Root Cause:

org.apache.shiro.UnavailableSecurityManagerException: No SecurityManager accessible to the calling code, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton.  This is an invalid application configuration.

網上搜羅來的解釋說是web.xml少了這一段, 但是我有:

<!-- 配置shiro的核心攔截器 -->
 

    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern
 
>/*</url-pattern>
    </filter-mapping>

後來發現是還少了幾行, 完整體應該是:

<!-- 配置shiro的核心攔截器 -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
 

    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>ERROR</dispatcher>
    </filter-mapping>

表示這4種都要經過shiro攔截器。我之前配置的404頁面裡回去訪問shiro的SecurityUtils.getSubject()，若error不被攔截， 則這個請求是無法獲取Subject的， 因此報錯