Package org.apache.shiro.web.servlet

Class AbstractShiroFilter

  • All Implemented Interfaces:
    Filter, Nameable
    Direct Known Subclasses:
    GuiceShiroFilter, IniShiroFilter, ShiroFilter
    public abstract class AbstractShiroFilter
extends OncePerRequestFilter
    Abstract base class that provides all standard Shiro request filtering behavior and expects subclasses to implement configuration-specific logic (INI, XML, .properties, etc).

    Subclasses should perform configuration and construction logic in an overridden init() method implementation. That implementation should make available any constructed SecurityManager and FilterChainResolver by calling setSecurityManager(org.apache.shiro.web.mgt.WebSecurityManager) and setFilterChainResolver(org.apache.shiro.web.filter.mgt.FilterChainResolver) methods respectively.

    Static SecurityManager

    By default the SecurityManager instance enabled by this filter will not be enabled in static memory via the SecurityUtils.setSecurityManager method. Instead, it is expected that Subject instances will always be constructed on a request-processing thread via instances of this Filter class.

    However, if you need to construct Subject instances on separate (non request-processing) threads, it might be easiest to enable the SecurityManager to be available in static memory via the SecurityUtils.getSecurityManager() method. You can do this by additionally specifying an init-param: 

     <filter>
     ... other config here ...
     <init-param>
         <param-name>staticSecurityManagerEnabled</param-name>
         <param-value>true</param-value>
     </init-param>
 </filter>
    See the Shiro Subject documentation for more information as to if you would do this, particularly the sections on the Subject.Builder and Thread Association.
    Since:
    1.0
    See Also:
    Subject documentation