Question

我将Shiro会话管理（基于Kim's and Leif's webinar）添加到Vaadin快速票证仪表板演示应用程序中。当我在应用程序中重新加载浏览器时，我会被抛回到没有会话的登录页面。如何/在哪里可以防止这种情况。

我有一个标准的shiro.ini设置

登录按钮处理程序：

        signin.addClickListener(new ClickListener() {
        @Override
        public void buttonClick(ClickEvent event) {
            boolean loginOK = false;

            Factory<SecurityManager> factory = 
                    new IniSecurityManagerFactory("classpath:shiro.ini");
            SecurityManager securityManager = factory.getInstance();
            SecurityUtils.setSecurityManager((org.apache.shiro.mgt.SecurityManager) 
                                                            securityManager);

            Subject currentUser = SecurityUtils.getSubject();

            //collect user principals and credentials in a gui specific manner 
            //such as username/password html form, X509 certificate, OpenID, etc.
            //We'll use the username/password example here since it is the most common.
            UsernamePasswordToken token = 
                    new UsernamePasswordToken(username.getValue(), password.getValue());

            //this is all you have to do to support 'remember me' (no config - built in!):
            token.setRememberMe(true);

            //currentUser.login(token);
            try {
                logger.log(Level.INFO, "trying login");
                currentUser.login( token );
                logger.log(Level.INFO, "login done");

                    //if no exception, that's it, we're done!
            } catch ( Exception e ) {
                logger.log(Level.INFO, "exception");
            }

            if ( currentUser.hasRole( "schwartz" ) ) {
                loginOK = true;
            } else {
                loginOK = false;
            }

            if (loginOK) {
                signin.removeShortcutListener(enter);
                buildMainView();
            } else {
                if (loginPanel.getComponentCount() > 2) {
                    // Remove the previous error message
                    loginPanel.removeComponent(loginPanel.getComponent(2));
                }
                // Add new error message
                Label error = new Label(
                        "Wrong username or password. <span>Hint: try empty values</span>",
                        ContentMode.HTML);
                error.addStyleName("error");
                error.setSizeUndefined();
                error.addStyleName("light");
                // Add animation
                error.addStyleName("v-animate-reveal");
                loginPanel.addComponent(error);
                username.focus();
            }
        }
    });

Answer 1

在UI init类中使用@preserveonRefresh注释

Answer 2

我建议使用Shiro的网络过滤器。这样，您的会话不会丢失，并且您可以轻松地禁止未经授权的操作（例如，实例化视图对象），因为在您显示登录或任何其他视图时已经设置了Shiro的上下文。

Shiro / Vaadin在页面重新加载时失去了会话

2 个答案: