Spring Shiro Learning (ii)

The Shiro default comes with the following filters:

Filter Name	Class
Anon	Org.apache.shiro.web.filter.authc.AnonymousFilter
Authc	Org.apache.shiro.web.filter.authc.FormAuthenticationFilter
Authcbasic	Org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
Logout	Org.apache.shiro.web.filter.authc.LogoutFilter
Nosessioncreation	Org.apache.shiro.web.filter.session.NoSessionCreationFilter
Perms	Org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
Port	Org.apache.shiro.web.filter.authz.PortFilter
Rest	Org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
Roles	Org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
Qs.	Org.apache.shiro.web.filter.authz.SslFilter
User	Org.apache.shiro.web.filter.authc.UserFilter

We usually use anon: anyone can access; AUTHC: must be logged in to access, do not include rememberme; User : Login users can access, including RememberMe ;p erms: Specify the filter rules, this is generally extended use, will not use the original, such as Springrain extension for the frameperms.

Filterchaindefinitions is to specify the filter rules, generally the use of public configuration files, such as JS CSS img These resource files are not intercepted, business-related URL configuration to the database, there is a filter query database for permission to judge.

<BeanID= "Shirofilter"class= "Org.apache.shiro.spring.web.ShiroFilterFactoryBean">        < Propertyname= "SecurityManager"ref= "SecurityManager"/>        < Propertyname= "Loginurl"value= "${zheng.upms.sso.server.url}"/>        < Propertyname= "Successurl"value= "${zheng.upms.successurl}"/>        < Propertyname= "Unauthorizedurl"value= "${zheng.upms.unauthorizedurl}"/>        < Propertyname= "Filters">            <Util:map>                <entryKey= "AUTHC"Value-ref= "Upmsauthenticationfilter"/>            </Util:map>        </ Property>        < Propertyname= "Filterchaindefinitions">            <value>/manage/** = Upmssessionforcelogout,authc/manage/index = user/druid/** = user/swagger-ui.html = user/resources/** = Anon/** = Anon 
    </value>        </ Property>    </Bean>

Filterchaindefinitions is defining the interception rules

The priority of the Interceptor is: from top to bottom, from left to right, if a matching interceptor is blocked and returned, such as Access/manage/index the second interceptor user matches, returns true, no longer matches down.

The last sentence is/**=anon means that except for those above, everything else has to go through anon. Anyone can access

Spring Shiro Learning (ii)