如何让 Shiro 使用 Spring Boot 返回 403 Forbidden 而不是重定向到 login.jsp

Question

我有一个服务器，它只是一个 API 端点，没有客户端前端，没有 jsp，没有 html。 它使用 Spring Boot，我试图用 Shiro 来保护它。 我的 SpringBootServletInitializer 的相关部分如下所示。 如果在 BasicRealm 中定义的角色查找失败，我试图让 Shiro 返回 403 响应。 然而，它似乎默认重定向到不存在的 login.jsp，无论我似乎使用什么解决方案。 我无法覆盖它。 任何帮助将不胜感激。

@SpringBootApplication
public class RestApplication extends SpringBootServletInitializer {

    ...

    @Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean shiroFilter() {
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();


        Map<String, String> filterChain = new HashMap<>();
        filterChain.put("/admin/**", "roles[admin]");

        shiroFilter.setFilterChainDefinitionMap(filterChain);
        shiroFilter.setSecurityManager(securityManager());

        return shiroFilter;
    }

    @Bean
    public org.apache.shiro.mgt.SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(userRealm());

        CookieRememberMeManager rmm = new CookieRememberMeManager();
        rmm.setCipherKey(Base64.decode("XXXXXXXXXXXXXXXXXXXXXX"));
        securityManager.setRememberMeManager(rmm);

        return securityManager;
    }

    @Bean(name = "userRealm")
    @DependsOn("lifecycleBeanPostProcessor")
    public BasicRealm userRealm() {
        return new BasicRealm();
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }
}

public class BasicRealm extends AuthorizingRealm {
    private static Logger logger = UserService.logger;
    private static final String REALM_NAME = "BASIC";

    public BasicRealm() {
        super();
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken token)
            throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        String userid = upToken.getUsername();

        User user = Global.INST.getUserService().getUserById(userid);

        if (user == null) {
            throw new UnknownAccountException("No account found for user [" + userid + "]");
        }

        return new SimpleAuthenticationInfo(userid, user.getHashedPass().toCharArray(), REALM_NAME);
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(final PrincipalCollection principals) {

        String userid = (String) principals.getPrimaryPrincipal();

        if (userid == null) {
            return new SimpleAuthorizationInfo();
        }

        return new SimpleAuthorizationInfo(Global.INST.getUserService().getRoles(userid));
    }
}

Answer 1

好的，这就是我解决它的方法。 我创建了一个类...

public class AuthFilter extends RolesAuthorizationFilter {
    private static final String MESSAGE = "Access denied.";

    @Override
    protected boolean onAccessDenied(final ServletRequest request, final ServletResponse response) throws IOException {
        HttpServletResponse httpResponse ;
        try {
            httpResponse = WebUtils.toHttp(response);
        }
        catch (ClassCastException ex) {
            // Not a HTTP Servlet operation
            return super.onAccessDenied(request, response) ;
        }

        if (MESSAGE == null) {
            httpResponse.sendError(403);
        } else {
            httpResponse.sendError(403, MESSAGE);
        }
        return false;  // No further processing.
    }
}

...然后在上面的 shiroFilter() 方法中，我添加了此代码 ...

Map<String, Filter> filters = new HashMap<>();
filters.put("roles", new AuthFilter());
shiroFilter.setFilters(filters);

...希望这对其他人有帮助。

Answer 2

在 Shiro 1.4+ 中，您可以在 application.properties 中设置登录 URL：

https://github.com/apache/shiro/blob/master/samples/spring-boot-web/src/main/resources/application.properties#L20

早期版本你应该能够设置ShiroFilterFactoryBean.setLoginUrl("/login")

https://shiro.apache.org/static/current/apidocs/org/apache/shiro/spring/web/ShiroFilterFactoryBean.html