雖然spring早就推出java註解的方式配置框架，由於習慣了看xml所以一直沒有去學習，然而最近需要學習springboot，為了平滑過渡，先被迫研究一下註解配置方式。

這裡展示3種spring配置檔案，來對比xml配置和java註解配置的區別，分別是spring\mvc\shiro的配置

先說總結：

對比2種配置方式會發現xml方法更繁瑣（xml那噁心的頭部約束），拿shiro來說，配完spring-shiro.xml，往往還需要在mvc.xml中開啟代理，啟用aop，然後在web.xml中啟動shiro的Filter

而純java配置只需一個類就能搞定，並且個人覺得可以更直觀的看出bean的構造和依賴情況，又不依賴xsd檔案

所以貌似java配置方法越來越流行，而xml的方式逐漸在被替代

話說回來現在springboot專案裡似乎都已經放棄xml，要學習springboot的童鞋還是先習慣java配置方法吧（boot的配置還要高階，還要簡單，感覺還是要先從基礎的學起，免得直接看高階的一臉懵逼）

一、 spring配置

1、傳統的spring.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:cache="http://www.springframework.org/schema/cache"
       xmlns:p="http://www.springframework.org/schema/p"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context.xsd
       http://www.springframework.org/schema/cache
       http://www.springframework.org/schema/cache/spring-cache.xsd">

    <context:component-scan base-package="com.ssm"/>

    <context:property-placeholder location="classpath:jdbc.properties" ignore-unresolvable="true" />

    <!-- 資料來源 -->
    <bean id="dataSource" class="org.apache.commons.dbcp2.BasicDataSource">
        <property name="driverClassName" value="com.mysql.jdbc.Driver"/>
        <property name="url" value="jdbc:mysql:///test?useSSL=false&amp;useUnicode=true&amp;characterEncoding=UTF-8"/>
        <property name="username" value="${jdbc.username}"/>
        <property name="password" value="${jdbc.password}"/>
    </bean>

     <!--mybatis的SqlSession的工廠-->
    <bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
        <property name="configLocation" value="classpath:mybatis.xml"/>
        <property name="dataSource" ref="dataSource"/>
        <property name="mapperLocations" value="classpath*:com/ssm/**/*-mapper.xml"/>
    </bean>

     <!--告訴mybatis去哪裡找mapper.xml檔案-->
    <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
        <property name="basePackage" value="com.ssm.dao"/>
        <property name="sqlSessionFactoryBeanName" value="sqlSessionFactory"/>
    </bean>

    <!--事務配置-->
    <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
        <property name="dataSource" ref="dataSource"/>
    </bean>
    
    <!--啟動事務-->
    <tx:annotation-driven transaction-manager="transactionManager" order="3"/>
</beans>
 

 2、基於註解的java類配置方式：

import org.apache.commons.dbcp2.BasicDataSource;
import org.mybatis.spring.SqlSessionFactoryBean;
import org.mybatis.spring.mapper.MapperScannerConfigurer;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.support.PathMatchingResourcePatternResolver;
import org.springframework.jdbc.datasource.DataSourceTransactionManager;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.annotation.EnableTransactionManagement;

@Configuration
@ComponentScan("com.demo")//啟動spring掃描
@PropertySource(value = {"classpath:jdbc.properties"}, ignoreResourceNotFound = true)//找不到配置檔案則丟擲異常
@EnableTransactionManagement//啟動事務
public class SpringConfig {

    @Value("${jdbc.username}")
    private String username;
    @Value("${jdbc.password}")
    private String password;

    //資料來源
    @Bean
    public BasicDataSource basicDataSource() {
        BasicDataSource dataSource = new BasicDataSource();
        dataSource.setDriverClassName("com.mysql.jdbc.Driver");
        dataSource.setUrl("jdbc:mysql:///test?useSSL=false&useUnicode=true&characterEncoding=UTF-8");
        dataSource.setUsername(username);
        dataSource.setPassword(password);
        return dataSource;
    }

    //session工廠
    @Bean
    public SqlSessionFactoryBean sqlSessionFactoryBean(BasicDataSource dataSource) throws IOException {
        SqlSessionFactoryBean factoryBean = new SqlSessionFactoryBean();
        factoryBean.setDataSource(dataSource);

        // mapper location
        PathMatchingResourcePatternResolver pathResolver = new PathMatchingResourcePatternResolver();
        factoryBean.setMapperLocations(pathResolver.getResources("classpath*:com/demo/**/*-mapper.xml"));

        // config file
        factoryBean.setConfigLocation(new ClassPathResource("mybatis.xml"));
        return factoryBean;
    }

    //mapper掃描
    @Bean
    public MapperScannerConfigurer mapperScannerConfigurer() {
        MapperScannerConfigurer mapperScannerConfigurer = new MapperScannerConfigurer();
        mapperScannerConfigurer.setBasePackage("com.demo.dao");
        mapperScannerConfigurer.setSqlSessionFactoryBeanName("sqlSessionFactoryBean");
        return mapperScannerConfigurer;
    }

    //事務配置
    @Bean
    public PlatformTransactionManager transactionManager(BasicDataSource dataSource) {
        DataSourceTransactionManager dataSourceTransactionManager = new DataSourceTransactionManager();
        dataSourceTransactionManager.setDataSource(dataSource);
        return dataSourceTransactionManager;
    }

}
 

說明：

2個配置檔案內裡都定義了資料來源、mybatis的session工廠以及啟用@Transantional的事務

第一份是xml配置方法（這裡忽略了web.xml），第二份是基於註解的純java配置方法

接下來看看mvc的配置：

二、spring-mvc配置

1、xml配置方法

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/mvc
       http://www.springframework.org/schema/mvc/spring-mvc.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context.xsd">

    <!-- 啟動MVC配置 -->
    <mvc:annotation-driven/>

    <!-- 靜態資源 -->
    <mvc:resources mapping="/static/**" location="/static/">
        <mvc:cache-control max-age="3600" cache-public="true"/>
    </mvc:resources>
    
    <!-- 啟動mvc的自動掃描。Spring.xml可以不用掃描 -->
    <context:component-scan base-package="com.demo"/>

    
    <!-- 檢視解析器 -->
    <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/WEB-INF/jsp/"/>
        <property name="suffix" value=".jsp"/>
        <property name="viewClass" value="org.springframework.web.servlet.view.JstlView"/>
    </bean>     

    <!--用來支援檔案上傳的multipart處理器-->
    <bean id="multipartResolver"
          class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
        <!--todo 可以通過配置引數控制上傳檔案的內容和大小-->
    </bean>
</beans>

 然後是配置web.xml：

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
    <servlet-name>mvc</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:mvc.xml</param-value>
    </init-param>
</servlet>
<servlet-mapping>
    <servlet-name>mvc</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

2、java註解方式

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.multipart.MultipartResolver;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;
import org.springframework.web.servlet.ViewResolver;
import org.springframework.web.servlet.config.annotation.DefaultServletHandlerConfigurer;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
import org.springframework.web.servlet.view.InternalResourceViewResolver;
import org.springframework.web.servlet.view.JstlView;

@Configuration
@EnableWebMvc//啟動springMVC註解驅動 等價於xml 配置中的<mvc:annotation-driven/>
@ComponentScan("com.demo")//掃描建立控制器類
public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Bean//定義試圖解析器
    public ViewResolver viewResolver(){
        InternalResourceViewResolver resolver = new InternalResourceViewResolver();
        resolver.setPrefix("/WEB-INF/jsp/");
        resolver.setSuffix(".jsp");
        resolver.setExposeContextBeansAsAttributes(true);
        resolver.setViewClass(JstlView.class);
        return resolver;
    }

    //靜態資源配置
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/static/**")
                .addResourceLocations("/static/js")
                .setCacheControl(CacheControl.maxAge(1, TimeUnit.HOURS).cachePublic());
    }

    /*靜態資源交給預設的servlet
    @Override
    public void configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
        configurer.enable();
    }*/

    //檔案上傳元件
    @Bean
    public MultipartResolver multipartResolver() {
        return new CommonsMultipartResolver();
    }
}

 再配個啟動類（相當於web.xml中配置ContextLoadListener）

繼承了AbstractAnnotationConfigDispatcherServletInitializer的AppInitalizer的作用就類似web.xml中的ContextLoadListener，並且會在web專案執行初始化被自動發現並載入，這就是java config的魅力所在了，不管在哪裡聲明瞭配置了，只要繼承了AbstractAnnotationConfigDispatcherServletInitializer，它就可以被自動載入。

import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
public class WebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[]{RootConfig.class};//非SpringMVC上下文配置類，不需要就return null
    }
    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class[]{WebMvcConfig.class};//SpringMVC上下文配置類
    }
    @Override
    protected String[] getServletMappings() {
        return new String[]{"/"};//dispatcher對映路徑，一個string的列表，這裡處理所有請求
    }
//相當於web.xml中的
//<servlet-mapping>
//    <servlet-name>mvc</servlet-name>
//    <url-pattern>/</url-pattern>
//</servlet-mapping>
}

RootConfig，不需要的話在上面 WebAppInitializer 的 getRootConfigClasses() 裡直接return null即可

可以參考官方文件：

https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#spring-web

import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.FilterType;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
@Configuration
@ComponentScan(basePackages="com.ssm",excludeFilters={
        @ComponentScan.Filter(type= FilterType.ANNOTATION,value=EnableWebMvc.class)
})
public class RootConfig {
//RootConfig.class的內容如下，它可以放在和AppInitializer同個目錄下，主要用來配置spring的bean，這裡只關注web專案的實現，所以暫時沒有具體內容
}

三、shiro配置

1、shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd">

<!--shiroFilter 過濾器-->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager"/>
    <property name="loginUrl" value="/login"/>
    <property name="successUrl" value="/hello"/>
    <property name="unauthorizedUrl" value="/fail"/>
    <property name="filters">
        <map>
            <entry key="authc" value-ref="formAuthenticationFilter"/>
            <!--自定義Filter，視需求-->
            <entry key="testAuth">
                 <bean class="com.yourpackage.AuthFilter"/>
            </entry>
        </map>
    </property>
    <property name="filterChainDefinitions" ref="shiroFilterChainDefinitions"></property>
</bean>
<!--許可權過濾過濾器連定義 -->
<bean name="shiroFilterChainDefinitions" class="java.lang.String">
    <constructor-arg>
        <value>
            /static/** = anon
            /login = authc
            /test = testAuth
        </value>
    </constructor-arg>
</bean>
 
<!--安全管理器 securityManager-->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="customRealm"/>
    <property name="cacheManager" ref="shiroCacheManager"/>
    <property name="sessionManager" ref="sessionManager"/>
    <property name="rememberMeManager" ref="rememberMeManager"/>
</bean>

<!--自定義系統認證域 Realm-->
<bean id="customRealm" class="com.ssm.shiro.CustomRealm">
    <property name="credentialsMatcher" ref="credentialsMatcher"/>
</bean>

<!-- 憑證匹配器，資料庫儲存的密碼是使用MD5演算法加密的-->
<bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    <property name="hashAlgorithmName" value="md5"/>
    <property name="hashIterations" value="1"/>
</bean>

<!-- 快取管理器-->
<bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml"/>
</bean>

 如果需要使用註解，還需要在mvc.xml中加入如下程式碼

<!--開啟aop，對類代理-->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator">
    <property name="proxyTargetClass" value="true"/>
</bean>
<!--開啟shiro註解支援-->
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManager"/>
</bean>

最後還要在web.xml中配置如下，啟動shiro的Filter 

<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>
        org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
    <!--設定true由servlet容器控制filter的生命週期-->
    <init-param>
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
    <!--設定spring容器filter的bean id，如果不設定則找與filter-name一致的bean-->
    <!--<init-param>-->
        <!--<param-name>targetBeanName</param-name>-->
        <!--<param-value>shiroFilter</param-value>-->
    <!--</init-param>-->
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

2、java方式：

import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;

@Configuration
public class ShiroConfig {
//在springboot中利用FilterRegistrationBean註冊delegatingFilterProxy來啟動shiro
//    @Bean
//    public FilterRegistrationBean delegatingFilterProxy(){
//        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
//        DelegatingFilterProxy proxy = new DelegatingFilterProxy();
//        proxy.setTargetFilterLifecycle(true);
//        proxy.setTargetBeanName("shiroFilter");
//        filterRegistrationBean.setFilter(proxy);
//        return filterRegistrationBean;
//    }

    @Bean("shiroFilter")
    public ShiroFilterFactoryBean factory(DefaultWebSecurityManager securityManager) {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        factoryBean.setSecurityManager(securityManager);
        factoryBean.setLoginUrl("/login");
        factoryBean.setSuccessUrl("/user");
        factoryBean.setUnauthorizedUrl("/fail");

        //自定義Filter（視需求而定）
        Map<String, Filter> filters = factoryBean.getFilters();//等號後面也可以直接new LinkedHashMap();
        filters.put("testAuth", new YourFilter());
        factoryBean.setFilters(filters);
        //自定義url規則
        // http://shiro.apache.org/web.html#urls-
        Map<String, String> filterChainDefinitions = new LinkedHashMap<>();
        filterChainDefinitions.put("/login", "authc");
        filterChainDefinitions.put("/test", "testAuth");
        filterChainDefinitions.put("/static/**", "anon");

        factoryBean.setFilterChainDefinitionMap(filterChainDefinitions);
        return factoryBean;
    }

    @Bean("securityManager")
    public DefaultWebSecurityManager getManager() {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(myShiroRealm());
//        manager.setCacheManager(ehCacheManager());//注入快取管理器,看需求
        /*
         * 關閉shiro自帶的session，詳情見文件
         * http://shiro.apache.org/session-management.html#SessionManagement-StatelessApplications%28Sessionless%29
         */
//        DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
//        DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();
//        defaultSessionStorageEvaluator.setSessionStorageEnabled(false);
//        subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);
//        manager.setSubjectDAO(subjectDAO);
        return manager;
    }

    @Bean
    public MyShiroRealm myShiroRealm() {
        MyShiroRealm myShiroRealm = new MyShiroRealm();
        myShiroRealm.setCredentialsMatcher(credentialsMatcher());
        return myShiroRealm;
    }

    @Bean("credentialsMatcher")
    public HashedCredentialsMatcher credentialsMatcher() {
        HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
        credentialsMatcher.setHashAlgorithmName("md5");
        credentialsMatcher.setHashIterations(5);
        return credentialsMatcher;
    }
    /**
     * 下面的程式碼是添加註解支援
     */
    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        // 強制使用cglib，防止重複代理和可能引起代理出錯的問題
        // https://zhuanlan.zhihu.com/p/29161098
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
        return defaultAdvisorAutoProxyCreator;
    }

    @Bean("lifecycleBeanPostProcessor")
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    /**
     * 開啟shiro aop註解支援. 使用代理方式; 所以需要開啟程式碼支援;
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }

//    @Bean
//    public EhCacheManager ehCacheManager() {
//        EhCacheManager cacheManager = new EhCacheManager();
////        cacheManager.setCacheManagerConfigFile("classpath:ehcache.xml");
//        return cacheManager;
//    }
}

沒有FilterRegistrationBean的話web.xml那段程式碼不能少，還得配置（暫時還沒找到不通過FilterRegistrationBean註冊

DelegatingFilterProxy來啟動Filter的方法）