How do shiro and spring security handle 401 errors with custom exceptions

This article mainly introduces shiro and spring security how to use custom exceptions to handle 401 errors, the article is very detailed, has a certain reference value, interested friends must read it!

Shiro and spring security custom exception handling 401 background

Now is the era of front and back end separation, the back end must uniformly deal with the return results, such as defining a return object

Public class ResponseData {/ * Unified error Code * / public String rtnCode; / * Unified error message * / public String rtnMsg; / * result object * / public T rtnData

There is a corresponding rtnCode for all exceptions, without the default handling of the framework, such as returning

At this time, the front-end students are unhappy, they already have rtnCode, so why does the status of http need 401 instead of 200?

Solution

General business exceptions can be handled by creating a new unified handling class in the springboot project, such as

@ ControllerAdvicepublic class DefaultExceptionHandler {/ * Unified exception handling * / @ ExceptionHandler ({Exception.class}) @ ResponseStatus (HttpStatus.OK) @ ResponseBody public ResponseData allException (Exception e) {

In most cases, the json object data can be caught and returned as scheduled, but some exceptions thrown by the permission framework, such as 401, will not be intercepted, so you need to build another class to handle this situation, as shown in the following code

Package com;import com.vo.ResponseData;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.boot.autoconfigure.web.ErrorAttributes;import org.springframework.boot.autoconfigure.web.ErrorController;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RestController;import org.springframework.web.context.request.RequestAttributes;import org.springframework.web.context.request.ServletRequestAttributes;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import java.util.Map / * * spring security exception handling * / @ RestControllerpublic class CustomErrorController implements ErrorController {private static final String PATH = "/ error"; @ Autowired private ErrorAttributes errorAttributes; @ RequestMapping (value = PATH) ResponseData error (HttpServletRequest request, HttpServletResponse response) {/ / Appropriate HTTP response code (e.g. 404 or 500) is automatically set by Spring. / / Here we just define response body. Map errorMap = getErrorAttributes (request); ResponseData d = new ResponseData (response.getStatus () + ", errorMap.get (" message "). ToString ()); response.setStatus (HttpServletResponse.SC_OK); return d;} @ Override public String getErrorPath () {return PATH;} private Map getErrorAttributes (HttpServletRequest request) {RequestAttributes requestAttributes = new ServletRequestAttributes (request); return errorAttributes.getErrorAttributes (requestAttributes, false) }} SpringBoot Integration Shiro Custom filter error No SecurityManager accessible to the calling code...

Recently, in the integration of shiro with springboot, No SecurityManager accessible to the calling code appeared during the visit.

Error report:

Cause

The custom SysUserFilter loading order comes before ShiroFilter, resulting in the emergence of No SecurityManager accessible to the calling code.

Solution.

Loading of shiroFilter () precedes custom SysUserFilter

The above is all the content of the article "how shiro and spring security handle 401 errors with custom exceptions". Thank you for reading! Hope to share the content to help you, more related knowledge, welcome to follow the industry information channel!