content: package com.qihoo.finance.chronus.common.filter;
  
  import com.alibaba.fastjson.JSONObject;
  import com.qihoo.finance.chronus.common.domain.Response;
  import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
  
  import javax.servlet.ServletRequest;
  import javax.servlet.ServletResponse;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import java.io.IOException;
  
  public class ShiroLoginFilter extends FormAuthenticationFilter {
  
      @Override
      protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException {
          HttpServletResponse httpServletResponse = (HttpServletResponse) response;
          //这里是个坑，如果不设置的接受的访问源，那么前端都会报跨域错误，因为这里还没到corsConfig里面
          httpServletResponse.setHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("Origin"));
          httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");
          httpServletResponse.setCharacterEncoding("UTF-8");
          httpServletResponse.setContentType("application/json");
          Response result = new Response().success();
          result.setCode("407");
          result.setMsg("登录失效");
          httpServletResponse.getWriter().write(JSONObject.toJSON(result).toString());
          return false;
      }
  
  }
  