blocks|key|788725|text|我没有使用Shiro的经验，我“部分”同意你关于Spring+Security的说法。在Spring+Security3.x之前，Spring+Security+(或Acegi)的设置非常痛苦。一个简单的基于角色的配置至少需要140行神秘的XML配置...我之所以知道这一点，是因为我实际上是自己数行的。这是您设置了一次的东西，您祈祷它将永远工作，而不会再次接触配置，因为您可以保证您已经忘记了所有配置的含义。:)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|788726|在Spring+Security+3.x中，它得到了极大的改进。它引入了security命名空间，极大地缩短了配置，从140行减少到大约30行。下面是我的一个项目的Spring+Security+3.x示例：|offset|length|style|CODE|788727|<?xml+version="1.0"+encoding="UTF-8"?>
<beans+xmlns="http://www.springframework.org/schema/beans"+xmlns:security="http://www.springframework.org/schema/security"+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
++++xsi:schemaLocation="http://www.springframework.org/schema/beans+http://www.springframework.org/schema/beans/spring-beans.xsd
++++++++++++++++++++++++http://www.springframework.org/schema/security+http://www.springframework.org/schema/security/spring-security.xsd">

++++<security:http+auto-config="true">
++++++++<security:form-login+login-page="/index.do"+authentication-failure-url="/index.do?login_error=1"+default-target-url="/index.do"
++++++++++++always-use-default-target="true"+/>
++++++++<security:logout+logout-success-url="/index.do"+/>
++++++++<security:intercept-url+pattern="/secure/**"+access="ROLE_ADMIN,ROLE_USER"+/>
++++++++<security:intercept-url+pattern="/**"+access="IS_AUTHENTICATED_ANONYMOUSLY"+/>
++++</security:http>

++++<bean+id="customAuthenticationProvider"+class="my.project.CustomAuthenticationProviderImpl">
++++++++...
++++</bean>

++++<security:authentication-manager>
++++++++<security:authentication-provider+ref="customAuthenticationProvider"+/>
++++</security:authentication-manager>

</beans>|code-block|syntax|javascript|788728|Spring+Security3.x的美妙之处在于它具有极强的可配置性，这导致了它的一个主要缺点:太复杂，难以理解。文档也不容易阅读，因为我对Spring+Security使用的一些术语只是部分熟悉。但是，如果您需要创建自定义配置或控制您希望的安全粒度，则可以使用这些选项。或者，您可以坚持使用上述<+30行代码来执行基于角色的安全检查。|788729|我真正喜欢Spring+Security的地方是，一旦设置好了，安全性就会无缝地集成到项目中。这就好像实际的项目代码不知道安全性的存在……这很好，因为它允许我在将来轻松地分离或升级安全组件(例如，将数据库身份验证更改为LDAP/CAS身份验证)。|788730|entityMap^0|0|10|8|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@$D|U|E|V|F|G]]|9|@]|A|$]]|$1|H|3|I|5|J|7|W|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|X|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|Y|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

I don't have experience using Shiro, and I "partly" agree with what you said about Spring Security. Prior to Spring Security 3.x, Spring Security (or Acegi) was very painful to set up. A simple role-based configuration will take at least 140 lines of cryptic XML configuration... I know this because I actually counted the lines myself. It was something where you set up one time, and you pray that it will work forever without you touching the configuration again, because you can assure you have forgotten what all the configuration means. :)

With Spring Security 3.x, it has tremendously improved upon. It introduces <code>security</code> namespace that drastically shorten the configuration from 140 lines to ~30 lines. Here's an example of Spring Security 3.x of one of my projects:-

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"&gt;

 &lt;security:http auto-config="true"&gt;
 &lt;security:form-login login-page="/index.do" authentication-failure-url="/index.do?login_error=1" default-target-url="/index.do"
 always-use-default-target="true" /&gt;
 &lt;security:logout logout-success-url="/index.do" /&gt;
 &lt;security:intercept-url pattern="/secure/**" access="ROLE_ADMIN,ROLE_USER" /&gt;
 &lt;security:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
 &lt;/security:http&gt;

 &lt;bean id="customAuthenticationProvider" class="my.project.CustomAuthenticationProviderImpl"&gt;
 ...
 &lt;/bean&gt;

 &lt;security:authentication-manager&gt;
 &lt;security:authentication-provider ref="customAuthenticationProvider" /&gt;
 &lt;/security:authentication-manager&gt;

&lt;/beans&gt;
</code></pre>

The beauty of Spring Security 3.x is it is extremely configurable, which contributes to one of the main cons: too complicated to understand. The documentation isn't easy to read either because I'm only partially familiar with the some of the terms Spring Security used. However, the options are there if you need to create your custom configuration or control how granular you want your security to be. Or else, you can stick with the above &lt; 30 lines to perform a role-based security check.

What I really like about Spring Security is once it is set up the security is integrated into the project seamlessly. It is as if the actual project code doesn't know the existence of the security... and that is good, because it allows me to easily detach or upgrade the security component in the future (ex: change database auth to LDAP/CAS auth).

blocks|key|788908|text|我使用Spring+Security+(3.1版)已经有几个月了，我对它非常满意。它真的很强大，有一些非常好的特性，特别是在像我以前一样手工实现所有东西之后！然而，就像我在某处读到的那样，在开发应用程序的时候，你只需设置一次，然后祈祷它能一直工作到最后，因为如果你必须去修复它，你可能已经忘记了你必须参数的大部分东西。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|788909|但随后出现了一个新项目，具有更复杂的安全需求。简而言之，我们必须在几个相关的we应用程序之间实现某种自定义的SSO。|788910|我确切地知道我想要在HTTP逻辑、cookie、会话id等方面实现什么，以及应该以什么顺序发生什么，但是我花了大半天的时间与Spring+Security+API作斗争，仍然不能确切地确定我应该实现或覆盖哪个类或接口，以及如何将它们插入上下文中。整个API感觉真的很复杂，有时还有点深奥。虽然该文档对于一般用例甚至一些定制都很好，但它并没有深入到满足我的需求。|788911|在阅读了这里和网络上其他一些地方的答案后，我得到的印象是Shiro会更容易理解并根据我的需求进行定制。所以我试了试。|788912|我很高兴我做到了，因为经过一天的工作，我设法了解了足够多的API，不仅可以在我的Spring+webapp中毫不费力地设置基本的身份验证和授权系统，还可以实现我正在寻找的自定义SSO行为。我只需要扩展2到3个类，在我的spring上下文中，整个过程只需要25行XML配置。|788913|所以总而言之，在易用性和学习曲线方面，Shiro真的很讨人喜欢，我认为我可能会在未来使用它，除非我遇到一些缺少的功能或其他问题(我到目前为止还没有)。|788914|两者都很强大，但Shiro更容易学习。|788915|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|S|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|T|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|U|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|V|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|O|$]]

I had been using Spring Security (version 3.1) for a few months and was quite happy with it. It is really powerful and has some very nice feature, especially after implementing everything by hand as I did before ! It was though, like I read somewhere, sort of something that you set up once near the beginning of the develoepment of the app, and then pray for it to keep working till the end, because if you have to go fix it you'll probably have forgotten most of the stuff you had to parameter.

But then a new project came along, with more complex security requirements. In short, we had to implement some sort of custom SSO between a couple of related webapps. 

I knew exactly what I wanted to achieve in terms of HTTP logic, cookies, session id's and stuff, and what should happen in what order, but I spent the better part of a day struggling with the Spring Security APIs, and still could not figure out exactly what class or interface I shoud implement or override, and how to plug them in the context. The whole API felt really complex and a bit esoteric at times. And while the doc is quite good for the general use cases and even some customization, it did not go deep enough to cover my needs.

After reading the answers here and on some other places on the web, I got the impression that Shiro would be easier to understand and customize to my needs. So I gave it a try.

And I am glad I did, because after a day working on it I managed to learn enough about the APIs not only to set up a basic authentication and authorization system in my Spring webapp without trouble, but also to implement the custom SSO behaviour I was looking for. I only had to extend 2 or 3 classes, and the whole thing took only about 25 lines of XML config in my spring context.

So as a conclusion, on the ease of use and learning curve aspects, Shiro is really quite likeable, and I think I will probably go with it in the future, unless I encounter some features lacking or some other problem (which I haven't so far).

TL;DR: Both are powerful, but Shiro is much easier to learn.

I have currently evaluating Java based security frameworks, I am a Spring 3.0 user so it seemed that SpringSecurity would be the right Choice, but Spring security seems to suffer from excessive complexity, it certainly does not seem like it is making security easier to implement, Shiro seems to be much more coherent and easier to understand. I am looking for lists of pros and cons between these two frameworks.

Shiro vs. SpringSecurity

我目前正在评估基于Java的安全框架，我是Spring3.0的用户，所以看起来SpringSecurity将是正确的选择，但Spring安全似乎受到了过度复杂的影响，它看起来并没有让安全更容易实现，Shiro似乎更连贯，更容易理解。我正在寻找这两个框架之间的利弊列表。

问Shiro vs.
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Shiro vs.EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Shiro vs.
EN