前后端分离的Web程序登录时出现SerializationException异常

ltolll 2019-04-21 02:13:32
后端spring-boot + shiro + redis
百度出来的代码，不知哪里不对：
配置类 ShiroConfig 代码：
 package com.wzr.shiro.config;



import com.wzr.shiro.ShiroRedisCacheManager;

import com.wzr.shiro.UserSessionManager;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;

import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.data.redis.core.RedisTemplate;



import java.util.LinkedHashMap;

import java.util.Map;



@Configuration

public class ShiroConfig {





	private static final Logger logger = LoggerFactory.getLogger(ShiroConfig.class);



	public static final String SERVICE_PREFIX = "/kd-pos";





	@Bean(name = "shiroRealm")

//	@DependsOn("lifecycleBeanPostProcessor")

	public UserRealm shiroRealm() {

		UserRealm realm = new UserRealm();

		UserCredentialsMatcher userCredentialsMatcher = new UserCredentialsMatcher();

		realm.setCredentialsMatcher(userCredentialsMatcher);

		return realm;

	}



	@Value("${spring.redis.timeout}")

	private int redisTimeout;



	@Value("${spring.redis.shiro.host}")

	private String redisHost;



	/**

	 * redisCacheManager 缓存 redis实现<p>

	 * @return

	 */

	@Bean

	public ShiroRedisCacheManager redisCacheManager(RedisTemplate redisTemplate) {

//		RedisCacheManager redisCacheManager = new RedisCacheManager();

//		redisCacheManager.setPrincipalIdFieldName("userID");

//		redisCacheManager.setRedisManager(redisManager());

		return new ShiroRedisCacheManager(redisTemplate);

	}



	/**

	 * RedisSessionDAO shiro sessionDao层的实现 通过redis

	 * <p>

	 * 使用的是shiro-redis开源插件

	 */

//	@Bean

//	public RedisSessionDAO redisSessionDAO() {

//		RedisSessionDAO redisSessionDAO = new RedisSessionDAO();

//		redisSessionDAO.setRedisManager(redisManager());

//		return redisSessionDAO;

//	}



	@Bean

	public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {

		AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor

			= new AuthorizationAttributeSourceAdvisor();

		authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);

		return authorizationAttributeSourceAdvisor;

	}



	@Bean("sessionManager")

	public DefaultWebSessionManager sessionManager(){

		UserSessionManager manager = new UserSessionManager();

		manager.setSessionDAO(new EnterpriseCacheSessionDAO());

		return manager;

	}





	@Bean(name = "securityManager")

	public SecurityManager securityManager(RedisTemplate<Object, Object> redisTemplate ){

		DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

		// 配置 缓存管理类 cacheManager，这个cacheManager必须要在前面执行，

		// 因为setRealm 和 setSessionManage都有方法使用了cacheManager

		securityManager.setCacheManager(redisCacheManager(redisTemplate));//用户授权/认证信息Cache

		securityManager.setRealm(shiroRealm());

		securityManager.setSessionManager(sessionManager());

		return securityManager;

	}



	@Bean//(name = "shiroFilter")

	public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {

		ShiroFilterFactoryBean shiroFilterFactoryBean = new MyShiroFilterFactoryBean();

		shiroFilterFactoryBean.setSecurityManager(securityManager);



		// 如果不设置值，默认会自动寻找Web工程根目录下的"/login.jsp"页面 或 "/login" 映射

		shiroFilterFactoryBean.setLoginUrl(SERVICE_PREFIX + "/login");



		// 设置拦截器

		Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

		// authc:所有url都必须认证通过才可以访问; anon:所有url都可以匿名访问

		//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了，登出后跳转配置的loginUrl

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/ajax-logout", "logout");

		// 配置不会被拦截的链接 顺序判断

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/static/**", "anon");

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/ajax-login", "anon");

		filterChainDefinitionMap.put(SERVICE_PREFIX + "/favicon.ico", "anon");//网站图标

		//拦截代码必须放在所有权限设置的最后，不然会导致所有 url 都被拦截

		filterChainDefinitionMap.put("/**", "authc");

		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);



		// 设置无权限时跳转的 url;

		shiroFilterFactoryBean.setUnauthorizedUrl("/notRole");

		return shiroFilterFactoryBean;

	}

}

...全文
347 3 打赏 收藏 转发到动态 举报
AI 作业
写回复
用AI写文章
3 条回复
切换为时间正序
请发表友善的回复…
发表回复
ltolll 2019-04-23
  • 打赏
  • 举报
 回复
引用 2 楼 小小菜鸟肥 的回复:
你这个不是报序列化异常吗？检查下自己的实体类有有实现Serializa类吧。
是的，原因就是User类没有实现 Serializable 接口
小小菜鸟肥 2019-04-22
  • 打赏
  • 举报
 回复
你这个不是报序列化异常吗？检查下自己的实体类有有实现Serializa类吧。
ltolll 2019-04-21
  • 打赏
  • 举报
 回复
每次点完登录按钮后消息进入后台服务器端， 执行： subject.login(token); 会报如下异常： 
org.springframework.data.redis.serializer.SerializationException: Cannot serialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to serialize object using DefaultSerializer; nested exception is java.io.NotSerializableException: com.wzr.bean.User
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.serialize(JdkSerializationRedisSerializer.java:96)
	at org.springframework.data.redis.core.AbstractOperations.rawValue(AbstractOperations.java:126)
	at org.springframework.data.redis.core.DefaultValueOperations.set(DefaultValueOperations.java:235)
	at com.wzr.shiro.ShiroRedisCache.put(ShiroRedisCache.java:48)
	at org.apache.shiro.session.mgt.eis.CachingSessionDAO.cache(CachingSessionDAO.java:247)
	at org.apache.shiro.session.mgt.eis.CachingSessionDAO.cache(CachingSessionDAO.java:235)
	at org.apache.shiro.session.mgt.eis.CachingSessionDAO.update(CachingSessionDAO.java:280)
	at org.apache.shiro.session.mgt.DefaultSessionManager.onChange(DefaultSessionManager.java:212)
	at org.apache.shiro.session.mgt.AbstractNativeSessionManager.setAttribute(AbstractNativeSessionManager.java:258)
	at org.apache.shiro.session.mgt.DelegatingSession.setAttribute(DelegatingSession.java:151)
	at org.apache.shiro.session.ProxiedSession.setAttribute(ProxiedSession.java:128)
	at org.apache.shiro.mgt.DefaultSubjectDAO.mergePrincipals(DefaultSubjectDAO.java:208)
	at org.apache.shiro.mgt.DefaultSubjectDAO.saveToSession(DefaultSubjectDAO.java:165)
	at org.apache.shiro.mgt.DefaultSubjectDAO.save(DefaultSubjectDAO.java:146)
	at org.apache.shiro.mgt.DefaultSecurityManager.save(DefaultSecurityManager.java:387)
	at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:354)
	at org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:187)
	at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:287)
	at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:260)
	at com.wzr.login.LoginController.ajaxLogin(LoginController.java:70)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189)
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800)
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038)
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942)
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005)
	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:908)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
	at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
	at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
	at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
	at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
	at com.wzr.shiro.config.MyShiroFilterFactoryBean$MSpringShiroFilter.doFilterInternal(MyShiroFilterFactoryBean.java:83)
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1417)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: org.springframework.core.serializer.support.SerializationFailedException: Failed to serialize object using DefaultSerializer; nested exception is java.io.NotSerializableException: com.wzr.bean.User
	at org.springframework.core.serializer.support.SerializingConverter.convert(SerializingConverter.java:68)
	at org.springframework.core.serializer.support.SerializingConverter.convert(SerializingConverter.java:35)
	at org.springframework.data.redis.serializer.JdkSerializationRedisSerializer.serialize(JdkSerializationRedisSerializer.java:94)
	... 88 more
Caused by: java.io.NotSerializableException: com.wzr.bean.User
	at java.base/java.io.ObjectOutputStream.writeObject0(ObjectOutputStream.java:1185)
	at java.base/java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:349)
	at java.base/java.util.HashSet.writeObject(HashSet.java:288)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at java.base/java.io.ObjectStreamClass.invokeWriteObject(ObjectStreamClass.java:1130
SpringSecurity-前后端分离
Spring Security是Spring家族中的一个安全管理框架。相比于另外一个安全框架Shiro，它提供了更丰富的功能，社区资源也比Shiro丰富。一般来说中大型的项目都是使用SpringSecurity来做...一般Web应用需要进行认证和授权。
SpringBoot前后端分离集成SpringSecurity登录功能详解
本文是作者自己实践得出的基于前后端分离SpringBoot项目, 配置SpringSecurity的教程, 阅读本文, 你可以了解SpringSecurity认证过程中各种隐藏的点 (正是这些隐含的点让我们理解困难), 并轻松将其配置到自己的前后端...
springsecurity+jwt实现前后端分离认证授权
Spring Security 中文文档Spring Security是一个Java框架，用于保护应用程序的安全性。它提供了一套全面的安全解决方案，包括身份验证、授权、防止攻击等功能。Spring Security基于过滤器链的概念，可以轻松地集成到...
SpringSecurity+Redis+JJwt前后端分离登录详解
本文是作者自己实践得出的基于前后端分离SpringBoot项目, 配置SpringSecurity的教程, 阅读本文, 你可以了解SpringSecurity认证过程中各种隐藏的点 (正是这些隐含的点让我们理解困难), 并轻松将其配置到自己的前后端...
前后端分离认证实践指南：Spring Security和JWT详解
Spring Security 是针对Spring项目的安全框架，也是Spring Boot底层安全模块默认的技术选型，他可 以实现强大的Web安全控制，对于安全控制，我们仅需要引入 spring-boot-starter-security 模块，进行少量的配置，...
Web 开发

81,122

社区成员

341,743

社区内容

发帖
与我相关
我的任务
社区描述
Java Web 开发
社区管理员
  • Web 开发社区
加入社区
  • 近7日
  • 近30日
  • 至今

加载中

查看更多榜单
社区公告
暂无公告

试试用AI创作助手写篇文章吧

+ 用AI写文章