SpringSecurity 中默认的是表单登录格式，即用户在表单中输入用户名和密码进行登录，登录参数的提取是在 UsernamePasswordAuthenticationFilter 过滤器中完成的，UsernamePasswordAuthenticationFilter 是AbstractAuthenticationProcessingFilter 针对使用用户名和密码进行身份认证而定制化的一个过滤器。其添加是在调用http.formLogin() 时作用，默认的登录请求 pattern 为 “/login”，并且为 POST 请求。当我们登录的时候，也就是匹配到loginProcessingUrl，这个过滤器就会委托认证管理器 authenticationManager 来验证登录。
UsernamePasswordAuthenticationFilter 继承自 AbstractAuthenticationProcessingFilter
AbstractAuthenticationProcessingFilter 是一个抽象类，主要的功能是身份认证。OAuth2ClientAuthenticationProcessingFilter（Spriing OAuth2）、RememberMeAuthenticationFilter（RememberMe）都继承了 AbstractAuthenticationProcessingFilter ，并重写了方法 attemptAuthentication 进行身份认证。
AbstractAuthenticationProcessingFilter 源码：
public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean implements ApplicationEventPublisherAware, MessageSourceAware {
//事件发布管理器
protected ApplicationEventPublisher eventPublisher;
protected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
// 认证管理器，定义了SpringSecurity如何进行认证操作
// 认证成功后会返回一个Authentication对象，这个对象会被设置到SecurityContextHolder中
private AuthenticationManager authenticationManager;
protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
// 如果用户开启了类似“记住我”之类的免密码登录，RememberMeServices来进行管理。
private RememberMeServices rememberMeServices = new NullRememberMeServices();
// 请求匹配器，定义了match()方法，匹配请求HttpServletRequest是否符合定义的规则
private RequestMatcher requiresAuthenticationRequestMatcher;
private boolean continueChainBeforeSuccessfulAuthentication = false;
// 会话验证管理
private SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();
private boolean allowSessionCreation = true;
// 用户登录成功的后续处理
private AuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
// 用户登录失败的后续处理
private AuthenticationFailureHandler failureHandler = new SimpleUrlAuthenticationFailureHandler();
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)res;
// 判断是否需要认证
if (!this.requiresAuthentication(request, response)) {
// 如果不需要认证，继续执行下一个过滤器
chain.doFilter(request, response);
} else {
Authentication authResult;
try {
// 认证处理,该方法需要子类去重写
authResult = this.attemptAuthentication(request, response);
if (authResult == null) {
return;
}
// 身份认证成功，保存session
this.sessionStrategy.onAuthentication(authResult, request, response);
} catch (InternalAuthenticationServiceException var8) {
this.logger.error("An internal error occurred while trying to authenticate the user.", var8);
// 认证失败的处理逻辑
this.unsuccessfulAuthentication(request, response, var8);
return;
} catch (AuthenticationException var9) {
// 认证失败的处理逻辑
this.unsuccessfulAuthentication(request, response, var9);
return;
}
if (this.continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
// 认证成功的处理逻辑
this.successfulAuthentication(request, response, chain, authResult);
}
}
// 判断该filter是否需要处理该次请求，即请求的路径和该filter配置的要处理的url是否匹配
protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
return this.requiresAuthenticationRequestMatcher.matches(request);
}
// 这个方法的目的很明确，就是需要子类提供身份认证的具体实现。
// 子类根据 HttpServletRequest 等信息进行身份认证，并返回 Authentication 对象、 null、异常
// 分别表示认证成功返回的身份认证信息、需要其他 Filter 继续进行身份认证、认证失败。
public abstract Authentication attemptAuthentication(HttpServletRequest var1, HttpServletResponse var2) throws AuthenticationException, IOException, ServletException;
// 认证成功的处理逻辑
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
// 将认证成功的用户信息保存到 SecurityContextHolder
SecurityContextHolder.getContext().setAuthentication(authResult);
// 处理记住我逻辑
this.rememberMeServices.loginSuccess(request, response, authResult);
// 发布时间，即发布认证成功消息，供其他的bean接收和处理
if (this.eventPublisher != null) {
this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
}
// 认证成功后后续处理
this.successHandler.onAuthenticationSuccess(request, response, authResult);
}
// 认证失败的处理逻辑
protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
SecurityContextHolder.clearContext();
this.rememberMeServices.loginFail(request, response);
this.failureHandler.onAuthenticationFailure(request, response, failed);
}
}
1、页面输入用户名和密码；
2、登录请求被UsernamePasswordAuthenticationFilter过滤器拦截，开始进行登录认证；
3、UsernamePasswordAuthenticationFilter过滤器会获取用户表单输入的用户名和棉麻，并创建一个未认证的UsernamePasswordAuthenticationToken，然后调用认证管理器AuthenticationManager完成认证功能；
public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
// 表单提交的username的name属性值
private String usernameParameter = "username";
// 表单提交的password的name属性值
private String passwordParameter = "password";
private boolean postOnly = true;
public UsernamePasswordAuthenticationFilter() {
// 默认处理/login请求且为Post方式
super(new AntPathRequestMatcher("/login", "POST"));
}
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
if (this.postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
} else {
// 获取用户名
String username = this.obtainUsername(request);
//获取密码
String password = this.obtainPassword(request);
// 参数校验
if (username == null) {
username = "";
}
if (password == null) {
password = "";
}
username = username.trim();
// 将用户的用户名和密码封装成 UsernamePasswordAuthenticationToken
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
this.setDetails(request, authRequest);
// 使用AuthenticationManager认证管理器完成认证功能
return this.getAuthenticationManager().authenticate(authRequest);
}
}
// 从request中获取用户提交的密码
@Nullable
protected String obtainPassword(HttpServletRequest request) {
return request.getParameter(this.passwordParameter);
}
// 从request中获取用户提交的用户名
@Nullable
protected String obtainUsername(HttpServletRequest request) {
return request.getParameter(this.usernameParameter);
}
protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {
authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
}
}
4、AuthenticationManager不直接进行登录验证，而是使用DaoAuthenticationProvider进行验证，DaoAuthenticationProvider调用UserDetailsService（自定义）对象的loadUserByUsername方法获取用户信息，然后对获得的对象进行一系列的检查（自定义），包括预检查、附加检查、后检查。预检查检查用户是否被冻结、是否启用、是否过期。附加检查进行用户名密码验证。
public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
private static final String USER_NOT_FOUND_PASSWORD = "userNotFoundPassword";
private PasswordEncoder passwordEncoder;
private volatile String userNotFoundEncodedPassword;
private UserDetailsService userDetailsService;
private UserDetailsPasswordService userDetailsPasswordService;
public DaoAuthenticationProvider() {
this.setPasswordEncoder(PasswordEncoderFactories.createDelegatingPasswordEncoder());
}
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
if (authentication.getCredentials() == null) {
this.logger.debug("Authentication failed: no credentials provided");
throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
} else {
String presentedPassword = authentication.getCredentials().toString();
if (!this.passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
this.logger.debug("Authentication failed: password does not match stored value");
throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
}
}
}
protected void doAfterPropertiesSet() {
Assert.notNull(this.userDetailsService, "A UserDetailsService must be set");
}
protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
this.prepareTimingAttackProtection();
try {
UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
if (loadedUser == null) {
throw new InternalAuthenticationServiceException("UserDetailsService returned null, which is an interface contract violation");
} else {
return loadedUser;
}
} catch (UsernameNotFoundException var4) {
this.mitigateAgainstTimingAttack(authentication);
throw var4;
} catch (InternalAuthenticationServiceException var5) {
throw var5;
} catch (Exception var6) {
throw new InternalAuthenticationServiceException(var6.getMessage(), var6);
}
}
protected Authentication createSuccessAuthentication(Object principal, Authentication authentication, UserDetails user) {
boolean upgradeEncoding = this.userDetailsPasswordService != null && this.passwordEncoder.upgradeEncoding(user.getPassword());
if (upgradeEncoding) {
String presentedPassword = authentication.getCredentials().toString();
String newPassword = this.passwordEncoder.encode(presentedPassword);
user = this.userDetailsPasswordService.updatePassword(user, newPassword);
}
return super.createSuccessAuthentication(principal, authentication, user);
}
private void prepareTimingAttackProtection() {
if (this.userNotFoundEncodedPassword == null) {
this.userNotFoundEncodedPassword = this.passwordEncoder.encode("userNotFoundPassword");
}
}
private void mitigateAgainstTimingAttack(UsernamePasswordAuthenticationToken authentication) {
if (authentication.getCredentials() != null) {
String presentedPassword = authentication.getCredentials().toString();
this.passwordEncoder.matches(presentedPassword, this.userNotFoundEncodedPassword);
}
}
}
5、登陆成功后将验证过的用户信息存储在SecurityContext中，然后调用登录成功处理器（自定义）。
// 认证成功的处理逻辑
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
// 将认证成功的用户信息保存到 SecurityContextHolder
SecurityContextHolder.getContext().setAuthentication(authResult);
// 处理记住我逻辑
this.rememberMeServices.loginSuccess(request, response, authResult);
// 发布时间，即发布认证成功消息，供其他的bean接收和处理
if (this.eventPublisher != null) {
this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
}
// 认证成功后后续处理
this.successHandler.onAuthenticationSuccess(request, response, authResult);
}
在实际项目中，我们可能通过 json 格式来传递参数，这就需要我们自定义登录过滤器链来实现。登录参数的提取是在UsernamePasswordAuthenticationFilter过滤器中完成的，如果要使用 Json 格式登录，只要模仿UsernamePasswordAuthenticationFilter过滤器自定义自己的过滤器，再将自定义的额过滤器放到UsernamePasswordAuthenticationFilter过滤器所在的位置即可。
定义一个LoginFilter 继承自UsernamePasswordAuthenticationFilter：
public class LoginFilter extends UsernamePasswordAuthenticationFilter {
@Autowired
private ObjectMapper objectMapper;
@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
// 确保进入过滤器中的请求时Post请求
if(!request.getMethod().equals("POST")){
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
}
if(request.getContentType().equalsIgnoreCase(MediaType.APPLICATION_JSON_VALUE)
|| request.getContentType().equalsIgnoreCase(MediaType.APPLICATION_JSON_UTF8_VALUE)){
Map<String,String> userInfo = new HashMap<>();
try {
// 将输入流转为Map对象
userInfo = objectMapper.readValue(request.getInputStream(), Map.class);
String username = userInfo.get(getUsernameParameter());
String password = userInfo.get(getPasswordParameter());
// 从Map对象中分别提取用户名和密码
// 构造成UsernamePasswordAuthenticationToken对象
UsernamePasswordAuthenticationToken authRequest
= new UsernamePasswordAuthenticationToken(username,password);
setDetails(request,authRequest);
// 调用AuthenticationManager的 authticate()方法完成认证操作
return this.getAuthenticationManager().authenticate(authRequest);
} catch (IOException e) {
e.printStackTrace();
}
}
//如果不是json格式，那么按照父类的表单登录逻辑处理
return super.attemptAuthentication(request,response);
}
}
LoginFilter 定义完后，需要将其添加到SpringSecurity过滤器链中，代码如下：
@EnableWebSecurity(debug = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("zhansan")
.password("{noop}123")
.roles("admin");
}
@Override
@Bean
public AuthenticationManager authenticationManager() throws Exception {
return super.authenticationManagerBean();
}
@Bean
LoginFilter loginFilter() throws Exception {
LoginFilter loginFilter = new LoginFilter();
// 设置认证管理器
loginFilter.setAuthenticationManager(authenticationManagerBean());
// 自定义认证成功的处理逻辑，以json格式写回浏览器
loginFilter.setAuthenticationSuccessHandler(((httpServletRequest, httpServletResponse, authentication) -> {
httpServletResponse.setContentType("application/json;charset=utf-8");
PrintWriter writer = httpServletResponse.getWriter();
writer.write(new ObjectMapper().writeValueAsString(authentication));
}));
return loginFilter;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.anyRequest().authenticated()
.and()
.formLogin().loginProcessingUrl("/login").permitAll()
.and()
.csrf().disable();
// 将loginFilter过滤器添加到UsernamePasswordAuthenticationFilter过滤器所在的位置
http.addFilterAt(loginFilter(), UsernamePasswordAuthenticationFilter.class);
}
}
使用Postman测试 json 格式登录：
{"username":"zhangsan","password":"123"}