xml文件中添加shiro，C3P0的jar包

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

</dependency>

</dependency>

</dependency>

<groupId>commons-logging</groupId>

<artifactId>commons-logging</artifactId>

</dependency>

<groupId>mysql</groupId>

<artifactId>mysql-connector-java</artifactId>

</dependency>

</dependencies>

在src/main/resources下创建

Shiro学习笔记

log4j.properties直接拷贝其他工程

jdbc_realm.ini配置如下

[main] //如果配置代码需要使用main

jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm //设置jdbcRealm

dataSource= com.mchange.v2.c3p0.ComboPooledDataSource //设置数据源

dataSource.driverClass=com.mysql.jdbc.Driver //driver

dataSource.jdbcUrl=jdbc:mysql://localhost:3306/mydata?characterEncoding=UTF-8&useSSL=true //url

dataSource.user=root //用户名

dataSource.password=123 //密码

jdbcRealm.dataSource=$dataSource //相当于jdbcRealm.setDataSource(dataSource)

securityManager.realms=$jdbcRealm //相当于securityManager.setRealms(jdbcRealm)

创建一个数据库mydata , 创建一个数据表，表名为固定名称users,

字段为userName,password,如果名称不同则jdbcRealm会找不到指定的表名和字段名进行比对

Shiro学习笔记

编写测试类

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.config.IniSecurityManagerFactory;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.subject.Subject;

import org.apache.shiro.util.Factory;

public class HelloWorld {

public static void main(String[] args) {

//读取配置文件，初始化SecurityManager工厂

Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:jdbc_realm.ini");

//获取SecurityManager实例

SecurityManager securityManager = factory.getInstance();

//把SecurityManager实例绑定到SecurityUtils

SecurityUtils.setSecurityManager(securityManager);

//获取当前执行的用户

Subject currentUser = SecurityUtils.getSubject();

//创建token令牌，用户名/密码

UsernamePasswordToken token = new UsernamePasswordToken("wang", "12345");

try {

//身份验证

currentUser.login(token);

System.out.println("身份认证成功！");

}catch(AuthenticationException e) {

e.printStackTrace();

System.out.println("身份认证失败！");

}

//退出登录

currentUser.logout();

}

权限认证核心要素

权限认证，也就是访问控制，即在应用中控制谁能访问哪些资源

在权限认证中，最核心的三个要素是：权限，角色，用户

权限：操作资源的权利，比如访问某个页面，以及对某个模块的数据的添加，修改，删除，查看的权利

角色：是权利的集合，一种角色可以包含多种权限

用户：在shiro中，代表访问系统的用户成为Subject

测试角色

在src/main/resources下创建shiro_role.ini配置文件

[users]

wang=12345,role3,role2

zhangsan=12345,role1

说明:用户名wang,密码：12345，拥有角色role3,role2

创建shiro工具类,用于判断身份是否合法

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.config.IniSecurityManagerFactory;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.subject.Subject;

import org.apache.shiro.util.Factory;

public class ShiroUtils {

public static Subject login(String configFile, String userName, String password) {

// 读取配置文件，初始化SecurityManager工厂

Factory<SecurityManager> factory = new IniSecurityManagerFactory(configFile);

// 获取SecurityManager实例

SecurityManager securityManager = factory.getInstance();

// 把SecurityManager实例绑定到SecurityUtils

SecurityUtils.setSecurityManager(securityManager);

// 获取当前执行的用户

Subject currentUser = SecurityUtils.getSubject();

// 创建token令牌，用户名/密码

UsernamePasswordToken token = new UsernamePasswordToken(userName, password);

try {

// 身份验证

currentUser.login(token);

System.out.println("身份认证成功！");

} catch (AuthenticationException e) {

e.printStackTrace();

System.out.println("身份认证失败！");

}

return currentUser;

}

在pom.xml文件中添加junit依赖

<groupId>junit</groupId>

<artifactId>junit</artifactId>

</dependency>

测试用户的角色

@Test

public void testRoles() {

Subject subject = ShiroUtils.login("classpath:shiro_role.ini", "wang", "12345");

//判断一个角色

boolean result = subject.hasRole("role1");

System.out.println(result ? "有role1角色" : "没有role1角色");

//判断集合角色(可以单个判断角色)

boolean[] results = subject.hasRoles(Arrays.asList("role1","role2","role3"));

System.out.println(results[0] ? "有role1角色" : "没有role1角色");

System.out.println(results[1] ? "有role2角色" : "没有role2角色");

System.out.println(results[2] ? "有role3角色" : "没有role3角色");

//判断集合角色(只能判断都具备的角色)

boolean resultAll = subject.hasAllRoles(Arrays.asList("role1","role2"));

System.out.println(resultAll ? "role1,role2角色都有" : "role1,role2角色不全具备");

}

@Test

public void testCheckRoles() {

Subject subject = ShiroUtils.login("classpath:shiro_role.ini", "wang", "12345");

//检查角色，没有返回值，会抛出异常UnauthorizedException

subject.checkRole("role1");

//检查角色，如果有一个不符合的角色就异常

subject.checkRoles("role1","role2","role3");

subject.checkRoles(Arrays.asList("role1","role2"));

}

测试用户的权限

在src/main/resources中创建shiro_permission.ini文件

[users]

wang=12345,role1 //用户wang，密码12345，权限role1

zhangsan=12345,role2

[roles]

role1=user:select //权限user:select查询权限

role2=user:add,user:update,user.delete

@Test

public void testPermitted() {

Subject subject = ShiroUtils.login("classpath:shiro_permission.ini", "wang", "12345");

//单个查询权限

System.out.println(subject.isPermitted("user:update") ? "有查询权限" : "没有查询权限");

//测试多个权限

boolean[] results = subject.isPermitted("user:update","user:select","user:add");

System.out.println(results[0] ? "有Update权限" : "没有update权限");

System.out.println(results[1] ? "有select权限" : "没有select权限");

System.out.println(results[2] ? "有add权限" : "没有add权限");

//整体查询权限(权限之间为与的关系，只要一个为false，整个表达式为false)

boolean result = subject.isPermittedAll("user:update","user:select","user:add");

System.out.println(result ? "权限全都有" : "权限不完整");

subject.logout();

}

@Test

public void testCheckPermitted() {

Subject subject = ShiroUtils.login("classpath:shiro_permission.ini", "wang", "12345");

//单个检查是否有权限，如果没有就会抛出UnauthorizedException异常

subject.checkPermission("user:update");

//整体检查权限(权限之间为与关系)

subject.checkPermissions("user:update","user:select","user:add");

}

Shiro+Web验证用户的身份，角色，权限

创建一个maven工程，带框架maven-archetype-webapp1.0

Shiro学习笔记

创建后的maven工程是这个样子

Shiro学习笔记

没有看到src/main/java目录

这时可以在工程上单击右键Build PathàConfigure Build Path

Shiro学习笔记

将默认的JRE1.8删除，并重新添加

Shiro学习笔记

然后再次添加JRE

Shiro学习笔记

应用保存即可在工程中出现src/main/java目录

修改pom.xml文件，添加jar包

<groupId>junit</groupId>

<artifactId>junit</artifactId>

</dependency>

<groupId>javax.servlet</groupId>

<artifactId>javax.servlet-api</artifactId>

<scope>provided</scope>

</dependency>

<groupId>javax.servlet.jsp</groupId>

<artifactId>javax.servlet.jsp-api</artifactId>

</dependency>

<groupId>javax.servlet.jsp.jstl</groupId>

</dependency>

</dependency>

<groupId>commons-logging</groupId>

<artifactId>commons-logging</artifactId>

</dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

</dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-web</artifactId>

</dependency>

</dependency>

这时我们发现Maven生成的文件夹格式需要调整

Shiro学习笔记

缺少META-INF文件夹，以及文件夹下的MANIFEST.MF文件

以及WEB-INF文件夹下的web.xml的内容也有问题

这时我们可以创建一个临时的动态Web工程，将WebContent下的META-INF文件夹，以及文件夹下的MANIFEST.MF文件拷贝到这个工程的webapp下即可，将临时动态工程的web.xml文件赋值一份到WEB-INF文件夹下替换即可。

标准的格式如下图

Shiro学习笔记

修改web.xml文件，添加Shiro过滤器和监听

<listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>

</listener>

<filter-name>ShiroFilter</filter-name>

<filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>ShiroFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

创建shiro.ini文件

[main]

authc.loginUrl=/login //authc认证登录的url是/login

[users]

wang=123456,admin //用户wang，密码123456，拥有admin角色

jack=123,teacher

[roles]

admin=user:* //admin角色拥有user:*的权限

teacher=student:*

[urls]

/login=anon //对于/login访问可以匿名进行

/admin=authc //对于/admin访问时必须认证过

在webapp下创建页面

<body>

userName:<input name="userName" type="text"><br>

password:<input name="password" type="password"><br>

</form>

</body>

success.jsp欢迎页面

创建LoginServlet.java

public class LoginServlet extends HttpServlet{

private static final long serialVersionUID = -7255349940789803107L;

@Override

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

System.out.println("login doGet");

request.getRequestDispatcher("login.jsp").forward(request, response);

}

@Override

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

System.out.println("login Post");

String userName = request.getParameter("userName");

String password = request.getParameter("password");

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token = new UsernamePasswordToken(userName, password);

try {

subject.login(token);

//重定向客户端跳转，1.地址栏变化，2.request不传递

response.sendRedirect("success.jsp"); //成功就重定向到success.jsp页面

}catch(Exception e) {

e.printStackTrace();

//请求转发：服务器端跳转，1.地址栏url不变，2.request值可以取得

request.getRequestDispatcher("login.jsp").forward(request, response);

}

创建AdminServlet.java

public class AdminServlet extends HttpServlet{

private static final long serialVersionUID = -4834638728907791133L;

@Override

protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

System.out.println("admin doget");

}

@Override

protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

System.out.println("admin dopost");

}

修改web.xml

<servlet-name>loginServlet</servlet-name>

<servlet-class>com.kingsoft.servlet.LoginServlet</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>loginServlet</servlet-name>

<url-pattern>/login</url-pattern>

</servlet-mapping>

<servlet-name>adminServlet</servlet-name>

<servlet-class>com.kingsoft.servlet.AdminServlet</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>adminServlet</servlet-name>

<url-pattern>/admin</url-pattern>

</servlet-mapping>

测试拦截效果

1. http://localhost:8080/shiro-web/admin

由于/admin=authc //对于/admin访问时必须认证过

所以被转发回了http://localhost:8080/shiro-web/login

2. http://localhost:8080/shiro-web/login

如果输入了用户名wang 密码12345后拥有了admin角色

wang=123456,admin

修改shiro.ini

[main]

authc.loginUrl=/login

roles.unauthorizedUrl=/none.jsp

perms.unauthorizedUrl=/none.jsp

[users]

wang=123456,admin

jack=123,teacher

zhangsan=123

[roles]

admin=user:*

teacher=student:*

[urls]

/login=anon

/admin=authc

/student=roles[teacher]

创建none.jsp用于展示权限不足的页面

当在地址栏中输入：http://localhost:8080/shiro-web/login

并填写用户名：zhangsan 密码 123

时登录成功，但是zhangsan并不具备任何角色

在登录成功页面修改http://localhost:8080/shiro-web/student时显示权限不足，说明配置成功，因为/student必须拥有teacher角色才可以登录

/student=roles[teacher]

这时可以使用jack--123进行登录，才能拥有teacher角色

URL的匹配方式

1. 字符 ? 可以匹配单个字符 /admin?=authc

可以匹配/admin3或/admin5或/adminx 但是不能匹配/admin23或admin

2. 字符 * 可以匹配多个字符 /admin*=authc

可以匹配/adminxyz,/admin234,/admin 但是不能匹配/adminxyxz/xyz

3. 字符**可以匹配多个路径 /admin/**=authc

可以匹配/admin/xyz/zyx这种多路径，但是不能匹配/admin234

4. 字符*/**可以任意匹配路径和多个字符 /admin*/**=authc

可以任意匹配/admin/zbc/xyz, /admin123/abc/def , /admin234 , /admin

Shiro标签

在success.jsp中使用Shiro标签用于展示用户的权限信息

<%@ page language="java" contentType="text/html; charset=UTF-8"

pageEncoding="UTF-8"%>

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags"%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<title>Insert title here</title>

</head>

<body>

<shiro:hasRole name="admin"> //admin角色登录显示

欢迎有Admin角色的用户登录

<shiro:principal /> //显示登录人的信息

</shiro:hasRole>

<shiro:hasRole name="teacher"> //teacher角色登录显示

欢迎有teacher角色的用户登录

<shiro:principal />

</shiro:hasRole>

<shiro:hasPermission name="student:*"> //拥有student:*的权限人登录信息

欢迎有student:*权限的用户登录<shiro:principal />

</shiro:hasPermission>

</body>

</html>

Shiro会话机制

一般管理会话，shiro也是调用serlvet容器中来进行，大概了解

修改LoginServlet.java

@Override

protected void doPost(HttpServletRequest request, HttpServletResponse response)

throws ServletException, IOException {

System.out.println("login Post");

String userName = request.getParameter("userName");

String password = request.getParameter("password");

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token = new UsernamePasswordToken(userName, password);

try {

subject.login(token);

Session session = subject.getSession();

System.out.println("sessionId:"+session.getId());

System.out.println("host:"+session.getHost());

System.out.println("timeout:"+session.getTimeout());

System.out.println("lastAccessTime:"+session.getLastAccessTime());

session.setAttribute("info", session.getId()); //session传递

response.sendRedirect("success.jsp");

}catch(Exception e) {

e.printStackTrace();

request.getRequestDispatcher("login.jsp").forward(request, response);

}

修改success.jsp

显示传递过来的session值

${info}<br>

自定义的Realm（之前的内容都是把用户的密码，角色，权限写在shiro.ini配置文件中），这次需要把相关的用户，角色，权限放在数据库中

修改之前的工程

在pom.xml中需要添加mysql的连接驱动

<groupId>mysql</groupId>

<artifactId>mysql-connector-java</artifactId>

</dependency>

创建用户表t_user

Shiro学习笔记

创建角色表t_role

Shiro学习笔记

创建权限表t_permission

Shiro学习笔记

创建实体类User.java

public class User {

private Integer id;

private String userName;

private String password;

public Integer getId() {

return id;

}

public void setId(Integer id) {

this.id = id;

}

public String getUserName() {

return userName;

}

public void setUserName(String userName) {

this.userName = userName;

}

public String getPassword() {

return password;

}

public void setPassword(String password) {

this.password = password;

}

创建连接数据库的工具类

import java.sql.Connection;

import java.sql.DriverManager;

public class DBUtils {

public Connection getCon() throws Exception{

Class.forName("com.mysql.jdbc.Driver");

Connection con=DriverManager.getConnection("jdbc:mysql://localhost:3306/mydata", "root", "123");

return con;

}

public void closeCon(Connection con)throws Exception{

if(con!=null){

con.close();

}

public static void main(String[] args) {

DBUtils dbUtil=new DBUtils();

try {

dbUtil.getCon();

System.out.println("数据库连接成功");

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

System.out.println("数据库连接失败");

}

创建UserDao.java

public class UserDao {

public User getByUserName(Connection connection, String userName)throws Exception{

User userResult = null;

String sql = "select * from t_user where userName = ?";

PreparedStatement pStatement = connection.prepareStatement(sql);

pStatement.setString(1, userName);

ResultSet rs = pStatement.executeQuery();

if(rs.next()) {

userResult = new User();

userResult.setId(rs.getInt("id"));

userResult.setUserName(rs.getString("userName"));

userResult.setPassword(rs.getString("password"));

}

return userResult;

}

/**

* <b>Description</b><br>

* (获取用户角色)

* <br>

* -------------------------------------------------<br>

* <b>A我去 2019年10月21日下午10:41:48</b>

public Set<String> getRoles(Connection connection, String userName)throws Exception{

Set<String> roles = new HashSet<String>();

String sql = "SELECT r.roleName FROM t_role r JOIN t_user u ON r.id = u.roleId AND u.userName = ?";

PreparedStatement pStatement = connection.prepareStatement(sql);

pStatement.setString(1, userName);

ResultSet resultSet = pStatement.executeQuery();

while(resultSet.next()) {

roles.add(resultSet.getString("roleName"));

}

return roles;

}

/**

* <b>Description</b><br>

* (获取用户的权限)

* <br>

* -------------------------------------------------<br>

* <b>A我去 2019年10月21日下午10:41:22</b>

public Set<String> getPermissions(Connection connection, String userName)

throws Exception{

Set<String> permissions = new HashSet<String>();

String sql = "SELECT p.perName FROM t_user u JOIN t_permission p ON p.roleId= u.roleId JOIN t_role r ON u.roleId=r.id WHERE u.userName = ?";

PreparedStatement pStatement = connection.prepareStatement(sql);

pStatement.setString(1, userName);

ResultSet resultSet = pStatement.executeQuery();

while(resultSet.next()) {

permissions.add(resultSet.getString("perName"));

}

return permissions;

}

创建自定义的MyRealm.java

import java.sql.Connection;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import com.kingsoft.dao.UserDao;

import com.kingsoft.entity.User;

import com.kingsoft.utils.DBUtils;

public class MyRealm extends AuthorizingRealm{

private UserDao userDao = new UserDao();

private DBUtils utils = new DBUtils();

/**

* 为登录成功的用户授权

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

String userName = (String)principals.getPrimaryPrincipal();

SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();

Connection connection = null;

try {

connection = utils.getCon();

authorizationInfo.setRoles(userDao.getRoles(connection,userName));

authorizationInfo.setStringPermissions(userDao.getPermissions(connection, userName));

}catch(Exception e) {

e.printStackTrace();

}finally {

try {

utils.closeCon(connection);

} catch (Exception e) {

e.printStackTrace();

}

return authorizationInfo;

}

/**

* 验证当前登录的用户

@Override

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

String userName = (String)token.getPrincipal();

Connection connection = null;

try {

connection = utils.getCon();

User user = userDao.getByUserName(connection, userName);

if(user!=null) {

AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(

user.getUserName(),user.getPassword(),"aa");

return authcInfo;

}else {

return null;

}

}catch(Exception e) {

e.printStackTrace();

}finally {

try {

utils.closeCon(connection);

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

return null;

}

创建LoginServlet.java

public class LoginServlet extends HttpServlet {

private static final long serialVersionUID = -7255349940789803107L;

@Override

protected void doGet(HttpServletRequest request, HttpServletResponse response)throws ServletException, IOException {

System.out.println("login doGet");

request.getRequestDispatcher("login.jsp").forward(request, response);

}

@Override

protected void doPost(HttpServletRequest request, HttpServletResponse response)throws ServletException, IOException {

System.out.println("login Post");

String userName = request.getParameter("userName");

String password = request.getParameter("password");

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token = new UsernamePasswordToken(userName, password);

try {

subject.login(token);

Session session = subject.getSession();

System.out.println("sessionId:" + session.getId());

System.out.println("host:" + session.getHost());

System.out.println("timeout:" + session.getTimeout());

System.out.println("lastAccessTime:" + session.getLastAccessTime());

session.setAttribute("info", session.getId());

response.sendRedirect("success.jsp");

} catch (Exception e) {

e.printStackTrace();

request.getRequestDispatcher("login.jsp").forward(request, response);

}

加密

在工具包utils下创建EncryptionUtils.java

package com.kingsoft.utils;

import org.apache.shiro.codec.Base64;

import org.apache.shiro.crypto.hash.Md5Hash;

public class EncryptionUtils {

/**

* <b>Description</b><br>

* (Base64加密)

* <br>

* -------------------------------------------------<br>

* <b>A我去 2019年10月22日下午9:24:26</b>

public static String encBase64(String str) {

return Base64.encodeToString(str.getBytes());

}

/**

* <b>Description</b><br>

* (Base64解密)

* <br>

* -------------------------------------------------<br>

* <b>A我去 2019年10月22日下午9:26:29</b>

public static String decBase64(String str) {

return Base64.decodeToString(str);

}

/**

* <b>Description</b><br>

* (MD5加密，salt加盐)

* <br>

* -------------------------------------------------<br>

* <b>A我去 2019年10月22日下午9:34:49</b>

public static String encMD5(String source, String salt) {

return new Md5Hash(source, salt).toString();

}

/**

* <b>Description</b><br>

* (MD5加密,salt加盐,num散列的次数)

* <br>

* -------------------------------------------------<br>

* <b>A我去 2019年10月22日下午9:37:35</b>

public static String encMD5(String source, String salt, int num) {

return new Md5Hash(source, salt, num).toString();

}

public static void main(String[] args) {

String str = "a";

String str1 = "YQ==";

System.out.println("Base64加密:"+EncryptionUtils.encBase64(str));

System.out.println("Base64解密:"+EncryptionUtils.decBase64(str1));

System.out.println("MD5加盐加密:"+EncryptionUtils.encMD5(str, "abc123"));

System.out.println("MD5加盐加密64次散列:"+EncryptionUtils.encMD5(str, "abc123", 64));

}

以后可以将加密的字符串插入用户表的密码中，当登录时就会比对用户表中的密码，还需修改登录Servlet

修改LoginServlet.java

String userName = request.getParameter("userName");

String password = request.getParameter("password");

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token = new UsernamePasswordToken

(userName, EncryptionUtils.encMD5(password, "abc123"));

一般都会把”abc123”称为盐，一般情况下这个盐放在配置文件中保存

Shiro+Spring整合

创建Maven工程

Shiro学习笔记

单击“Finish”完成创建Maven工程

创建出的Maven工程没有src/main/java目录

Shiro学习笔记

在工程上单击右键Build Path àConfigure Build Path…

Shiro学习笔记

将默认的JRE删除，并单击”Add Library”重新添加JRE运行库

Shiro学习笔记

选择JRE System Library

Shiro学习笔记

选择默认的工作空间JRE

应用并保存后，可以看到src/main/java目录出现了

Shiro学习笔记

接下来我们看默认生成的webapp目录格式也不对

Shiro学习笔记

这时我们可以创建一个临时的动态Web工程将对应的目录和web.xml文件拷贝一下

Shiro学习笔记

以上操作就可以创建出标准的Maven web工程

修改pom.xml文件，引入对应的jar包

<groupId>junit</groupId>

<artifactId>junit</artifactId>

</dependency>

<groupId>javax.servlet</groupId>

<artifactId>javax.servlet-api</artifactId>

</dependency>

<groupId>javax.servlet.jsp</groupId>

<artifactId>javax.servlet.jsp-api</artifactId>

</dependency>

<groupId>javax.servlet.jsp.jstl</groupId>

</dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>