import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
/**
 * @see DefaultWebSessionManager
 */
@Bean(name = "sessionManager")
public DefaultWebSessionManager defaultWebSessionManager() {
    DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
    //sessionManager.setSessionDAO(new CustomSessionDAO());
    sessionManager.setCacheManager(ehCacheManager());
    //单位为毫秒（1秒=1000毫秒） 3600000毫秒为1个小时
    sessionManager.setSessionValidationInterval(3600000 * 12);
    //3600000 milliseconds = 1 hour
    sessionManager.setGlobalSessionTimeout(3600000 * 12);
    sessionManager.setDeleteInvalidSessions(true);
    sessionManager.setSessionValidationSchedulerEnabled(true);
    Cookie cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
    cookie.setName("WEBID");
    cookie.setHttpOnly(true);
    sessionManager.setSessionIdCookie(cookie);
    return sessionManager;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Override
protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
	// 如果参数中包含“__sid”参数，则使用此sid会话。 例如：http://localhost/project?__sid=xxx&__cookie=true
	String sid = request.getParameter("__sid");
	if (StringUtils.isNotBlank(sid)) {
		// 是否将sid保存到cookie，浏览器模式下使用此参数。
		if (WebUtils.isTrue(request, "__cookie")) {
			HttpServletRequest rq = (HttpServletRequest) request;
			HttpServletResponse rs = (HttpServletResponse) response;
			Cookie template = getSessionIdCookie();
			Cookie cookie = new SimpleCookie(template);
			cookie.setValue(sid);
			cookie.saveTo(rq, rs);
		}
		// 设置当前session状态
		request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, ShiroHttpServletRequest.URL_SESSION_ID_SOURCE); // session来源与url
		request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sid);
		request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
		return sid;
	} else {
		return super.getSessionId(request, response);
	}
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Override
protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
    // 如果参数中包含“__sid”参数，则使用此sid会话。
    // 例如：http://localhost/project?__sid=xxx&__cookie=true
    String sid = request.getParameter("__sid");
    if (StringUtils.isNotBlank(sid)) {
        // 是否将sid保存到cookie，浏览器模式下使用此参数。
        if (WebUtils.isTrue(request, "__cookie")) {
            HttpServletRequest rq = (HttpServletRequest) request;
            HttpServletResponse rs = (HttpServletResponse) response;
            Cookie template = getSessionIdCookie();
            Cookie cookie = new SimpleCookie(template);
            cookie.setValue(sid);
            cookie.saveTo(rq, rs);
        }
        // 设置当前session状态
        request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,
                ShiroHttpServletRequest.URL_SESSION_ID_SOURCE); // session来源与url
        request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sid);
        request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
        return sid;
    } else {
        return super.getSessionId(request, response);
    }
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Bean
@ConditionalOnMissingBean(RememberMeManager.class)
public RememberMeManager rememberMeManager(Cookie cookie) {
    CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
    cookieRememberMeManager.setCookie(cookie);
    cookieRememberMeManager.setCipherService(cipherService);
    if (shiroCookieProperties.getCipherKey() != null) {
        cookieRememberMeManager.setCipherKey(shiroCookieProperties.getCipherKey().getBytes());
    } else {
        if (shiroCookieProperties.getEncryptionCipherKey() != null) {
            cookieRememberMeManager.setEncryptionCipherKey(shiroCookieProperties.getEncryptionCipherKey().getBytes());
        }
        if (shiroCookieProperties.getDecryptionCipherKey() != null) {
            cookieRememberMeManager.setDecryptionCipherKey(shiroCookieProperties.getDecryptionCipherKey().getBytes());
        }
    }
    cookieRememberMeManager.setSerializer(serializer);
    return cookieRememberMeManager;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Bean
@ConditionalOnMissingBean(RememberMeManager.class)
public RememberMeManager rememberMeManager(Cookie cookie) {
    CookieRememberMeManager manager = new CookieRememberMeManager();
    manager.setCookie(cookie);
    manager.setCipherService(cipherService);
    if (null != shiroCookieProperties.getCipherKey()) {
        manager.setCipherKey(shiroCookieProperties.getCipherKey().getBytes());
    } else {
        if (null != shiroCookieProperties.getEncryptionCipherKey()) {
            manager.setEncryptionCipherKey(shiroCookieProperties.getEncryptionCipherKey().getBytes());
        }
        if (null != shiroCookieProperties.getDecryptionCipherKey()) {
            manager.setDecryptionCipherKey(shiroCookieProperties.getDecryptionCipherKey().getBytes());
        }
    }
    manager.setSerializer(serializer);

    return manager;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
/**
 * Base64-encodes the specified serialized byte array and sets that base64-encoded String as the cookie value.
 * <p/>
 * The {@code subject} instance is expected to be a {@link WebSubject} instance with an HTTP Request/Response pair
 * so an HTTP cookie can be set on the outgoing response.  If it is not a {@code WebSubject} or that
 * {@code WebSubject} does not have an HTTP Request/Response pair, this implementation does nothing.
 *
 * @param subject    the Subject for which the identity is being serialized.
 * @param serialized the serialized bytes to be persisted.
 */
protected void rememberSerializedIdentity(Subject subject, byte[] serialized) {

    if (!WebUtils.isHttp(subject)) {
        if (log.isDebugEnabled()) {
            String msg = "Subject argument is not an HTTP-aware instance.  This is required to obtain a servlet " +
                    "request and response in order to set the rememberMe cookie. Returning immediately and " +
                    "ignoring rememberMe operation.";
            log.debug(msg);
        }
        return;
    }


    HttpServletRequest request = WebUtils.getHttpRequest(subject);
    HttpServletResponse response = WebUtils.getHttpResponse(subject);

    //base 64 encode it and store as a cookie:
    String base64 = Base64.encodeToString(serialized);

    Cookie template = getCookie(); //the class attribute is really a template for the outgoing cookies
    Cookie cookie = new SimpleCookie(template);
    cookie.setValue(base64);
    cookie.saveTo(request, response);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Override
protected void rememberSerializedIdentity(Subject subject, byte[] serialized) {
    if (!WebUtils.isHttp(subject)) {
        if (LOGGER.isDebugEnabled()) {
            String msg = "Subject argument is not an HTTP-aware instance.  This is required to obtain a servlet " +
                    "request and response in order to set the rememberMe cookie. Returning immediately and " +
                    "ignoring rememberMe operation.";
            LOGGER.debug(msg);
        }
        
        return;
    }


    HttpServletRequest request = WebUtils.getHttpRequest(subject);
    HttpServletResponse response = WebUtils.getHttpResponse(subject);

    // base 64 encode it and store as a cookie:
    String base64 = Base64.encodeToString(serialized);

    // the class attribute is really a template for the outgoing cookies
    Cookie cookie = getCookie(); 
    cookie.setValue(base64);
    cookie.saveTo(request, response);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Override
protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
	// 如果参数中包含“__sid”参数，则使用此sid会话。 例如：http://localhost/project?__sid=xxx&__cookie=true
	String sid = request.getParameter("__sid");
	if (StringUtils.isNotBlank(sid)) {
		// 是否将sid保存到cookie，浏览器模式下使用此参数。
		if (WebUtils.isTrue(request, "__cookie")){
	        HttpServletRequest rq = (HttpServletRequest)request;
	        HttpServletResponse rs = (HttpServletResponse)response;
			Cookie template = getSessionIdCookie();
	        Cookie cookie = new SimpleCookie(template);
			cookie.setValue(sid); cookie.saveTo(rq, rs);
		}
		// 设置当前session状态
           request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,
                   ShiroHttpServletRequest.URL_SESSION_ID_SOURCE); // session来源与url
           request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sid);
           request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
       	return sid;
	}else{
		return super.getSessionId(request, response);
	}
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Bean
@ConditionalOnMissingBean(Cookie.class)
public Cookie rememberMeCookie() {
    SimpleCookie cookie = new SimpleCookie();

    cookie.setName(authFilterProperties.getRememberMeParamName());
    cookie.setMaxAge(shiroCookieProperties.getMaxAge());
    cookie.setValue(shiroCookieProperties.getValue());
    cookie.setVersion(shiroCookieProperties.getVersion());
    cookie.setHttpOnly(shiroCookieProperties.isHttpOnly());
    cookie.setSecure(shiroCookieProperties.isSecure());

    return cookie;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Bean
public Cookie rememberMeCookie() {
	SimpleCookie cookie = new SimpleCookie("rememberMe");
	cookie.setHttpOnly(true);
	cookie.setMaxAge(31536000);
	return cookie;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
public DefaultWebSessionManager() {
    Cookie cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
    cookie.setHttpOnly(true); //more secure, protects against XSS attacks
    this.sessionIdCookie = cookie;
    this.sessionIdCookieEnabled = true;
    this.sessionIdUrlRewritingEnabled = true;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
private void storeSessionId(Serializable currentId, HttpServletRequest request, HttpServletResponse response) {
    if (currentId == null) {
        String msg = "sessionId cannot be null when persisting for subsequent requests.";
        throw new IllegalArgumentException(msg);
    }
    Cookie template = getSessionIdCookie();
    Cookie cookie = new SimpleCookie(template);
    String idString = currentId.toString();
    cookie.setValue(idString);
    cookie.saveTo(request, response);
    log.trace("Set session ID cookie for session with id {}", idString);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
/**
 * Constructs a new {@code CookieRememberMeManager} with a default {@code rememberMe} cookie template.
 */
public CookieRememberMeManager() {
    Cookie cookie = new SimpleCookie(DEFAULT_REMEMBER_ME_COOKIE_NAME);
    cookie.setHttpOnly(true);
    //One year should be long enough - most sites won't object to requiring a user to log in if they haven't visited
    //in a year:
    cookie.setMaxAge(Cookie.ONE_YEAR);
    this.cookie = cookie;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
public SimpleWebSessionManager() {
	Cookie cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
	cookie.setHttpOnly(true);
	this.sessionIdCookie = cookie;
	this.sessionIdCookieEnabled = true;
	setSessionValidationSchedulerEnabled(false);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
/**
 * 创建session
 */
// @Override
// protected Session doCreateSession(SessionContext context) {
// Session session = newSessionInstance(context);
// if (log.isTraceEnabled()) {
// log.trace("Creating session for host {}", session.getHost());
// }
// // 去掉重复生成sessionId
//// if (session.getId() == null && session instanceof SimpleSession) {
//// HttpServletRequest httpRequest = WebUtils.getHttpRequest(context);
//// String currUrl =
// WebUtils.getPathWithinApplication(WebUtils.toHttp(httpRequest));
//// boolean isLoginSubmission = WebUtils.toHttp(httpRequest).getMethod()
//// .equalsIgnoreCase(AccessControlFilter.POST_METHOD);
//// if (postLoginUrl != null && postLoginUrl.equals(currUrl) &&
// isLoginSubmission) {
//// // ignore
//// } else {
//// WebSessionKey webSessionKey = new WebSessionKey(httpRequest,
// WebUtils.getHttpResponse(context));
//// Serializable id = super.getSessionId(webSessionKey);
//// if (id == null && WebUtils.isWeb(webSessionKey)) {
//// ServletRequest request = WebUtils.getRequest(webSessionKey);
//// ServletResponse response = WebUtils.getResponse(webSessionKey);
//// id = getReferencedSessionId(request, response);
//// if (id != null) {
//// ((SimpleSession) session).setId(id);
//// }
//// }
//// }
//// }
// create(session);
// return session;
// }

public Cookie getSessionIdCookie() {
	return sessionIdCookie;
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
private void storeSessionId(Serializable currentId, HttpServletRequest request, HttpServletResponse response) {
	if (currentId == null) {
		String msg = "sessionId cannot be null when persisting for subsequent requests.";
		throw new IllegalArgumentException(msg);
	}
	Cookie template = getSessionIdCookie();
	Cookie cookie = new SimpleCookie(template);
	String idString = currentId.toString();
	cookie.setValue(idString);
	cookie.saveTo(request, response);
	log.trace("Set session ID cookie for session with id {}", idString);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Inject
public void configureProperties(
    @Named("${shiro.globalSessionTimeout:-" + DEFAULT_GLOBAL_SESSION_TIMEOUT + "}") final long globalSessionTimeout,
    @Named("${nexus.sessionCookieName:-" + DEFAULT_NEXUS_SESSION_COOKIE_NAME + "}") final String sessionCookieName)
{
  setGlobalSessionTimeout(globalSessionTimeout);
  log.info("Global session timeout: {} ms", getGlobalSessionTimeout());

  Cookie cookie = getSessionIdCookie();
  cookie.setName(sessionCookieName);
  log.info("Session-cookie prototype: name={}", cookie.getName());
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
private void storeSessionId(final Serializable currentId, final HttpServletRequest request, final HttpServletResponse response) {
    if (currentId == null) {
        String msg = "sessionId cannot be null when persisting for subsequent requests.";
        throw new IllegalArgumentException(msg);
    }
    
    final String idString = currentId.toString();
    final Cookie cookie = getSessionIdCookie();
    cookie.setValue(idString);
    cookie.saveTo(request, response);
    LOGGER.debug("Set session ID cookie for session with id {}", idString);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
@Override
public String readValue(HttpServletRequest request, HttpServletResponse ignored) {
    String name = getName();
    String value = null;
    javax.servlet.http.Cookie cookie = Cookies.getCookie(request, name);
    if (cookie != null) {
        value = cookie.getValue();
    } else {
        return value;
    }
    
    return this.cookieValueManager.obtainCookieValue(getName(), value, request);
}
 

import org.apache.shiro.web.servlet.Cookie; //导入依赖的package包/类
public Cookie getSessionIdCookie() {
    return sessionIdCookie;
}