您需要实现自定义的Shiro过滤器.

像这样：

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import java.io.IOException ;

import javax.servlet.http.HttpServletResponse ;

import org.apache.shiro.web.filter.authz.AuthorizationFilter ;

import org.apache.shiro.web.util.WebUtils ;

public class LocalhostFilter extends AuthorizationFilter {

private static final String message = "Access denied.";

@Override

protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {

//do something when access allowed

return true;

}

@Override

protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException {

HttpServletResponse httpResponse ;

try { httpResponse = WebUtils.toHttp(response); }

catch (ClassCastException ex) {

// Not a HTTP Servlet operation

return super.onAccessDenied(request, response) ;

}

if ( message == null )

httpResponse.sendError(403) ;

else

httpResponse.sendError(403, message) ;

return false ; // No further processing.

}

}