shiro在收到請求時會預設讀取cookie裡的資料來判別客戶端的身份，然而我的專案沒有用cookie，伺服器也不處理cookie資訊，我們看看shiro讀取cookie的程式碼：

//SimpleCookie類的readValue方法
public String readValue(HttpServletRequest request, HttpServletResponse ignored) {
        String name = getName();
        String value = null;
        javax.servlet.http.Cookie cookie = getCookie(request, name);
        if
 
 (cookie != null) {
            // Validate that the cookie is used at the correct place.
            String path = StringUtils.clean(getPath());
            if (path != null && !pathMatches(path, request.getRequestURI())) {
                log.warn("Found '{}' cookie at path '{}', but should be only used for '{}'"
 
, new Object[] { name, request.getRequestURI(), path});
            } else {
                value = cookie.getValue();
                log.debug("Found '{}' cookie value [{}]", name, value);
            }
        } else {
            log.trace("No '{}' cookie value", name);
        }

        return
 
 value;
    }

知道了問題的根源就好辦了，我給SimpleCookie建個子類，並重寫readValue方法：

@Override
    public String readValue(HttpServletRequest request, HttpServletResponse ignored) {
        String token = request.getParameter("tokenContent");
        return token;
        // return super.readValue(request, ignored);
    }

然後對SimpleCookie的子類做下配置：

    <!-- sessionManager -->
    <bean id="sessionManager"
        class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="sessionDAO" ref="redisSessionDAO" />
        <property name="globalSessionTimeout" value="604800000" />
        <!-- 會話Cookie -->
        <property name="sessionIdCookie" ref="sessionIdCookie" />
    </bean>

    <!-- 自定義會話Cookie -->
    <bean id="sessionIdCookie" class="com.cookie.MySimpleCookie">

        <property name="httpOnly" value="true" />
        <!--cookie的有效時間 -->
        <property name="maxAge" value="604800" />       
    </bean>

使了一個偷樑換柱的手段，問題解決！不過當提交的表單是型別是multipart/form-data時會獲取不了token，解決方法下次再寫。