前后端分离的Web程序登录时出现SerializationException异常

ltolll 2019-04-21 02:13:32
后端spring-boot + shiro + redis
百度出来的代码，不知哪里不对：
配置类 ShiroConfig 代码：
 package com.wzr.shiro.config;



import com.wzr.shiro.ShiroRedisCacheManager;

import com.wzr.shiro.UserSessionManager;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;

import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.data.redis.core.RedisTemplate;



import java.util.LinkedHashMap;

import java.util.Map;



@Configuration

public class ShiroConfig {





	private static final Logger logger = LoggerFactory.getLogger(ShiroConfig.class);



	public static final String SERVICE_PREFIX = "/kd-pos";





	@Bean(name = "shiroRealm")

//	@DependsOn("lifecycleBeanPostProcessor")

	public UserRealm shiroRealm() {

		UserRealm realm = new UserRealm();

		UserCredentialsMatcher userCredentialsMatcher = new UserCredentialsMatcher();

		realm.setCredentialsMatcher(userCredentialsMatcher);

		return realm;

	}



	@Value("${spring.redis.timeout}")

	private int redisTimeout;



	@Value("${spring.redis.shiro.host}")

	private String redisHost;



	/**

	 * redisCacheManager 缓存 redis实现<p>

	 * @return

	 */

	@Bean

	public ShiroRedisCacheManager redisCacheManager(RedisTemplate redisTemplate) {

//		RedisCacheManager redisCacheManager = new RedisCacheManager();

//		redisCacheManager.setPrincipalIdFieldName("userID");

//		redisCacheManager.setRedisManager(redisManager());

		return new ShiroRedisCacheManager(redisTemplate);

	}



	/**

	 * RedisSessionDAO shiro sessionDao层的实现 通过redis

	 * <p>

	 * 使用的是shiro-redis开源插件

	 */

//	@Bean

//	public RedisSessionDAO redisSessionDAO() {

//		RedisSessionDAO redisSessionDAO = new RedisSessionDAO();

//		redisSessionDAO.setRedisManager(redisManager());

//		return redisSessionDAO;

//	}



	@Bean

	public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {

		AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor

			= new AuthorizationAttributeSourceAdvisor();

		authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);

		return authorizationAttributeSourceAdvisor;

	}



	@Bean("sessionManager")

	public DefaultWebSessionManager sessionManager(){

		UserSessionManager manager = new UserSessionManager();

		manager.setSessionDAO(new EnterpriseCacheSessionDAO());

		return manager;

	}





	@Bean(name = "securityManager")

	public SecurityManager securityManager(RedisTemplate<Object, Object> redisTemplate ){

		DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

		// 配置 缓存管理类 cacheManager，这个cacheManager必须要在前面执行，

		// 因为setRealm 和 setSessionManage都有方法使用了cacheManager

		securityManager.setCacheManager(redisCacheManager(redisTemplate));//用户授权/认证信息Cache

		securityManager.setRealm(shiroRealm());

		securityManager.setSessionManager(sessionManager());

		return securityManager;

	}



	@Bean//(name = "shiroFilter")

	public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {

		ShiroFilterFactoryBean shiroFilterFactoryBean = new MyShiroFilterFactoryBean();

		shiroFilterFactoryBean.setSecurityManager(securityManager);



		// 如果不设置值，默认会自动寻找Web工程根目录下的"/login.jsp"页面 或 "/login" 映射

		shiroFilterFactoryBean.setLoginUrl(SERVICE_PREFIX + "/login");



		// 设置拦截器

		Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

		// authc:所有url都必须认证通过才可以访问; anon:所有url都可以匿名访问

		//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了，登出后跳转配置的loginUrl

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/ajax-logout", "logout");

		// 配置不会被拦截的链接 顺序判断

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/static/**", "anon");

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/ajax-login", "anon");

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/favicon.ico", "anon");//网站图标

		//拦截代码必须放在所有权限设置的最后，不然会导致所有 url 都被拦截

		filterChainDefinitionMap.put("/**", "authc");

		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);



		// 设置无权限时跳转的 url;

		shiroFilterFactoryBean.setUnauthorizedUrl("/notRole");

		return shiroFilterFactoryBean;

	}

}

...全文
346 3 打赏 收藏 转发到动态 举报
AI 作业
写回复
用AI写文章
3 条回复
切换为时间正序
请发表友善的回复…
发表回复
ltolll 2019-04-23
  • 打赏
  • 举报
 回复
引用 2 楼 小小菜鸟肥 的回复:
你这个不是报序列化异常吗？检查下自己的实体类有有实现Serializa类吧。
是的，原因就是User类没有实现 Serializable 接口
小小菜鸟肥 2019-04-22
  • 打赏
  • 举报
 回复
你这个不是报序列化异常吗？检查下自己的实体类有有实现Serializa类吧。
ltolll 2019-04-21
  • 打赏
  • 举报
 回复
每次点完登录按钮后消息进入后台服务器端， 执行： subject.login(token); 会报如下异常： 
org.springframework.data.redis.serializer.SerializationException: Cannot serialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to serialize object using DefaultSerializer; nested exception is java.io.NotSerializableException: com.wzr.bean.User
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.serialize(JdkSerializationRedisSerializer.java:96)
	at org.springframework.data.redis.core.AbstractOperations.rawValue(AbstractOperations.java:126)
	at org.springframework.data.redis.core.DefaultValueOperations.set(DefaultValueOperations.java:235)
	at com.wzr.shiro.ShiroRedisCache.put(ShiroRedisCache.java:48)
	at org.apache.shiro.session.mgt.eis.CachingSessionDAO.cache(CachingSessionDAO.java:247)
	at org.apache.shiro.session.mgt.eis.CachingSessionDAO.cache(CachingSessionDAO.java:235)
	at org.apache.shiro.session.mgt.eis.CachingSessionDAO.update(CachingSessionDAO.java:280)
	at org.apache.shiro.session.mgt.DefaultSessionManager.onChange(DefaultSessionManager.java:212)
	at org.apache.shiro.session.mgt.AbstractNativeSessionManager.setAttribute(AbstractNativeSessionManager.java:258)
	at org.apache.shiro.session.mgt.DelegatingSession.setAttribute(DelegatingSession.java:151)
	at org.apache.shiro.session.ProxiedSession.setAttribute(ProxiedSession.java:128)
	at org.apache.shiro.mgt.DefaultSubjectDAO.mergePrincipals(DefaultSubjectDAO.java:208)
	at org.apache.shiro.mgt.DefaultSubjectDAO.saveToSession(DefaultSubjectDAO.java:165)
	at org.apache.shiro.mgt.DefaultSubjectDAO.save(DefaultSubjectDAO.java:146)
	at org.apache.shiro.mgt.DefaultSecurityManager.save(DefaultSecurityManager.java:387)
	at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:354)
	at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:187)
	at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:287)
	at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:260)
	at com.wzr.login.LoginController.ajaxLogin(LoginController.java:70)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189)
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800)
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038)
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942)
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005)
	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:908)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
	at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
	at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
	at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
	at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
	at com.wzr.shiro.config.MyShiroFilterFactoryBean$MSpringShiroFilter.doFilterInternal(MyShiroFilterFactoryBean.java:83)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1417)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: org.springframework.core.serializer.support.SerializationFailedException: Failed to serialize object using DefaultSerializer; nested exception is java.io.NotSerializableException: com.wzr.bean.User
	at org.springframework.core.serializer.support.SerializingConverter.convert(SerializingConverter.java:68)
	at org.springframework.core.serializer.support.SerializingConverter.convert(SerializingConverter.java:35)
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.serialize(JdkSerializationRedisSerializer.java:94)
	... 88 more
Caused by: java.io.NotSerializableException: com.wzr.bean.User
	at java.base/java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1185)
	at java.base/java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:349)
	at java.base/java.util.HashSet.writeObject(HashSet.java:288)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at java.base/java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java:1130
SpringSecurity-前后端分离
Spring Security是Spring家族中的一个安全管理框架。相比于另外一个安全框架Shiro，它提供了更丰富的功能，社区资源也比Shiro丰富。一般来说中大型的项目都是使用SpringSecurity来做安全框架，小项目用Shiro的比较多。相比于SpringSecurity，Shiro的上手更加简单。一般Web应用需要进行认证和授权。
SpringBoot前后端分离集成SpringSecurity登录功能详解
SpringSecurity集成到SpringBoot, 从而代替自己实现安全框架是一个较好的选择, 但SpringSecurity官方文档稍显晦涩, 而大部分博客内容又难以统一, 各执一词, 讲解含糊不清, 难以快速理解SpringSecurity的运作原理, 并快速应用到自己项目中.
springsecurity+jwt实现前后端分离认证授权
Spring Security 中文文档Spring Security是一个Java框架，用于保护应用程序的安全性。它提供了一套全面的安全解决方案，包括身份验证、授权、防止攻击等功能。Spring Security基于过滤器链的概念，可以轻松地集成到任何基于Spring的应用程序中。它支持多种身份验证选项和授权策略，开发人员可以根据需要选择适合的方式。此外，Spring Security还提供了一些附加功能，如集成第三方身份验证提供商和单点登录，以及会话管理和密码编码等。
若依前后端分离框架修改3.8.9版本（重点在安全框架讲解与微信小程序登录集成）
若依框架的部署与修改，还有插件集成。包含mqtt，webSocket，微信小程序登录
SpringSecurity+Redis+JJwt前后端分离登录详解
在authenticationManager.authenticate()中:获取数据库中的用户详细信息检测该用户是否过期, 是否可用检测该用户的密码是否过期进行密码匹配进行用户类封装并确认认证登录返回结果。
Web 开发

81,122

社区成员

341,744

社区内容

发帖
与我相关
我的任务
社区描述
Java Web 开发
社区管理员
  • Web 开发社区
加入社区
  • 近7日
  • 近30日
  • 至今

加载中

查看更多榜单
社区公告
暂无公告

试试用AI创作助手写篇文章吧

+ 用AI写文章