shiro中unauthorizedUrl不起作用

解決方法：

在shiro配置文件中添加（異常全路徑做key，錯誤頁面做value）

<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="exceptionMappings">
            <props>
                <prop key="org.apache.shiro.authz.UnauthorizedException">/403</prop>
            </props>
        </property>
    </bean>

原因：這是因為shiro源代碼中判斷了filter是否為AuthorizationFilter，只有perms，roles，ssl，rest，port才是屬於AuthorizationFilter，而anon，authcBasic，auchc，user是AuthenticationFilter，所以unauthorizedUrl設置后不起作用。

shiro源代碼

    private void applyUnauthorizedUrlIfNecessary(Filter filter) {
        String unauthorizedUrl = getUnauthorizedUrl();
        if (StringUtils.hasText(unauthorizedUrl) && (filter instanceof AuthorizationFilter)) {
            AuthorizationFilter authzFilter = (AuthorizationFilter) filter;
            //only apply the unauthorizedUrl if they haven't explicitly configured one already:
            String existingUnauthorizedUrl = authzFilter.getUnauthorizedUrl();
            if (existingUnauthorizedUrl == null) {
                authzFilter.setUnauthorizedUrl(unauthorizedUrl);
            }
        }
    }

 

shiro默認過濾器(10個) 

• anon -- org.apache.shiro.web.filter.authc.AnonymousFilter
• authc -- org.apache.shiro.web.filter.authc.FormAuthenticationFilter
• authcBasic -- org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
• perms -- org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
• port -- org.apache.shiro.web.filter.authz.PortFilter
• rest -- org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
• roles -- org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
• ssl -- org.apache.shiro.web.filter.authz.SslFilter
• user -- org.apache.shiro.web.filter.authc.UserFilter
• logout -- org.apache.shiro.web.filter.authc.LogoutFilter