Shiro中SimpleByteSource序列化异常：java.io.NotSerializableException:org.apache.shiro.util.SimpleByteSource

超、凢脫俗 2022-12-15 11:14 71阅读 0赞

# 异常说明 #

在学习Shiro使用缓存时，出现：java.io.NotSerializableException:org.apache.shiro.util.SimpleByteSource异常。出现这种情况是因为：SimpleByteSource没有是实现Serializable接口。

# 解决方案 #

第一步：自定义一个类继承SimpleByteSource实现Serializable接口

public class MySimpleByteSource implements ByteSource, Serializable { 
        private static final long serialVersionUID = 5175082362119580768L;
    
        private  byte[] bytes;
        private String cachedHex;
        private String cachedBase64;
    
        public MySimpleByteSource(){ 
        }
    
        public MySimpleByteSource(byte[] bytes) { 
            this.bytes = bytes;
        }
    
        public MySimpleByteSource(char[] chars) { 
            this.bytes = CodecSupport.toBytes(chars);
        }
    
        public MySimpleByteSource(String string) { 
            this.bytes = CodecSupport.toBytes(string);
        }
    
        public MySimpleByteSource(ByteSource source) { 
            this.bytes = source.getBytes();
        }
    
        public MySimpleByteSource(File file) { 
            this.bytes = (new MySimpleByteSource.BytesHelper()).getBytes(file);
        }
    
        public MySimpleByteSource(InputStream stream) { 
            this.bytes = (new MySimpleByteSource.BytesHelper()).getBytes(stream);
        }
    
        public static boolean isCompatible(Object o) { 
            return o instanceof byte[] || o instanceof char[] || o instanceof String || o instanceof ByteSource || o instanceof File || o instanceof InputStream;
        }
    
        public void setBytes(byte[] bytes) { 
            this.bytes = bytes;
        }
    
        @Override
        public byte[] getBytes() { 
            return this.bytes;
        }
    
    
        @Override
        public String toHex() { 
            if(this.cachedHex == null) { 
                this.cachedHex = Hex.encodeToString(this.getBytes());
            }
            return this.cachedHex;
        }
    
        @Override
        public String toBase64() { 
            if(this.cachedBase64 == null) { 
                this.cachedBase64 = Base64.encodeToString(this.getBytes());
            }
    
            return this.cachedBase64;
        }
    
        @Override
        public boolean isEmpty() { 
            return this.bytes == null || this.bytes.length == 0;
        }
        @Override
        public String toString() { 
            return this.toBase64();
        }
    
        @Override
        public int hashCode() { 
            return this.bytes != null && this.bytes.length != 0? Arrays.hashCode(this.bytes):0;
        }
    
        @Override
        public boolean equals(Object o) { 
            if(o == this) { 
                return true;
            } else if(o instanceof ByteSource) { 
                ByteSource bs = (ByteSource)o;
                return Arrays.equals(this.getBytes(), bs.getBytes());
            } else { 
                return false;
            }
        }
    
        private static final class BytesHelper extends CodecSupport { 
            private BytesHelper() { 
            }
    
            public byte[] getBytes(File file) { 
                return this.toBytes(file);
            }
    
            public byte[] getBytes(InputStream stream) { 
                return this.toBytes(stream);
            }
        }
    
    }

第二步：修改UserRealm的doGetAuthenticationInfo()方法

@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { 
      //模拟从数据库中获取用户名密码
        UsernamePasswordToken userToken = (UsernamePasswordToken) token;
    
        User user = userService.getUserByUsername(userToken.getUsername());
        //用户不存在
        if (null == user) { 
            return null; //抛出异常UnknownAccountException
        }
        // 用户被锁定
        if (user.getLocked()) { 
            throw new LockedAccountException("该用户已被锁定,暂时无法登录！");
        }
    
        // 获取用户的盐值
        //ByteSource salt = ByteSource.Util.bytes(user.getSalt()); //旧代码会抛出NotSerializableException:org异常，替换成下面代码就可以了
        MySimpleByteSource salt = new MySimpleByteSource(user.getSalt());
    
        //用户登录成功，将用户信息保存在Shiro的session中
        SecurityUtils.getSubject().getSession().setAttribute("currentLoginedUser", user);
    
        //不能自己做密码认证，系统会自己做
        // 第一个参数为用户信息，方便授权时查找用户的权限
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user, user.getPassword(),salt, getName());
        return simpleAuthenticationInfo;
    }

# 备注 #

网上有很多介绍这个问题的解决办法只需要自定义一个SimpleByteSource类继承SimpleByteSource实现Serializable接口

public class MySimpleByteSource extends SimpleByteSource implements Serializable { 
    
        private static final long serialVersionUID = -409798445206117297L;
    
        public MySimpleByteSource(byte[] bytes) { 
            super(bytes);
        }
    
    }

然后在自定义的Realm中的doGetAuthenticationInfo方法中使用即可。  
但是经过测试，这种方法虽然在序列化SimpleAuthenticationInfo的时候不报错的，但是在反序列化的时候也会报错：org.apache.commons.lang3.SerializationException: java.io.InvalidClassException。这是因为SimpleByteSource没有默认构造方法，导致反序列化的时候失败。