• Spring Security Filter Chain

    1. 简介

    Spring Security中的所有功能都是通过过滤器来实现的，这些过滤器组成一个完整的过滤器链。过滤器链涉及很多基础组件，首先梳理一下这些关键组件，会方便理解Spring Security过滤器链。

    2. ObjectPostProcessor

    他是一个对象后置处理器，当一个对象创建成功后，如果需要一些额外的事情需要补充，就可以通过ObjectPostProcessor来进行处理。

    在Spring Security中，开发者可以灵活的配置项目中需要哪些过滤器，一旦选定过滤器之后，每个过滤器会有一个对应的配置器，叫做xxxConfigurer（例如CorsConfigurer），过滤器都是在xxxConfigurer中new出来的，然后再postProcess方法中处理一遍，就将这些过滤器注入到Spring容器中了。

    1. public interface ObjectPostProcessor {
    2.     extends T> O postProcess(O object);
    3. }

    默认有两个继承类，继承关系如下

    2.1  AutowireBeanFactoryObjectPostProcessor

    当一个对象被new出来以后，只要调用AutowireBeanFactoryObjectPostProcessor#postProcess方法，就可以成功注入到Spring容器中。

    1.     @Override
    2. 	@SuppressWarnings("unchecked")
    3. 	public  T postProcess(T object) {
    4. 		if (object == null) {
    5. 			return null;
    6. 		}
    7. 		T result = null;
    8. 		try {
    9. 			result = (T) this.autowireBeanFactory.initializeBean(object, object.toString());
    10. 		}
    11. 		catch (RuntimeException ex) {
    12. 			Class type = object.getClass();
    13. 			throw new RuntimeException("Could not postProcess " + object + " of type " + type, ex);
    14. 		}
    15. 		this.autowireBeanFactory.autowireBean(object);
    16. 		if (result instanceof DisposableBean) {
    17. 			this.disposableBeans.add((DisposableBean) result);
    18. 		}
    19. 		if (result instanceof SmartInitializingSingleton) {
    20. 			this.smartSingletons.add((SmartInitializingSingleton) result);
    21. 		}
    22. 		return result;
    23. 	}

    2.2  CompositeObjectPostProcessor

    他是一个组合的对象后置处理器，维护了一个List集合，存放了所有的后置处理器。在Spring Security框架中，最终使用的对象后置处理器其实就是CompositeObjectPostProcessor，他里面的集合默认只有一个对象，就是AutowireBeanFactoryObjectPostProcessor。

    1. private static final class CompositeObjectPostProcessor implements ObjectPostProcessor {
    2.  
    3. 		private List> postProcessors = new ArrayList<>();
    4.  
    5. 		@Override
    6. 		@SuppressWarnings({ "rawtypes", "unchecked" })
    7. 		public Object postProcess(Object object) {
    8. 			for (ObjectPostProcessor opp : this.postProcessors) {
    9. 				Class oppClass = opp.getClass();
    10. 				Class oppType = GenericTypeResolver.resolveTypeArgument(oppClass, ObjectPostProcessor.class);
    11. 				if (oppType == null || oppType.isAssignableFrom(object.getClass())) {
    12. 					object = opp.postProcess(object);
    13. 				}
    14. 			}
    15. 			return object;
    16. 		}
    17.  
    18. 	}
      19.  

      3. SecurityFilterChain
       

      SecurityFilterChain是Spring Security中的过滤器链对象
       

      1. public interface SecurityFilterChain {
      2.  
      3.     //用来判断request请求是否应该被当前过滤器链处理
      4. 	boolean matches(HttpServletRequest request);
      5.  
      6.     //如果matches返回true，那么request请求就会在getFilters方法返回的Filter集合中被处理
      7. 	List getFilters();
      8.  
      9. }
       

      他的默认实现类是DefaultSecurityFilterChain，需要注意的点是，在一个Spring Security项目中，SecurityFilterChain实例可能有多个。
       

      1. //省略部分代码
      2. public final class DefaultSecurityFilterChain implements SecurityFilterChain {
      3.  
      4. 	private final RequestMatcher requestMatcher;
      5.  
      6. 	private final List filters;
      7.  
      8. 	@Override
      9. 	public List getFilters() {
      10. 		return this.filters;
      11. 	}
      12.  
      13. 	@Override
      14. 	public boolean matches(HttpServletRequest request) {
      15. 		return this.requestMatcher.matches(request);
      16. 	}
      17.  
      18. }
       

      4. SecurityBuilder
       

       

      Spring Security中很多对象都可以通过SecurityBuilder来构建，源码如下：
       

      1. public interface SecurityBuilder {
      2.     O build() throws Exception;
      3. }
       

      4.1 HttpSecurityBuilder
       

      用来构建HttpSecurity对象，最终构建出来的对象为DefaultSecurityFilterChain，默认构建后的filter顺序如下：
       

       

      HttpSecurityBuilder源码如下：
       

      1. //HttpSecurityBuilder默认实现类只有HttpSecurity，可以把H当作HttpSecurity
      2. public interface HttpSecurityBuilderextends HttpSecurityBuilder> extends SecurityBuilder {
      3.  
      4.     extends SecurityConfigurer> C getConfigurer(Class clazz);
      5.  
      6.     extends SecurityConfigurer> C removeConfigurer(Class clazz);
      7.  
      8.     //设置可以在多个配置器之间共享的对象
      9.      void setSharedObject(Class sharedType, C object);
      10.  
      11.      C getSharedObject(Class sharedType);
      12.  
      13.     //配置认证器AuthenticationProvider
      14.     H authenticationProvider(AuthenticationProvider authenticationProvider);
      15.  
      16.     //配置数据源
      17.     H userDetailsService(UserDetailsService userDetailsService) throws Exception;
      18.  
      19.     H addFilterAfter(Filter filter, Class afterFilter);
      20.  
      21.     H addFilterBefore(Filter filter, Class beforeFilter);
      22.  
      23.     //这个过滤器必须是Spring Security框架提供的过滤器的实例或者扩展，添加完成后，会自动进行排序
      24. 	H addFilter(Filter filter);
      25. }
       

      4.2 AbstractSecurityBuilder
       

      AbstractSecurityBuilder实现了SecurityBuilder接口，并对build做了完善，确保只build一次。
       

      1. public abstract class AbstractSecurityBuilder implements SecurityBuilder {
      2.  
      3. 	private AtomicBoolean building = new AtomicBoolean();
      4.  
      5. 	private O object;
      6.  
      7.     //设置为final，确保子类不会再重写这个方法
      8. 	@Override
      9. 	public final O build() throws Exception {
      10. 		if (this.building.compareAndSet(false, true)) {
      11. 			this.object = doBuild();
      12. 			return this.object;
      13. 		}
      14. 		throw new AlreadyBuiltException("This object has already been built");
      15. 	}
      16.  
      17. 	public final O getObject() {
      18. 		if (!this.building.get()) {
      19. 			throw new IllegalStateException("This object has not been built");
      20. 		}
      21. 		return this.object;
      22. 	}
      23.  
      24. 	protected abstract O doBuild() throws Exception;
      25.  
      26. }
       

      4.3 AbstractConfiguredSecurityBuilder
       

      它允许securityconfigururer被应用到它。这使得修改SecurityBuilder成为一种策略，它可以被自定义，并分解成许多securityconfigururer对象，这些对象比SecurityBuilder有更具体的目标。
       

      例如，一个SecurityBuilder可以构建一个DelegatingFilterProxy，但是一个securityconfiger可以用会话管理、基于表单的登录、授权等所需的过滤器填充SecurityBuilder。
       

      在这个类中有一个声明了一个枚举，用来描述构建过程的不同状态。
       

      1. private static enum BuildState {
      2.         UNBUILT(0),
      3.         INITIALIZING(1),
      4.         CONFIGURING(2),
      5.         BUILDING(3),
      6.         BUILT(4);
      7.  
      8.         private final int order;
      9.  
      10.         private BuildState(int order) {
      11.             this.order = order;
      12.         }
      13.  
      14.         public boolean isInitializing() {
      15.             return INITIALIZING.order == this.order;
      16.         }
      17.  
      18.         public boolean isConfigured() {
      19.             return this.order >= CONFIGURING.order;
      20.         }
      21.     }
       

      在AbstractConfiguredSecurityBuilder中与configurers相关的部分代码如下：
       

      1. public abstract class AbstractConfiguredSecurityBuilderextends SecurityBuilder> extends AbstractSecurityBuilder {
      2.  
      3.     private final LinkedHashMapextends SecurityConfigurer>, List>> configurers;
      4.     private final List> configurersAddedInInitializing;
      5.     private final Map, Object> sharedObjects;
      6.     private final boolean allowConfigurersOfSameType;
      7.     private BuildState buildState;
      8.     private ObjectPostProcessor objectPostProcessor;
      9.  
      10.     //向configures变量添加配置类，调用add方法
      11.     public extends SecurityConfigurerAdapter> C apply(C configurer) throws Exception {
      12.         configurer.addObjectPostProcessor(this.objectPostProcessor);
      13.         configurer.setBuilder(this);
      14.         this.add(configurer);
      15.         return configurer;
      16.     }
      17.  
      18.     public extends SecurityConfigurer> C apply(C configurer) throws Exception {
      19.         this.add(configurer);
      20.         return configurer;
      21.     }
      22.     
      23.     //将所有的配置类保存到configures中，默认情况下，allowConfigurersOfSameType为false，所以List集合中的
      24.     //配置类始终只有一个
      25.     private extends SecurityConfigurer> void add(C configurer) {
      26.         Assert.notNull(configurer, "configurer cannot be null");
      27.         Classextends SecurityConfigurer> clazz = configurer.getClass();
      28.         synchronized(this.configurers) {
      29.             if (this.buildState.isConfigured()) {
      30.                 throw new IllegalStateException("Cannot apply " + configurer + " to already built object");
      31.             } else {
      32.                 List> configs = null;
      33.                 if (this.allowConfigurersOfSameType) {
      34.                     configs = (List)this.configurers.get(clazz);
      35.                 }
      36.  
      37.                 List> configs = configs != null ? configs : new ArrayList(1);
      38.                 ((List)configs).add(configurer);
      39.                 this.configurers.put(clazz, configs);
      40.                 if (this.buildState.isInitializing()) {
      41.                     this.configurersAddedInInitializing.add(configurer);
      42.                 }
      43.             }
      44.         }
      45.     }
      46. }
        47.  

         在AbstractConfiguredSecurityBuilder中与构建相关的部分代码如下：
         

        1.     //一边更新状态，一边执行构建方法
        2.     protected final O doBuild() throws Exception {
        3.         synchronized(this.configurers) {
        4.             this.buildState = AbstractConfiguredSecurityBuilder.BuildState.INITIALIZING;
        5.             this.beforeInit();
        6.             this.init();
        7.             this.buildState = AbstractConfiguredSecurityBuilder.BuildState.CONFIGURING;
        8.             this.beforeConfigure();
        9.             this.configure();
        10.             this.buildState = AbstractConfiguredSecurityBuilder.BuildState.BUILDING;
        11.             O result = this.performBuild();
        12.             this.buildState = AbstractConfiguredSecurityBuilder.BuildState.BUILT;
        13.             return result;
        14.         }
        15.     }
        16.  
        17.     protected void beforeInit() throws Exception {
        18.     }
        19.  
        20.     protected void beforeConfigure() throws Exception {
        21.     }
        22.  
        23.     protected abstract O performBuild() throws Exception;
        24.  
        25.     //遍历所有配置类，并调用其init方法完成初始化操作
        26. 	private void init() throws Exception {
        27. 		Collection> configurers = getConfigurers();
        28. 		for (SecurityConfigurer configurer : configurers) {
        29. 			configurer.init((B) this);
        30. 		}
        31. 		for (SecurityConfigurer configurer : this.configurersAddedInInitializing) {
        32. 			configurer.init((B) this);
        33. 		}
        34. 	}
        35.  
        36.    	private void configure() throws Exception {
        37. 		Collection> configurers = getConfigurers();
        38. 		for (SecurityConfigurer configurer : configurers) {
        39. 			configurer.configure((B) this);
        40. 		}
        41. 	}
         

        4.4 ProviderManagerBuilder
         

        ProviderManagerBuilder通过范型指定构建对象为AuthenticationManager
         

        1. public interface ProviderManagerBuilderextends ProviderManagerBuilder>
        2. 		extends SecurityBuilder {
        3.  
        4. 	B authenticationProvider(AuthenticationProvider authenticationProvider);
        5. }
         

        4.5  AuthenticationManagerBuilder
         

        AuthenticationManagerBuilder用来构建AuthenticationManager对象，他继承自AbstractConfiguredSecurityBuilder，并且实现了ProviderManagerBuilder，部分代码如下
         

        1. public class AuthenticationManagerBuilder extends AbstractConfiguredSecurityBuilder implements ProviderManagerBuilder {
        2.  
        3.     private AuthenticationManager parentAuthenticationManager;
        4.     private List authenticationProviders = new ArrayList();
        5.     private UserDetailsService defaultUserDetailsService;
        6.     private Boolean eraseCredentials;
        7.     private AuthenticationEventPublisher eventPublisher;
        8.  
        9.     //表示允许相同类型的配置类同时存在
        10.     public AuthenticationManagerBuilder(ObjectPostProcessor objectPostProcessor) {
        11.         super(objectPostProcessor, true);
        12.     }
        13.  
        14.     public AuthenticationManagerBuilder parentAuthenticationManager(AuthenticationManager authenticationManager) {
        15.         if (authenticationManager instanceof ProviderManager) {
        16.             this.eraseCredentials(((ProviderManager)authenticationManager).isEraseCredentialsAfterAuthentication());
        17.         }
        18.  
        19.         this.parentAuthenticationManager = authenticationManager;
        20.         return this;
        21.     }
        22.  
        23.     public AuthenticationManagerBuilder eraseCredentials(boolean eraseCredentials) {
        24.         this.eraseCredentials = eraseCredentials;
        25.         return this;
        26.     }
        27.  
        28.     //配置基于内存的数据源，会创建一个InMemoryUserDetailsManagerConfigurer配置类，并最终
        29.     //将该配置类添加到父类的configurers变量中，由于设置了允许相同类型的配置类同时存在
        30.     //因此该方法可以被调用多次
        31.     public InMemoryUserDetailsManagerConfigurer inMemoryAuthentication() throws Exception {
        32.         return (InMemoryUserDetailsManagerConfigurer)this.apply(new InMemoryUserDetailsManagerConfigurer());
        33.     }
        34.  
        35.     public JdbcUserDetailsManagerConfigurer jdbcAuthentication() throws Exception {
        36.         return (JdbcUserDetailsManagerConfigurer)this.apply(new JdbcUserDetailsManagerConfigurer());
        37.     }
        38.  
        39.     public extends UserDetailsService> DaoAuthenticationConfigurer userDetailsService(T userDetailsService) throws Exception {
        40.         this.defaultUserDetailsService = userDetailsService;
        41.         return (DaoAuthenticationConfigurer)this.apply(new DaoAuthenticationConfigurer(userDetailsService));
        42.     }
        43.  
        44.     public AuthenticationManagerBuilder authenticationProvider(AuthenticationProvider authenticationProvider) {
        45.         this.authenticationProviders.add(authenticationProvider);
        46.         return this;
        47.     }
        48.  
        49.     //创建和配置AuthenticationManager的实现类ProviderManager
        50.     //ProviderManager创建成功后，会调用后置处理器处理一遍后再返回
        51.     protected ProviderManager performBuild() throws Exception {
        52.         if (!this.isConfigured()) {
        53.             this.logger.debug("No authenticationProviders and no parentAuthenticationManager defined. Returning null.");
        54.             return null;
        55.         } else {
        56.             ProviderManager providerManager = new ProviderManager(this.authenticationProviders, this.parentAuthenticationManager);
        57.             if (this.eraseCredentials != null) {
        58.                 providerManager.setEraseCredentialsAfterAuthentication(this.eraseCredentials);
        59.             }
        60.  
        61.             if (this.eventPublisher != null) {
        62.                 providerManager.setAuthenticationEventPublisher(this.eventPublisher);
        63.             }
        64.  
        65.             providerManager = (ProviderManager)this.postProcess(providerManager);
        66.             return providerManager;
        67.         }
        68.     }
        69.  
        70.     private extends UserDetailsAwareConfigurerextends UserDetailsService>> C apply(C configurer) throws Exception {
        71.         this.defaultUserDetailsService = configurer.getUserDetailsService();
        72.         return (UserDetailsAwareConfigurer)super.apply(configurer);
        73.     }
        74. }
          75.  

          4.6 HttpSecurity
           

          HttpSecurity的主要作用是用来构建一条过滤器链，也就是构建一个DefaultSecurityFilterChain对象。一个DefaultSecurityFilterChain对象包含一个路径匹配器和多个Spring Security过滤器，HttpSecurity中通过收集各种各样的xxxConfigurer，将Spring Security过滤器对应的配置类收集起来，并保存到父类AbstractConfiguredSecurityBuilder的configurers变量中。
           

          在后续的构建过程中，再将这些xxxConfigurer构建为具体的Spring Security过滤器，并添加到filters对象中。
          
                
                    
                

                
        75. 

                    相关阅读:
          
                    
python 图片爬虫记录                            
          
coreldraw2024版本有哪些新增功能？                            
          
html主页框架，前端首页通用架构，layui主页架构框架，首页框架模板                            
          
【无标题】                            
          
推荐 7 个本周 yyds 的开源项目                            
          
“遥遥领先”已被注册为商标，华为这次真的在行业里遥遥领先                            
          
WebSocket vs SSE: 实时数据推送到前端的选择与实现(详细)                            
          
将虚拟机VMware从C盘移动到E盘                            
          
webpack PostCSS工具                            
          
springcloudalibaba架构(7):Sentinel授权规则和系统规则                            
          
                              
                
          76. 
                
        76. 
                    原文地址：https://blog.csdn.net/qq_39385118/article/details/126230651
                
          77.