SessionManager支持token認證

1.定義一個SessionManager類

建立一個類，繼承AuthorizingRealm ，而後在doGetAuthenticationInfo中重寫認證的方法

/**
 * 重寫 SessionId 獲取方式
 * @param request 請求
 * @param response 響應
 * @return id
 */
@Override
protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
    String id = WebUtils.toHttp( request ).getHeader( AUTHORIZATION );
    //若是請求頭中有 Authorization 則其值爲sessionId
    if (!StringUtils.isEmpty( id )) {
        request.setAttribute( REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE );
        request.setAttribute( ShiroHttpServletRequest.REFERENCED_SESSION_ID, id );
        request.setAttribute( ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE );
        return id;
    } else {
        //不然按默認規則從cookie取sessionId
        return super.getSessionId( request, response );
    }
}