SpringBoot整合Apache Shiro 重定向时去掉URL中的JSESSIONID--重写getSessionId方式

没设置时的情况，地址栏携带了JSESSIONID了

1.设置DefaultSessionManager类的 setSessionIdUrlRewritingEnabled(false) 方法为false，它默认是true

2.重写getSessionId方法
添加如下代码

request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());

完整代码

public class CustomSessionManager extends DefaultWebSessionManager {

    private static final String AUTHORIZATING = "token";

    public CustomSessionManager(){
        super();
        super.setSessionIdUrlRewritingEnabled(false);
    }

    @Override
    protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
        //拿到token
        String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATING);
        //不为空则自己管控
        if (sessionId != null){
            request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "cookie");
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
            return sessionId;
        }else {
            //为空调用父类的
            return super.getSessionId(request,response);
        }
    }
}

设置后，重定向时不带JSESSIONID了