User Filter for Shiro

Project to use the Shiro this permission framework, feel it, very convenient.

Look at the appearance of more than two days a day. Then run some examples, it is easier to see later a filter, configured as follows

[Main] #默认是/login.jspauthc.loginurl=/loginroles.unauthorizedurl=/unauthorizedperms.unauthorizedurl=/ Unauthorizedlogout.redirecturl=/login[users]zhang=123,adminwang=123[roles]admin=user:*,menu:*[urls] #anon Do not log in to access/logout2=logout/login=anon/logout=anon/unauthorized=anon/static/**=anon #需要登录才能访问 # requires login and has admin role to access/ role=authc,roles[admin]/permission=authc,perms["User:create"]/authenticated=user#userfilter first is to determine whether the login page is, if so, Is Allowd, if not, if previously logged in, and isrememberme=true. can be accessed, but AUTHC cannot #

There is a user filter in this is not very understand, but you understand, it feels easy.

User represents the Userfilter

if (isloginrequest (request, Response)) {            return true;        } else {            Subject Subject = getsubject (Request, Response);            IF principal is isn't null, then the user was known and should be allowed access.            Return Subject.getprincipal ()! = null;        }

This is the source code of the Isaccessallowed method. Basically, if the login page is accessed, the user is allowed access, if not, from the current user, to see if the user is RememberMe, rememberme and logged in within the validity period, will allow access to its path, but will not allow access to the AUTHC path. The user is between, anon and authc straight. In other words: While the "/authenticated= user" means that users who access the address are authenticated either through or RememberMe logged in. Or, a page needs to be logged in to see, but this page information is not very important, you can already use this

RememberMe principle, is to log the user name, in some kind of encryption, stored in the cookie, the name is called RememberMe, the next login will be found from the cookie, if there is, Pricipal will not be empty. Also note that the call to Subject.logout () will erase this cookie

User Filter for Shiro