public class ShiroHttpServletRequest extends HttpServletRequestWrapper {
}
public class HttpServletRequestWrapper extends ServletRequestWrapper implements HttpServletRequest {}
public class ServletRequestWrapper implements ServletRequest {
private ServletRequest request;
}
request
在使用实现过滤器进行包装的时候，过滤器的设置顺序决定了包装的层级关系,由于在前面的filter先执行，所以在前面的request是包在最里层的
如下配置ShiroHttpServletRequest包含RemoteSessionRequest（CrossDomainFilter把servelet包装成RemoteSessionRequest），ShiroHttpServletRequest再一次包装当前的RemoteSessionRequest：
所以在使用的时候不可以直接转化，需要获取后再转化((RemoteSessionRequest)((ShiroHttpServletRequest)request).getRequest()).getSession().setAttribute("q","2");
RemoteSessionRequest用动态代理的方式使得相应的操作在redis中操作（即改变本地内存的操作），解决进一步解决了分布式中request中一些内容的公用，
虽然shiro可以集成使用redis实现session共享（使得更多的内容以更多的方式实现共享）
CrossDomainFilter：同时也做了跨域的request修饰包装
web.xml:
<filter>
<filter-name>cors</filter-name>
<filter-class>com.common.CrossDomainFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>cors</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<display-name>Acegi Security Tutorial Application</display-name>
<!--loginFilter 用来过滤登录信息的，如果账号密码有误，不能登录 -->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter>
<filter-name>loginFilter</filter-name>
<filter-class>core.apps.rbac.login.LoginFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>loginFilter</filter-name>
<url-pattern>/j_acegi_security_check</url-pattern>
</filter-mapping>
java:
package com.common;
import core.session.filter.RemoteSessionRequest;
import java.io.IOException;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.Vector;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;
public final class CrossDomainFilter implements Filter {
private static final String VAL_ACCESS_CONTROL_ALLOW_ORIGIN = "*";
private static final String VAL_ACCESS_CONTROL_ALLOW_HEADERS = new StringBuilder(
"Origin,X-Requested-With,Content-Type,Accept").toString();
// .append("," + AuthenticationConstants.X_AUTH_TOKEN)
// .append("," + VersionDispatchFilter.HEADER_APP_VERSION)
private static final String VAL_ACCESS_CONTROL_ALLOW_METHODS = "GET,POST,PUT,DELETE,OPTIONS";
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletResponse httpResponse = (HttpServletResponse) response;
HttpServletRequest httpRequest = (HttpServletRequest) request;
httpResponse.addHeader("Access-Control-Allow-Origin", VAL_ACCESS_CONTROL_ALLOW_ORIGIN);
httpResponse.addHeader("Access-Control-Allow-Headers", VAL_ACCESS_CONTROL_ALLOW_HEADERS);
httpResponse.addHeader("Access-Control-Allow-Methods", VAL_ACCESS_CONTROL_ALLOW_METHODS);
httpResponse.addHeader("P3P", "CP=CAO PSA OUR");
if ("application/x-www-form-urlencoded".equals(httpRequest.getHeader("content-type"))) {
httpRequest = new CrossRequestWrapper(httpRequest);
}
try {
//if ("get".equals(httpRequest.getMethod().toLowerCase()) && StringUtils.isNotBlank(httpRequest.getParameter(AuthenticationConstants.X_AUTH_TOKEN))) {
//httpRequest.setAttribute(AuthenticationConstants.X_AUTH_TOKEN, httpRequest.getParameter(AuthenticationConstants.X_AUTH_TOKEN).trim());
//}
if ("get".equals(httpRequest.getMethod().toLowerCase()) ) {
// httpRequest.setAttribute(AuthenticationConstants.X_AUTH_TOKEN, httpRequest.getParameter(AuthenticationConstants.X_AUTH_TOKEN).trim());
}
} catch (Throwable e) {
}
chain.doFilter(new RemoteSessionRequest((HttpServletRequest) httpRequest), response);
}
@Override
public void destroy() {
}
private class CrossRequestWrapper extends HttpServletRequestWrapper {
private CrossRequestWrapper(HttpServletRequest httpRequest) {
super(httpRequest);
}
@Override
public String getHeader(String name) {
if ("content-type".equals(name.toLowerCase())) {
return "application/json";
}
return super.getHeader(name);
}
@Override
public Enumeration<String> getHeaders(String name) {
if ("content-type".equals(name.toLowerCase())) {
return new Vector<String>(Arrays.asList("application/json")).elements();
}
return super.getHeaders(name);
}
public Enumeration<String> getHeaderNames() {
return super.getHeaderNames();
}
@Override
public String getContentType() {
return "application/json";
}
}
/*private class AuthTokenHttpServletRequest extends HttpServletRequestWrapper {
private final String requestBody;
public AuthTokenHttpServletRequest(HttpServletRequest request, String requestBody) {
super(request);
this.requestBody = requestBody;
}
public ServletInputStream getInputStream() {
try {
return new ByteServletInputStream(new ByteArrayInputStream(requestBody.getBytes("UTF-8")));
} catch (Throwable e) {
log.error("", e);
}
return null;
}
}
private class ByteServletInputStream extends ServletInputStream {
private ByteArrayInputStream byteInputStream;
private ByteServletInputStream(ByteArrayInputStream byteInputStream) {
this.byteInputStream = byteInputStream;
}
@Override
public boolean isFinished() {
return byteInputStream.available() <= 0;
}
@Override
public boolean isReady() {
return true;
}
@Override
public void setReadListener(ReadListener readListener) {
// TODO Auto-generated method stub
}
@Override
public int read() throws IOException {
return byteInputStream.read();
}
}*/
}
RemoteSessionRequest：（提供动态代理拦截）代理了session
WebSessionManager 进行redis操作
package core.session.filter;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpSession;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import core.session.manager.RedisTemplateDelegate;
import core.session.manager.WebSession;
import core.session.manager.WebSessionManager;
import lombok.extern.log4j.Log4j2;
/**
*
* <p>通过继承HttpServletRequestWrapper 来实现</p>
* @author houzhanshan
* @version $Id: RemoteSessionRequest.java, v 0.1 2017年5月26日 下午11:40:51 houzhanshan Exp $
*/
public class RemoteSessionRequest extends HttpServletRequestWrapper {
public RemoteSessionRequest(HttpServletRequest request) {
super(request);
}
@Override
public HttpSession getSession() {
return RemoteSessionHandler.getInstance(super.getSession());
}
}
@Log4j2
class RemoteSessionHandler implements InvocationHandler {
// 模拟远程Session服务器，Key表示SessionId,Value表示该Session的内容
private static Map<String, Map<String, Object>> map = new ConcurrentHashMap<String, Map<String, Object>>();
private static Logger log= LoggerFactory.getLogger(RedisTemplateDelegate.class);
private HttpSession session = null;
private RemoteSessionHandler(HttpSession httpSession) {
this.session = httpSession;
};
public static HttpSession getInstance(HttpSession httpSession) {
InvocationHandler handler = new RemoteSessionHandler(httpSession);
return (HttpSession) Proxy.newProxyInstance(httpSession.getClass().getClassLoader(), httpSession.getClass().getInterfaces(), handler);
}
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
if ("setAttribute".equals(method.getName())) {
String id = session.getId();
Map<String, Object> m = map.get(id);
if (m == null) {
m = new HashMap<String, Object>();
}
WebSession webSession=WebSessionManager.getInstance().getSession(id);
if(webSession==null){
webSession=WebSessionManager.getInstance().createSession(id);
}else{
webSession=WebSessionManager.getInstance().getSession(id);
}
webSession.setAttribute((String) args[0], args[1]);
log.info("[存入]key:" + args[0] + ",value:" + args[1]);
return null;
} else if ("getAttribute".equals(method.getName())) {
String id = session.getId();
WebSession webSession= WebSessionManager.getInstance().getSession(id);
if(webSession==null){
return null;
}
Object result = webSession.getAttribute((String) args[0]);
log.info("[取出]key:" + args[0] + ",value:" + result);
return result;
}
return method.invoke(session, args);
}
}