During the study of shiro, I felt that the object session and cache were a little confused, so I straightened it out (of course it shouldn't be confused, but I just forgot to sort out the ideas).
The confusion lies in:
1. Traditionally, the session is obtained through jsessionid, and then the user in the session and the role and permission information stored in the session are obtained.
The disadvantage is that each time you log in, you need to query the role and permission information, and then save it to the session, so the performance is low (the original architecture was too simple, and it was not considered that it should be placed in the cache).
2. Shiro obtains the subject (equivalent to the current user) through the sessionid, and then puts the user's role and permissions in the cache. After all, the session has a short duration, and the cache can be retained for a long time, which improves performance.