在shiro使用過程中，保持客戶端的狀態是通過兩種方式關聯。一種方式是通過cookie返回，一種是通過重定向回寫url。但是重定向解決不了ajax請求。 如果客戶端禁用了cookie，會導致shiro無法獲得seesion儲存的認證，授權資訊。導致shiro無法使用。

        解決思路：在客戶端與服務端進行互動之前，普通請求通過重定向會寫url帶上會話資訊。ajax請求通過寫訊息頭形式，返回特定錯誤讓客戶端獲取相應頭得到seesionId。如果請求後臺沒有用到seesion，可以不用先獲取會話，否則所有的請求都必須先獲得會話。

客戶端獲取到訊息頭後，儲存會話id，每次請求在通過header帶上會話資訊（一定要帶上，特別是重定向的請求，必須從url獲取到會話id）。

        也可以不需要先獲取認證資訊，如果使用cookie形式的方式，是不需要先獲的會話。服務端使用了會話，自動寫cookie到客戶端。但是禁用了cookie，服務端產生了會話，相應得到了正確處理，然後在響應頭裡寫訊息頭，客戶端每次請求都從訊息頭裡獲取會話id，當然這樣實現也是可以的。

程式碼如下，相容cookie模式。

public class OssWebSessionManager extends DefaultWebSessionManager implements WebSessionManager {
  
	private static final Logger log = LoggerFactory.getLogger(OssWebSessionManager.class);
	
	private boolean sessionIdHeaderEnabled;
	 
	public static final String HEADER_SESSION_NAME = "X-AUTH-SESSION";
	
	public static final String HEADER_SESSION_ID_SOURCE = "header";
   
     public OssWebSessionManager() {
         super();
         //重定向無法手動帶上header
         super.setSessionIdUrlRewritingEnabled(true);
         sessionIdHeaderEnabled=true;
     }
     
     @Override
     protected Session createExposedSession(Session session,SessionContext context) {
    	 return super.createExposedSession(session, context);
     }
     
     @Override
     protected Session createExposedSession(Session session, SessionKey key) {
    	 return super.createExposedSession(session, key);
     }
      
     @Override
     protected void onStart(Session session, SessionContext context) {
         super.onStart(session, context);

         HttpServletRequest request = WebUtils.getHttpRequest(context);
         HttpServletResponse response = WebUtils.getHttpResponse(context);
         //用header儲存會話sessionId
         if (sessionIdHeaderEnabled) {
             Serializable sessionId = session.getId();
             storeSessionId(sessionId, request, response);
         } 
     }
     
     @Override
     public Serializable getSessionId(SessionKey key) {
         Serializable id = super.getSessionId(key);
         if(null != id){
        	 return id;
         }
         if (WebUtils.isWeb(key)) {
             ServletRequest request = WebUtils.getRequest(key);
             ServletResponse response = WebUtils.getResponse(key);
             id = getHeaderSessionId(request, response);
         }
         return id;
     }

   
     protected Serializable getHeaderSessionId(ServletRequest request, ServletResponse response) {
    	 String id=getHeaderSessionId((HttpServletRequest)request);
    	 if (id != null) {
             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,OssWebSessionManager.HEADER_SESSION_ID_SOURCE);
         }
    	 if (id != null) {
             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
         }
         request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());
         return id;
     }
     
     @Override
     protected void onExpiration(Session s, ExpiredSessionException ese, SessionKey key) {
         super.onInvalidation(s, ese, key);
         onInvalidation(key);
     }
	
     @Override
     protected void onInvalidation(Session session, InvalidSessionException ise, SessionKey key) {
         super.onInvalidation(session, ise, key);
         onInvalidation(key);
     }
     
     @Override
     protected void onStop(Session session, SessionKey key) {
         super.onStop(session, key);
         onInvalidation(key);
     }
     
     @Override
     public boolean isServletContainerSessions() {
         return false;
     }

     private void storeSessionId(Serializable currentId, HttpServletRequest request, HttpServletResponse response) {
         if (currentId == null) {
             String msg = "sessionId cannot be null when persisting for subsequent requests.";
             throw new IllegalArgumentException(msg);
         }
         response.setHeader(OssWebSessionManager.HEADER_SESSION_NAME,currentId.toString());
         log.trace("Set session ID  header for session with id {}", currentId.toString());
     }
     
     /**
      * 獲取請求的token
      */
     private String getHeaderSessionId(HttpServletRequest httpRequest){
    	 String sessionId=null;
    	 //從header中獲取session
    	 sessionId = httpRequest.getHeader(OssWebSessionManager.HEADER_SESSION_NAME);
         //如果header中不存在token，則從引數中獲取token
         if(!StringUtils.hasText(sessionId)){
        	 sessionId = httpRequest.getParameter(OssWebSessionManager.HEADER_SESSION_NAME);
         }
         return sessionId;
     }
     
     private void onInvalidation(SessionKey key) {
    	 if (WebUtils.isWeb(key)) {
        	 ServletResponse response = WebUtils.getResponse(key);
        	 if(null != response){
        		 ((HttpServletResponse)response).addHeader(OssWebSessionManager.HEADER_SESSION_NAME, "");
        	 }
         }
     }

	public boolean isSessionIdHeaderEnabled() {
		return sessionIdHeaderEnabled;
	}

	public void setSessionIdHeaderEnabled(boolean sessionIdHeaderEnabled) {
		this.sessionIdHeaderEnabled = sessionIdHeaderEnabled;
	}
}
 

需要認證的請求

public class OssAuthenticationFilter extends AuthenticationFilter {

	private static final Logger log = LoggerFactory.getLogger(OssAuthenticationFilter.class);

		
	@Override
	protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
		Subject subject=SecurityUtils.getSubject();
		if(isRelogin( request,  response, subject)){
			return false; 
		}
		return subject.isAuthenticated();
	}
	
	protected  boolean isRelogin(ServletRequest request, ServletResponse response,Subject subject) throws IOException{
		Session session=subject.getSession(false);
		if(null == session){
			 if(isAjax(request)){
					//無法手動帶上sessionId，從訊息頭獲取sessionId
				    session=subject.getSession();
	            	response.getWriter().write(JSON.toJSONString(ResultBuilder.genExpResult(new AppBizException(AppExcCodesEnum.SESSION_TIMEOUT))));
	            }else{
	            	request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, true);
	                this.saveRequestAndRedirectToLogin(request, response);
	            }
			 return true;
		}
		return false;
	}
	
	protected  boolean isAjax(ServletRequest request){
        String header = ((HttpServletRequest) request).getHeader("X-Requested-With");
        if("XMLHttpRequest".equalsIgnoreCase(header)){
            return Boolean.TRUE;
        }
        return Boolean.FALSE;
    }

}
 

不需要認證，只需要有會話的請求
public class OssNoAuthenticationFilter extends OssAuthenticationFilter {

	private static final Logger log = LoggerFactory.getLogger(OssNoAuthenticationFilter.class);
	
	@Override
	protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
		Subject subject=SecurityUtils.getSubject();
		if(isRelogin( request,  response, subject)){
			return false; 
		}
		return true;
	}
}

shiro過濾器配置

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
	    <!-- Shiro的核心安全介面,這個屬性是必須的 -->  
	    <property name="securityManager" ref="securityManager"/>  
	    <!-- 要求登入時的連結(可根據專案的URL進行替換),非必須的屬性,預設會自動尋找Web工程根目錄apos.htmlhtml"頁面 -->
	    <property name="loginUrl" value="${shiro.loginUrl}"/>
	    <!-- 登入成功後要跳轉的連線 -->  
	    <property name="successUrl" value="/sys/manager/index"/>
	    <!-- 使用者訪問未對其授權的資源時,所顯示的連線 -->  
	    <!-- 若想更明顯的測試此屬性可以修改它的值,如unauthor.jsp-->  
	    <property name="unauthorizedUrl" value="/sys/manager/login"/>  
	    <property name="filters">
			<map>
			<entry key="authc">
			    <bean class="tc.oss.web.shiro.OssAuthenticationFilter" />
			</entry>
			<entry key="noAuthc">
                <bean class="tc.oss.web.shiro.OssNoAuthenticationFilter" />
            </entry>
			<entry key="validCode">
                <bean class="tc.oss.web.shiro.ValidCodeAuthenticationFilter">
                     <property name="validCodeUrl" value="/sys/manager/validCode" />
                </bean>
            </entry>
			<!-- <entry key="ssl">
			    <ref bean="sslFilter" />
			</entry> -->
			</map>
		</property>
	    <property name="filterChainDefinitions">  
	        <value>
	        	/statics/**=anon
				/js/**=anon
	        	/page/**=anon
	        	/sys/manager/login=noAuthc
	        	/sys/manager/captcha=noAuthc
	        	/favicon.ico=anon
	        	/sys/manager/validCode=authc
	        	/sys/manager/commitCode=authc
	        	/**=authc
	        </value>
	    </property>
	</bean>

這樣客戶端禁用cookie也能用了，請求必須帶上header。從url或者響應中獲取

url回撥的

 function refreshCode(){
	  var sid=window.location.href.split(";")[1].split("=")[1];
	  $.ajax({
	         type: "GET",
	         url: "${contextPath}/sys/manager/captcha?t=" + $.now(),
	         beforeSend: function (XMLHttpRequest) {
	        	 var sessionid = "X-AUTH-SESSION";
	        	 XMLHttpRequest.setRequestHeader(sessionid, sid);
	         },
	         success: function(r){
	        	 $("#captchaImg").attr("src",r);
	         }
	     });
  }

ajax非同步請求的沒測試了，應該是沒問題的了