在介绍Spring Securiry之前，我们试想一下如果我们自己去实现一个安全框架，我们需要包含哪些功能：
- 我们需要对登录接口或者一些不需要权限的接口放行，同时我们需要对某些接口进行身份认证，例如：在基于jwt的认证体系中，我们需要校验token是否合法，token合法我们才会放行；
- 我们希望我们写的安全框架能够做一些授权的操作，比如：我们可以限制认证后的用户访问/user接口需要什么权限，访问/group接口又需要什么权限；
- 我们希望安全框架能够提供一个缓存，无论是TreadLocal、还是HttpServletRequest也罢，只要能够获取保存当前认证通过的用户信息即可；
试想一下，如果我们去实现这些功能，我们需要怎么做：
- 我们需要去拦截所有的HTTP请求，我们首先想到的实现方式就是filter、Spring AOP、Intercepter，这三者的实现方式和应用场景都不一样，这里我们不去细究采用哪种方式，但是我可以告诉你Spring Security是采用了一系列的filter实现的。
- 假设我们也是采用的filter实现，那么我们是不是也要实现一个白名单啊，比如放行/login接口啊，然后剩下的接口，就要走认证流程；
- 认证完之后，我们怎么做授权呢，我们可以这么做，我们先获取当前登录用户所拥有的权限，比如某某用户对接口资源user具有添加权限，采用这种格式：interface:user:add，我们将若干个这种格式的权限放到一个list，然后放到缓存中
[
"interface:user:add",
"nterface:group:delete",
...
]
- 然后我们干一件什么事呢，我们搞个@PreAuthorize注解，然后在搞个注解处理器，注解处理器可以使用Spring AOP去实现。这个注解怎么用呢，我们可以将这个注解加载UserController /user/add接口上：
@PostMapping("/user/add")
@PreAuthorize("interface:user:add")
public NgspResponseEntity<User> insertUser(...)
- 如果用户去访问/user/add接口，我们就去缓存中拉取用户的权限列表，然后去校验用户是否具有访问这个接口的权限，如果有那么我们就放行。
当然了上面只是一个简单的实现，Spring Security的实现那是太太太复杂了，他为了满足各种需求，允许我们自己去配置各种过滤器，功能是强大了，但是学习起来还是比较困难的。
下面我将带领大家来学习Spring Security框架，Spring Security是一款基于Spring的安全框架，主要包含认证和授权两大安全模块，和另外一款流行的安全框架Apache Shiro相比，它拥有更为强大的功能。Spring Security也可以轻松的自定义扩展以满足各种需求，并且对常见的Web安全攻击提供了防护支持。如果你的Web框架选择的是Spring，那么在安全方面Spring Security会是一个不错的选择。
一、开启Spring Security
1、导入依赖
创建一个Spring Boot项目springboot-springsecurity，然后引入spring-boot-starter-security：
<!-- Spring Security的maven依赖 -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
2、创建Controller
新建包com.goldwind.controller，接下来我们创建一个TestController，对外提供一个/hello服务：
package com.goldwind.controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
/**
* @Author: zy
* @Description: 测试
* @Date: 2020-2-9
*/
@RestController
public class TestController {
@GetMapping("hello")
public String hello() {
return "hello spring security";
}
}
3、新建App入口
新建入口程序App.java：
package com.goldwind;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
/**
* @Author: zy
* @Description: 启动程序
* @Date: 2020-2-9
*/
@SpringBootApplication
public class App {
public static void main(String[] args){
SpringApplication.run(App.class,args);
}
}
这时候我们直接启动项目，访问http://localhost:8080/hello，可看到页面弹出了个formLogin认证框：
这个配置开启了一个form Login类型的认证，所有服务的访问都必须先过这个认证，默认的用户名为user，密码由Sping Security自动生成，回到IDE的控制台，可以找到密码信息：
Using generated security password: a77c9456-901e-4848-a221-3822347e52ea
输入用户名user，密码a77c9456-901e-4848-a221-3822347e52ea后，我们便可以成功访问/hello接口。
二、基于HTTP basic类型的认证
我们可以通过一些配置将表单认证修改为基于HTTP Basic的认证方式。
1、配置Spring Security
创建包com.goldwind.config，创建一个配置类WebSecurityConfig继承org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter这个抽象类并重写configure(HttpSecurity http)方法。WebSecurityConfigurerAdapter是由Spring Security提供的Web应用安全配置的适配器：
package com.goldwind.config;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
/**
* @Author: zy
* @Description: spring security配置类
* @Date: 2020-2-9
*/
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
/**
* 配置拦截请求资源
* @param http：HTTP请求安全处理
* @throws Exception
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
http.httpBasic() //HTTP Basic认证方式
.and()
.authorizeRequests() // 授权配置
.anyRequest() // 所有请求
.authenticated(); // 都需要认证
}
}
Spring Security提供了这种链式的方法调用。上面配置指定了认证方式为HTTP Basic登录，并且所有请求都需要进行认证。
这里有一点需要注意，我没并没有在Spring Security配置类上使用@EnableWebSecurity注解。这是因为在非Spring Boot的Spring Web MVC应用中，注解@EnableWebSecurity需要开发人员自己引入以启用Web安全。而在基于Spring Boot的Spring Web MVC应用中,开发人员没有必要再次引用该注解，Spring Boot的自动配置机制WebSecurityEnablerConfiguration已经引入了该注解，如下所示：
package org.springframework.boot.autoconfigure.security.servlet;
// 省略 imports 行
@Configuration
// 仅在存在 WebSecurityConfigurerAdapter bean 时该注解才有可能生效
// (最终生效与否要结合其他条件综合考虑)
@ConditionalOnBean(WebSecurityConfigurerAdapter.class)
// 仅在不存在 springSecurityFilterChain 时该注解才有可能生效
// (最终生效与否要结合其他条件综合考虑)
@ConditionalOnMissingBean(name = BeanIds.SPRING_SECURITY_FILTER_CHAIN)
// 仅在 Servlet 环境下该注解才有可能生效
// (最终生效与否要结合其他条件综合考虑)
@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET)
@EnableWebSecurity // <====== 这里启用了 Web 安全
public class WebSecurityEnablerConfiguration {
}
实际上，一个Spring Web应用中,WebSecurityConfigurerAdapter可能有多个 , @EnableWebSecurity可以不用在任何一个WebSecurityConfigurerAdapter上，可以用在每个WebSecurityConfigurerAdapter上，也可以只用在某一个WebSecurityConfigurerAdapter上。多处使用@EnableWebSecurity注解并不会导致问题，其最终运行时效果跟使用@EnableWebSecurity一次效果是一样的。
这时候我们重启项目，再次访问http://localhost:8080/hello，可以看到认证方式已经是HTTP Basic的方式了：
用户名依旧是user，密码由Spring Security自动生成，如果需要换回表单的认证方式，我们只需要简单修改configure方法中的配置：
@Override
protected void configure(HttpSecurity http) throws Exception {
// http.formLogin() // 表单方式
http.httpBasic() // HTTP Basic方式
.and()
.authorizeRequests() // 授权配置
.anyRequest() // 所有请求
.authenticated(); // 都需要认证
}
三、Spring Security基本原理
上面我们开启了一个最简单的Spring Security安全配置，下面我们来了解下Spring Security的基本原理。通过上面的的配置。
1、基本原理
Spring Security所解决的问题就是安全访问控制，而安全访问控制功能其实就是对所有进入系统的请求进行拦截， 校验每个请求是否能够访问它所期望的资源。而Spring Security对Web资源的保护是靠Filter实现的。当初始化Spring Security时，WebSecurityConfiguration会创建一个名为 springSecurityFilterChain 的Servlet过滤器，类型为org.springframework.security.web.FilterChainProxy，它实现了javax.servlet.Filter，因此外部的请求会经过此类。
FilterChainProxy是一个代理，真正起作用的是FilterChainProxy中SecurityFilterChain所包含的各个Filter，下图为实际调试中创建的FilterChainProxy实例。
这些Filter作为Bean被Spring管理，它们是Spring Security核心，各有各的职责，但他们并不直接处理用户的认 证，也不直接处理用户的授权，而是把它们交给了认证管理器（AuthenticationManager）和决策管理器 （AccessDecisionManager）进行处理。 Spring Security功能的实现主要是由一系列过滤器链相互配合完成，如下图（只是挑选了一些重要的Filter进行讲解）：
下面介绍几个重要的过滤器：
- UsernamePasswordAuthenticationFilter过滤器用于处理基于表单方式的登录验证，该过滤器默认只有当请求方法为post、请求页面为/login时过滤器才生效，如果想修改默认拦截url，只需在刚才介绍的Spring Security配置类WebSecurityConfig中配置该过滤器的拦截url：.loginProcessingUrl("url")即可;
- BasicAuthenticationFilter用于处理基于HTTP Basic方式的登录验证，当通过HTTP Basic方式登录时，默认会发送post请求/login，并且在请求头携带Authorization:Basic dXNlcjoxOWEyYWIzOC1kMjBiLTQ0MTQtOTNlOC03OThkNjc2ZTZlZDM=信息，该信息是登录用户名、密码加密后的信息，然后由BasicAuthenticationFilter过滤器解析后，构建UsernamePasswordAuthenticationFilter过滤器进行认证；如果请求头没有Authorization信息，BasicAuthenticationFilter过滤器则直接放行；
- FilterSecurityInterceptor的拦截器，用于判断当前请求身份认证是否成功，是否有相应的权限，当身份认证失败或者权限不足的时候便会抛出相应的异常；
- ExceptionTranslateFilter捕获并处理，所以我们在ExceptionTranslateFilter过滤器用于处理了FilterSecurityInterceptor抛出的异常并进行处理，比如需要身份认证时将请求重定向到相应的认证页面，当认证失败或者权限不足时返回相应的提示信息；
2、认证流程
以表单方式登录验证为例，认证流程如下：
- 用户提交用户名、密码被SecurityFilterChain中的 UsernamePasswordAuthenticationFilter 过滤器获取到， 封装为请求Authentication，通常情况下是UsernamePasswordAuthenticationToken这个实现类。
- 然后过滤器将Authentication提交至认证管理器（AuthenticationManager）进行认证 。
- 认证成功后， AuthenticationManager 身份管理器返回一个被填充满了信息的（包括上面提到的权限信息， 身份信息，细节信息，但密码通常会被移除） Authentication 实例。
- SecurityContextHolder 安全上下文容器将第3步填充了信息的 Authentication ，通过 SecurityContextHolder.getContext().setAuthentication(…)方法，设置到其中。 可以看出AuthenticationManager接口（认证管理器）是认证相关的核心接口，也是发起认证的出发点，它的实现类为ProviderManager。而Spring Security支持多种认证方式，因此ProviderManager维护着一个 List 列表，存放多种认证方式，最终实际的认证工作是由 AuthenticationProvider完成的。其中web表单的对应的AuthenticationProvider实现类为 DaoAuthenticationProvider，它的内部又维护着一个UserDetailsService负责UserDetails的获取。最终 AuthenticationProvider将UserDetails填充至Authentication。
3、授权策略
Spring Security可以通过 http.authorizeRequests() 对web请求进行授权保护。Spring Security使用标准Filter建立了对web请求的拦截，最终实现对资源的授权访问。授权流程如下：
四、Spring Security filter的构造和初始化
我们已经知道Spring Security通过构造层层filter来实现登录跳转、权限验证，角色管理等功能。这里我们将通过剖析Spring Security的核心源码来说明Spring Security的filter是如何开始构造的，下面的讲解比较长，如果你不是特别感兴趣，可以直接跳到总结，总结粗略了叙述了Spring Security框架filters的构建过程。我们可以下载Spring Security源码；
1、@EnableWebSecurity
我们知道要想启动Spring Security，必须配置注解@EnableWebSecurity，我们就从该注解说起：
@Retention(value = java.lang.annotation.RetentionPolicy.RUNTIME)
@Target(value = { java.lang.annotation.ElementType.TYPE })
@Documented
@Import({ WebSecurityConfiguration.class,
SpringWebMvcImportSelector.class,
OAuth2ImportSelector.class })
@EnableGlobalAuthentication
@Configuration
public @interface EnableWebSecurity {
/**
* Controls debugging support for Spring Security. Default is false.
* @return if true, enables debug support with Spring Security
*/
boolean debug() default false;
}
2、WebSecurityConfiguration类
我们可以看到该注解导入了WebSecurityConfiguration类，进入该类查看：
/*
* Copyright 2002-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.config.annotation.web.configuration;
import java.util.List;
import java.util.Map;
import javax.servlet.Filter;
import org.springframework.beans.factory.BeanClassLoaderAware;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.beans.factory.config.BeanFactoryPostProcessor;
import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;
import org.springframework.context.annotation.ImportAware;
import org.springframework.core.OrderComparator;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.AnnotationAttributes;
import org.springframework.core.annotation.AnnotationUtils;
import org.springframework.core.annotation.Order;
import org.springframework.core.type.AnnotationMetadata;
import org.springframework.security.access.expression.SecurityExpressionHandler;
import org.springframework.security.config.annotation.ObjectPostProcessor;
import org.springframework.security.config.annotation.SecurityConfigurer;
import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.crypto.RsaKeyConversionServicePostProcessor;
import org.springframework.security.context.DelegatingApplicationListener;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
/**
* Uses a {@link WebSecurity} to create the {@link FilterChainProxy} that performs the web
* based security for Spring Security. It then exports the necessary beans. Customizations
* can be made to {@link WebSecurity} by extending {@link WebSecurityConfigurerAdapter}
* and exposing it as a {@link Configuration} or implementing
* {@link WebSecurityConfigurer} and exposing it as a {@link Configuration}. This
* configuration is imported when using {@link EnableWebSecurity}.
*
* @see EnableWebSecurity
* @see WebSecurity
*
* @author Rob Winch
* @author Keesun Baik
* @since 3.2
*/
@Configuration(proxyBeanMethods = false)
public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
private WebSecurity webSecurity;
private Boolean debugEnabled;
private List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers;
private ClassLoader beanClassLoader;
@Autowired(required = false)
private ObjectPostProcessor<Object> objectObjectPostProcessor;
@Bean
public static DelegatingApplicationListener delegatingApplicationListener() {
return new DelegatingApplicationListener();
}
@Bean
@DependsOn(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
public SecurityExpressionHandler<FilterInvocation> webSecurityExpressionHandler() {
return webSecurity.getExpressionHandler();
}
/**
* Creates the Spring Security Filter Chain
* @return the {@link Filter} that represents the security filter chain
* @throws Exception
*/
@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
public Filter springSecurityFilterChain() throws Exception {
boolean hasConfigurers = webSecurityConfigurers != null
&& !webSecurityConfigurers.isEmpty();
if (!hasConfigurers) {
WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor
.postProcess(new WebSecurityConfigurerAdapter() {
});
webSecurity.apply(adapter);
}
return webSecurity.build();
}
/**
* Creates the {@link WebInvocationPrivilegeEvaluator} that is necessary for the JSP
* tag support.
* @return the {@link WebInvocationPrivilegeEvaluator}
*/
@Bean
@DependsOn(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
public WebInvocationPrivilegeEvaluator privilegeEvaluator() {
return webSecurity.getPrivilegeEvaluator();
}
/**
* Sets the {@code <SecurityConfigurer<FilterChainProxy, WebSecurityBuilder>}
* instances used to create the web configuration.
*
* @param objectPostProcessor the {@link ObjectPostProcessor} used to create a
* {@link WebSecurity} instance
* @param webSecurityConfigurers the
* {@code <SecurityConfigurer<FilterChainProxy, WebSecurityBuilder>} instances used to
* create the web configuration
* @throws Exception
*/
@Autowired(required = false)
public void setFilterChainProxySecurityConfigurer(
ObjectPostProcessor<Object> objectPostProcessor,
@Value("#{@autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()}") List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers)
throws Exception {
webSecurity = objectPostProcessor
.postProcess(new WebSecurity(objectPostProcessor));
if (debugEnabled != null) {
webSecurity.debug(debugEnabled);
}
webSecurityConfigurers.sort(AnnotationAwareOrderComparator.INSTANCE);
Integer previousOrder = null;
Object previousConfig = null;
for (SecurityConfigurer<Filter, WebSecurity> config : webSecurityConfigurers) {
Integer order = AnnotationAwareOrderComparator.lookupOrder(config);
if (previousOrder != null && previousOrder.equals(order)) {
throw new IllegalStateException(
"@Order on WebSecurityConfigurers must be unique. Order of "
+ order + " was already used on " + previousConfig + ", so it cannot be used on "
+ config + " too.");
}
previousOrder = order;
previousConfig = config;
}
for (SecurityConfigurer<Filter, WebSecurity> webSecurityConfigurer : webSecurityConfigurers) {
webSecurity.apply(webSecurityConfigurer);
}
this.webSecurityConfigurers = webSecurityConfigurers;
}
@Bean
public static BeanFactoryPostProcessor conversionServicePostProcessor() {
return new RsaKeyConversionServicePostProcessor();
}
@Bean
public static AutowiredWebSecurityConfigurersIgnoreParents autowiredWebSecurityConfigurersIgnoreParents(
ConfigurableListableBeanFactory beanFactory) {
return new AutowiredWebSecurityConfigurersIgnoreParents(beanFactory);
}
/**
* A custom verision of the Spring provided AnnotationAwareOrderComparator that uses
* {@link AnnotationUtils#findAnnotation(Class, Class)} to look on super class
* instances for the {@link Order} annotation.
*
* @author Rob Winch
* @since 3.2
*/
private static class AnnotationAwareOrderComparator extends OrderComparator {
private static final AnnotationAwareOrderComparator INSTANCE = new AnnotationAwareOrderComparator();
@Override
protected int getOrder(Object obj) {
return lookupOrder(obj);
}
private static int lookupOrder(Object obj) {
if (obj instanceof Ordered) {
return ((Ordered) obj).getOrder();
}
if (obj != null) {
Class<?> clazz = (obj instanceof Class ? (Class<?>) obj : obj.getClass());
Order order = AnnotationUtils.findAnnotation(clazz, Order.class);
if (order != null) {
return order.value();
}
}
return Ordered.LOWEST_PRECEDENCE;
}
}
/*
* (non-Javadoc)
*
* @see org.springframework.context.annotation.ImportAware#setImportMetadata(org.
* springframework.core.type.AnnotationMetadata)
*/
public void setImportMetadata(AnnotationMetadata importMetadata) {
Map<String, Object> enableWebSecurityAttrMap = importMetadata
.getAnnotationAttributes(EnableWebSecurity.class.getName());
AnnotationAttributes enableWebSecurityAttrs = AnnotationAttributes
.fromMap(enableWebSecurityAttrMap);
debugEnabled = enableWebSecurityAttrs.getBoolean("debug");
if (webSecurity != null) {
webSecurity.debug(debugEnabled);
}
}
/*
* (non-Javadoc)
*
* @see
* org.springframework.beans.factory.BeanClassLoaderAware#setBeanClassLoader(java.
* lang.ClassLoader)
*/
public void setBeanClassLoader(ClassLoader classLoader) {
this.beanClassLoader = classLoader;
}
}
如果我们忽略掉细节，只看最重要的步骤，该类主要实现了如下功能：
WebSecurityConfiguration类是作为一个Spring配置源，同时定义了许多bean，这里重点看WebSecurityConfiguration#setFilterChainProxySecurityConfigurer这个方法：
/**
* Sets the {@code <SecurityConfigurer<FilterChainProxy, WebSecurityBuilder>}
* instances used to create the web configuration.
*
* @param objectPostProcessor the {@link ObjectPostProcessor} used to create a
* {@link WebSecurity} instance
* @param webSecurityConfigurers the
* {@code <SecurityConfigurer<FilterChainProxy, WebSecurityBuilder>} instances used to
* create the web configuration
* @throws Exception
*/
@Autowired(required = false)
public void setFilterChainProxySecurityConfigurer(
ObjectPostProcessor<Object> objectPostProcessor,
@Value("#{@autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()}") List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers)
throws Exception {
webSecurity = objectPostProcessor
.postProcess(new WebSecurity(objectPostProcessor));
if (debugEnabled != null) {
webSecurity.debug(debugEnabled);
}
webSecurityConfigurers.sort(AnnotationAwareOrderComparator.INSTANCE);
Integer previousOrder = null;
Object previousConfig = null;
for (SecurityConfigurer<Filter, WebSecurity> config : webSecurityConfigurers) {
Integer order = AnnotationAwareOrderComparator.lookupOrder(config);
if (previousOrder != null && previousOrder.equals(order)) {
throw new IllegalStateException(
"@Order on WebSecurityConfigurers must be unique. Order of "
+ order + " was already used on " + previousConfig + ", so it cannot be used on "
+ config + " too.");
}
previousOrder = order;
previousConfig = config;
}
for (SecurityConfigurer<Filter, WebSecurity> webSecurityConfigurer : webSecurityConfigurers) {
webSecurity.apply(webSecurityConfigurer);
}
this.webSecurityConfigurers = webSecurityConfigurers;
}
下面我们对每一个步骤来做相应的源代码解释，首先我们来看一下方法得第二个参数：
@Value("#{@autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()}"
可以看一下autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()的源代码：
public List<SecurityConfigurer<Filter, WebSecurity>> getWebSecurityConfigurers() {
List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers = new ArrayList<SecurityConfigurer<Filter, WebSecurity>>();
Map<String, WebSecurityConfigurer> beansOfType = beanFactory
.getBeansOfType(WebSecurityConfigurer.class);
for (Entry<String, WebSecurityConfigurer> entry : beansOfType.entrySet()) {
webSecurityConfigurers.add(entry.getValue());
}
return webSecurityConfigurers;
}
我们如果调试代码，可以发现beanFactory.getBeansOfType从Spring容器获取类型为WebSecurityConfigurer的bean，在这里也就是获取到我们编写的WebSecurityConfig配置类：
我们可以看一下WebSecurityConfig类的类图：
然后直接用new 来创建一个WebSecurity的对象，用来初始化了WebSecurityConfiguration#webSecurity属性；
webSecurity = objectPostProcessor
.postProcess(new WebSecurity(objectPostProcessor));
if (debugEnabled != null) {
webSecurity.debug(debugEnabled);
}
当有多个配置项时进行排序，进行order重复验证：
webSecurityConfigurers.sort(AnnotationAwareOrderComparator.INSTANCE);
Integer previousOrder = null;
Object previousConfig = null;
for (SecurityConfigurer<Filter, WebSecurity> config : webSecurityConfigurers) {
Integer order = AnnotationAwareOrderComparator.lookupOrder(config);
if (previousOrder != null && previousOrder.equals(order)) {
throw new IllegalStateException(
"@Order on WebSecurityConfigurers must be unique. Order of "
+ order + " was already used on " + previousConfig + ", so it cannot be used on "
+ config + " too.");
}
previousOrder = order;
previousConfig = config;
}
遍历WebSecurityConfiguration#webSecurityConfigurers集合，调用webSecurity的apply方法，此时也会将我们自定义的WebSecurityConfig应用到 webSecurity.apply方法上：
for (SecurityConfigurer<Filter, WebSecurity> webSecurityConfigurer : webSecurityConfigurers) {
webSecurity.apply(webSecurityConfigurer);
}
最后，初始化WebSecurityConfiguration#webSecurityConfigurers属性：
this.webSecurityConfigurers = webSecurityConfigurers;
3、WebSecurity类
到这里我们知道了WebSecurityConfiguration类调用上述方法将我们配置的WebSecurityConfig类用WebSecurity类的apply方法关联起来，那么我们详细看看WebSecurity类的apply方法：
public <C extends SecurityConfigurer<O, B>> C apply(C configurer) throws Exception {
add(configurer);
return configurer;
}
private <C extends SecurityConfigurer<O, B>> void add(C configurer) {
Assert.notNull(configurer, "configurer cannot be null");
Class<? extends SecurityConfigurer<O, B>> clazz = (Class<? extends SecurityConfigurer<O, B>>) configurer
.getClass();
synchronized (configurers) {
if (buildState.isConfigured()) {
throw new IllegalStateException("Cannot apply " + configurer
+ " to already built object");
}
List<SecurityConfigurer<O, B>> configs = allowConfigurersOfSameType ? this.configurers
.get(clazz) : null;
if (configs == null) {
configs = new ArrayList<>(1);
}
configs.add(configurer);
this.configurers.put(clazz, configs);
if (buildState.isInitializing()) {
this.configurersAddedInInitializing.add(configurer);
}
}
}
从上述代码可知，实际上就是将我们定义的WebSecurityConfig配置类放入了WebSecurity类的一个LinkedHashMap中：
该LinkedHashMap在WebSecurity中属性名为configurers：
private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers = new LinkedHashMap<>();
可以看到键就是我们定义的配置类的Clazz类型，而值是List<SecurityConfigurer<Filter, WebSecurity>>类型，是一个list集合，其中只有一个元素，就是我们编写的WebSecurityConfig配置类；
我们继续回到WebSecurityConfiguration类，查看它的另外一个重要的方法：
build的方法来自于WebSecurity的父类AbstractSecurityBuilder，该方法即为Spring Security构建Filter的核心方法，通过webSecurity的build方法构建了Spring Security的Filter：
实际上调用了父类AbstractConfiguredSecurityBuilder的doBuild：
protected final O doBuild() throws Exception {
synchronized (configurers) {
buildState = BuildState.INITIALIZING;
beforeInit();
init();
buildState = BuildState.CONFIGURING;
beforeConfigure();
configure();
buildState = BuildState.BUILDING;
O result = performBuild();
buildState = BuildState.BUILT;
return result;
}
}
这里主要看AbstractConfiguredSecurityBuilder的init方法和WebSecurity实现的performBuild方法,首先看init方法，init方法将会遍历WebSecurity的LinkHashMap configurers中每个元素configurer，执行以下步骤：
调用configurer的init方法，init该方法来自父类WebSecurityConfigurerAdapter（这里的this指定就是WebSecurity）：
init方法中又会调用WebSecurityConfigurerAdapter#getHttp方法：
getHttp方法首先创建一个HttpSecurity对象，用来初始化configurer的http成员：
private HttpSecurity http;
又调用 configure 方法，最终将会执行我们在WebSecurityConfig写的configure方法：
configurer中的init方法执行完之后，WebSecurity调用addSecurityFilterChainBuilder方法将configurer创建的HttpSecurity放入了WebSecurity的一个list集合里，该list集合属性名为securityFilterChainBuilders：
public WebSecurity addSecurityFilterChainBuilder(SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder) {
this.securityFilterChainBuilders.add(securityFilterChainBuilder);
return this;
}
到目前为止，我们终于知道我们编写的WebSecurityConfig类的configure方法是如何被调用的了，但是仍有许多疑问没解开，比如HttpSecurity类的作用，Spring Security是如何通过HttpSecurity类构建一条拦截器链等。
这里我们先不分析HttpSecurity类的具体实现，再来看看WebSecurity的init方法执行后所执行的performBuild方法，该方法源码如下：
@Override
protected Filter performBuild() throws Exception {
Assert.state(
!securityFilterChainBuilders.isEmpty(),
() -> "At least one SecurityBuilder<? extends SecurityFilterChain> needs to be specified. "
+ "Typically this done by adding a @Configuration that extends WebSecurityConfigurerAdapter. "
+ "More advanced users can invoke "
+ WebSecurity.class.getSimpleName()
+ ".addSecurityFilterChainBuilder directly");
int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();
List<SecurityFilterChain> securityFilterChains = new ArrayList<>(
chainSize);
for (RequestMatcher ignoredRequest : ignoredRequests) {
securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));
}
for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : securityFilterChainBuilders) {
securityFilterChains.add(securityFilterChainBuilder.build());
}
FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
if (httpFirewall != null) {
filterChainProxy.setFirewall(httpFirewall);
}
filterChainProxy.afterPropertiesSet();
Filter result = filterChainProxy;
if (debugEnabled) {
logger.warn("\n\n"
+ "********************************************************************\n"
+ "********** Security debugging is enabled. *************\n"
+ "********** This may include sensitive information. *************\n"
+ "********** Do not use in a production system! *************\n"
+ "********************************************************************\n\n");
result = new DebugFilter(filterChainProxy);
}
postBuildAction.run();
return result;
}
该方法执行的操作主要如下：
(1)、遍历WebSecurity的securityFilterChainBuilders列表，一般也就一个元素，也就是我们的WebSecurityConfig配置类创建的HttpSecurity对象，并执行该对象的build方法，初始化成员属性filters，并通过filters集合构建SecurityFilterChain类；
然后将每个HttpSecurity对象构建的SecurityFilterChain对象添加到securityFilterChains列表中。
(2)、将List<SecurityFilterChain>集合构建成一个FilterChainProxy代理类，返回这个FilterChainProxy代理类；
到这里总的过程就非常明了，WebSecurityConfiguration的springSecurityFilterChain方法最终返回了一个FilterChainProxy代理类，作为Spring Security的顶层filter，而HttpSecurity主要用于注册和实例化各种filter，HttpSecurity类有个属性名为filters的List列表专门用于保存过滤器的。
到这里就分成了两路：
- 一路是HttpSecurity的build方法构建SecurityFilterChain类的原理；
- 一路是FilterChainProxy类的作用；
FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
我们先从FilterChainProxy类开始。
4、FilterChainProxy类
当请求到达的时候，FilterChainProxy会调用dofilter方法，会遍历所有的SecurityFilterChain，对匹配到的url，则调用SecurityFilterChain中的每一个filter做认证授权。FilterChainProxy的dofilter()中调用了doFilterInternal方法，如下：
private List<SecurityFilterChain> filterChains;
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;
if (clearContext) {
try {
request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
doFilterInternal(request, response, chain);
}
finally {
SecurityContextHolder.clearContext();
request.removeAttribute(FILTER_APPLIED);
}
}
else {
doFilterInternal(request, response, chain);
}
}
private void doFilterInternal(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
FirewalledRequest fwRequest = firewall
.getFirewalledRequest((HttpServletRequest) request);
HttpServletResponse fwResponse = firewall
.getFirewalledResponse((HttpServletResponse) response);
List<Filter> filters = getFilters(fwRequest);
if (filters == null || filters.size() == 0) {
if (logger.isDebugEnabled()) {
logger.debug(UrlUtils.buildRequestUrl(fwRequest)
+ (filters == null ? " has no matching filters"
: " has an empty filter list"));
}
fwRequest.reset();
chain.doFilter(fwRequest, fwResponse);
return;
}
VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters);
vfc.doFilter(fwRequest, fwResponse);
}
这里我就不贴VirtualFilterChain的源码了，实际上就是先去遍历执行我们filters中的过滤器的doFilter，最后再去执行chiin.doFilter。
我们理清了FilterChainProxy类的作用，那么这些SecurityFilterChain是从哪来的呢？从上节可知SecurityFilterChain是由HttpSecurity的build方法生成的，下面我们分析下HttpSecurity类。
5、HttpSecurity类
HttpSecurity与WebSecurity一样，都继承了AbstractConfiguredSecurityBuilder类，而WebSecurity的build和doBuild方法和LinkedHashMap属性，均来自AbstractConfiguredSecurityBuilder，故HttpSecurity的build方法代码与WebSecurity的相同，区别在于LinkedHashMap存储的东西不同：
(1)、WebSecurityConfig类的configure方法
在之前我们已经介绍了WebSecurity的doBuild是如何调用我们自己写的配置类WebSecurityConfig的configure方法；在该方法中http所调用的方法，最终的结果就是产生url-filter的关系映射：
protected void configure(HttpSecurity http) throws Exception {
http.formLogin() //HTTP Basic认证方式
.and()
.authorizeRequests() // 授权配置
.anyRequest() // 所有请求
.authenticated(); // 都需要认证
}
比如authorizeRequests()，formLogin()方法分别返回ExpressionUrlAuthorizationConfigurer和FormLoginConfigurer，他们都是SecurityConfigurer接口的实现类，分别代表的是不同类型的安全配置器。而这些安全配置器分别对应一个或多个filter：
- formLogin对应UsernamePasswordAuthenticationFilter，此外我们还可以给安全过滤器FormLoginConfigurer指定其它参数，比如.login("/login")：自定义登录请求页面；.loginProcessingUrl("/login")指定UsernamePasswordAuthenticationFilter拦截的Form action；
.and()
.formLogin() // 或者httpBasic()
.loginPage("/login") // 指定登录页的路径
.loginProcessingUrl("/login") // 指定自定义form表单提交请求的路径
- authorizeRequests对应FilterSecurityInterceptor；
public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests()
throws Exception {
ApplicationContext context = getContext();
return getOrApply(new ExpressionUrlAuthorizationConfigurer<>(context))
.getRegistry();
}
public FormLoginConfigurer<HttpSecurity> formLogin() throws Exception {
return getOrApply(new FormLoginConfigurer<>());
}
都调用了getOrApply方法，再来看getOrApply方法，又调用了其中的apply方法:
private <C extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSecurity>> C getOrApply(
C configurer) throws Exception {
C existingConfig = (C) getConfigurer(configurer.getClass());
if (existingConfig != null) {
return existingConfig;
}
return apply(configurer);
}
apply方法又调用了add方法，这里的add方法最终还是将该configurer加入了LinkedHashMap中:
private <C extends SecurityConfigurer<O, B>> void add(C configurer) {
Assert.notNull(configurer, "configurer cannot be null");
Class<? extends SecurityConfigurer<O, B>> clazz = (Class<? extends SecurityConfigurer<O, B>>) configurer
.getClass();
synchronized (configurers) {
if (buildState.isConfigured()) {
throw new IllegalStateException("Cannot apply " + configurer
+ " to already built object");
}
List<SecurityConfigurer<O, B>> configs = allowConfigurersOfSameType ? this.configurers
.get(clazz) : null;
if (configs == null) {
configs = new ArrayList<>(1);
}
configs.add(configurer);
this.configurers.put(clazz, configs);
if (buildState.isInitializing()) {
this.configurersAddedInInitializing.add(configurer);
}
}
}
故HttpSecurity在构建filter的过程中，本质还是将形如ExpressionUrlAuthorizationConfigurer、FormLoginConfigurer等类加入了它的LinkedHashMap中，该list集合属性名为configurers ：
private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers = new LinkedHashMap<>();
这里有一点需要注意，
- 在HttpSecurity的configurers列表中存放的元素都是继承自SecurityConfigurerAdapter类，Spring Security框架提供的不同类型的安全配置器主要有以下这些；
- 而在WebSecurity的configurers列表中存放的元素都是继承自WebSecurityConfigurerAdapter类，也就是我们写的配置类：
啥时候我们会使用到SecurityConfigurerAdapter类，在后面我们介绍手机验证码登录的时候会有一个案例：
如果想使得这个配置生效，我们只需要在WebSecurityConfig配置类的configure方法添加如下代码：
.apply(smsAuthenticationConfig); // 将短信验证码认证配置加到 Spring Security 中 添加一个安全配置其到http的configurers集合
调用http的apply方法，最终将该smsAuthenticationConfig加入了HttpSecurity的configurers列表中。
(2)、HttpSecurity的build方法构建SecurityFilterChain类的原理
那么将这些Configurer类存入LinkedHashMap的作用又是什么？
在前面我们已经说到通过调用HttpSecurity的build方法构建SecurityFilterChain类，而build方法封装了doBuild方法；
for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : securityFilterChainBuilders) {
securityFilterChains.add(securityFilterChainBuilder.build());
}
在我们回忆上面WebSecurity类的doBuild方法，我们知道HttpSecurity类调用的doBuild方法与WebSecurity类一样，而通过观察WebSecurity类doBuild方法里init;configure；这些语句的具体实现，实际就是遍历LinkedHashMap中的元素：
并调用其init方法和configure方法：
@Override
protected final O doBuild() throws Exception {
synchronized (configurers) {
buildState = BuildState.INITIALIZING;
beforeInit();
init();
buildState = BuildState.CONFIGURING;
beforeConfigure();
configure();
buildState = BuildState.BUILDING;
O result = performBuild();
buildState = BuildState.BUILT;
return result;
}
}
我们现在来查看其中一个ExpressionUrlAuthorizationConfigurer类的configure方法的详细代码：
@Override
public void configure(H http) throws Exception {
FilterInvocationSecurityMetadataSource metadataSource = createMetadataSource(http);
if (metadataSource == null) {
return;
}
FilterSecurityInterceptor securityInterceptor = createFilterSecurityInterceptor(
http, metadataSource, http.getSharedObject(AuthenticationManager.class));
if (filterSecurityInterceptorOncePerRequest != null) {
securityInterceptor
.setObserveOncePerRequest(filterSecurityInterceptorOncePerRequest);
}
securityInterceptor = postProcess(securityInterceptor);
http.addFilter(securityInterceptor);
http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor);
}
最后来看看HttpSecruity的performBuild()方法：
@Override
protected DefaultSecurityFilterChain performBuild() {
filters.sort(comparator);
return new DefaultSecurityFilterChain(requestMatcher, filters);
}
实际上就是通过HttpSecurity的filters集合构建了SecurityFilterChain。
从上面代码可总结出，HttpSecurity内部维护一个filter列表，而HttpSecurity调用形如authorizeRequests()，formLogin()等方法实际上就是将各种filter添加入它的列表当中，最后通过performBuild()方法构建出SecurityFilterChain，至此HttpSecurity构建filter的总过程就完成了。
6、核心接口SecurityBuilder 与 SecurityConfigurer
上面我们提到的WebSecurity，HttpSecurity都是具体的类。现在，我们从更高的层面来说，从两个核心接口以及其实现类的类图来理解下。
public interface SecurityBuilder<O> {
/**
* Builds the object and returns it or null.
*
* @return the Object to be built or null if the implementation allows it.
* @throws Exception if an error occurred when building the Object
*/
O build() throws Exception;
}
public interface SecurityConfigurer<O, B extends SecurityBuilder<O>> {
/**
* Initialize the {@link SecurityBuilder}. Here only shared state should be created
* and modified, but not properties on the {@link SecurityBuilder} used for building
* the object. This ensures that the {@link #configure(SecurityBuilder)} method uses
* the correct shared objects when building. Configurers should be applied here.
*
* @param builder
* @throws Exception
*/
void init(B builder) throws Exception;
/**
* Configure the {@link SecurityBuilder} by setting the necessary properties on the
* {@link SecurityBuilder}.
*
* @param builder
* @throws Exception
*/
void configure(B builder) throws Exception;
}
- HttpSecurity是接口SecurityBuilder的实现类，HttpSecuirty内部维护了一个Filter的List集合，我们添加的各种安全配置器对应的Filter最终都会被加入到这个List集合中；
- WebSecurity也是接口securityBuilder的实现类，内部维护着SecurityBuilder的列表，存储SecurityBuilder，这里主要是存储HttpSecurity；
很多官方类是XXXConfigurer，这些都是SecurityConfigurer。这些SecurityConfigurer的configure()方法，都会把对应filter添加到HttpSecurity。
7、总结
(1) WebSecurityConfiguration配置类有两个重要成员属性，调用setFilterChainProxySecurityConfigurer方法初始化webSecurity、使用我们编写的配置类WebSecurityConfig初始化webSecurityConfigurers。
private WebSecurity webSecurity;
private List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers;
需要注意的是：webSecurityConfigurers的程序都是继承自WebSecurityConfigurerAdapter类。
(2)、WebSecurity 有两三个重要成员，然后使用WebSecurityConfiguration#webSecurityConfigurers初始化webSecurity#configurers成员；
private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers = new LinkedHashMap<>();
private final List<SecurityBuilder<? extends SecurityFilterChain>> securityFilterChainBuilders = new ArrayList<>();
(3) 调用WebSecurityConfiguration#springSecurityFilterChain生成FilterChainProxy，主要是通过webSecurity.build()方法实现构建，该方法主要包含两步：
a、执行父类AbstractConfiguredSecurityBuilder#init方法：
- 遍历webSecurity#configurers成员，执行configurer的init方法；
- init方法调用getHttp方法，去初始化configurer的http成员（HttpSecurity类型），与此同时执行我们configure(http)方法，就是去调用我们配置类WebSecurityConfig中的configure方法；、
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
...
@Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin() //HTTP Basic认证方式
.and()
.authorizeRequests() // 授权配置
.anyRequest() // 所有请求
.authenticated(); // 都需要认证
}
}
- 比如authorizeRequests()，formLogin()方法分别返回ExpressionUrlAuthorizationConfigurer和FormLoginConfigurer，最终会将不同类型的安全配置器添加到http的configurers，这些configure都是继承自SecurityConfigurerAdapter类。HttpSecurity也是有两个非常重要的成员：
private List<Filter> filters = new ArrayList<>();
private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers = new LinkedHashMap<>();
- 然后调用webSecurity#addSecurityFilterChainBuilder方法将webSecurity#configurers中每个configurer创建的HttpSecurity放入了webSecurity的securityFilterChainBuilders集合里；
b、执行webSecurity#performBuild
- 遍历webSecurity的securityFilterChainBuilders列表，一般也就一个元素，也就是我们的WebSecurityConfig配置类创建的http对象，并执行http对象的build方法，生成SecurityFilterChain对象，该方法主要包含两步：
- 执行父类AbstractConfiguredSecurityBuilder#init方法：
- 遍历http#configurers成员，执行configurer的init方法，只是在init过程中不会创建http对象，而是把http对象传进去，以ExpressionUrlAuthorizationConfigurer为例，它会向http的filters属性添加securityInterceptor；
@Override public void configure(H http) throws Exception { FilterInvocationSecurityMetadataSource metadataSource = createMetadataSource(http); if (metadataSource == null) { return; } FilterSecurityInterceptor securityInterceptor = createFilterSecurityInterceptor( http, metadataSource, http.getSharedObject(AuthenticationManager.class)); if (filterSecurityInterceptorOncePerRequest != null) { securityInterceptor .setObserveOncePerRequest(filterSecurityInterceptorOncePerRequest); } securityInterceptor = postProcess(securityInterceptor); http.addFilter(securityInterceptor); http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor); }
- 执行http#performBuild方法，实际上就是通过HttpSecurity的filters集合构建了SecurityFilterChain；
- 然后将每个http对象构建的SecurityFilterChain对象添加到List<SecurityFilterChain> securityFilterChains临时列表中：
- 将securityFilterChains集合构建成一个FilterChainProxy代理类，返回这个FilterChainProxy代理类；
(4) 当请求到达的时候，FilterChainProxy会调用dofilter方法，会遍历所有的SecurityFilterChain，对匹配到的url，则调用SecurityFilterChain中的每一个filter做认证授权。
最后放一张概括图，有兴趣的朋友可以绘制出具体的时序图，这里我就不绘制了：
五、登录、验证流程分析
我们已经明白了Spring Security的filter的构造。下面我们来介绍一下filter的执行顺序（登录方式改回表单的方式）。
当我们启动项目访问http://localhost:8080/hello时：
1、请求/hello接口
由于BasicAuthenticationFilter、UsernamePasswordAuthenticationFilter默认只拦截/login post请求，因此过滤器会直接放行，代码直接跳转到FilterSecurityInteceptor上进行权限校验；
2、权限验证
此时会调用父类的beforeInvocation进行权限校验：
protected InterceptorStatusToken beforeInvocation(Object object) {
Assert.notNull(object, "Object was null");
final boolean debug = logger.isDebugEnabled();
if (!getSecureObjectClass().isAssignableFrom(object.getClass())) {
throw new IllegalArgumentException(
"Security invocation attempted for object "
+ object.getClass().getName()
+ " but AbstractSecurityInterceptor only configured to support secure objects of type: "
+ getSecureObjectClass());
}
Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource()
.getAttributes(object);
if (attributes == null || attributes.isEmpty()) {
if (rejectPublicInvocations) {
throw new IllegalArgumentException(
"Secure object invocation "
+ object
+ " was denied as public invocations are not allowed via this interceptor. "
+ "This indicates a configuration error because the "
+ "rejectPublicInvocations property is set to \'true\'");
}
if (debug) {
logger.debug("Public object - authentication not attempted");
}
publishEvent(new PublicInvocationEvent(object));
return null; // no further work post-invocation
}
if (debug) {
logger.debug("Secure object: " + object + "; Attributes: " + attributes);
}
if (SecurityContextHolder.getContext().getAuthentication() == null) {
credentialsNotFound(messages.getMessage(
"AbstractSecurityInterceptor.authenticationNotFound",
"An Authentication object was not found in the SecurityContext"),
object, attributes);
}
Authentication authenticated = authenticateIfRequired();
// Attempt authorization
try {
this.accessDecisionManager.decide(authenticated, object, attributes);
}
catch (AccessDeniedException accessDeniedException) {
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
accessDeniedException));
throw accessDeniedException;
}
if (debug) {
logger.debug("Authorization successful");
}
if (publishAuthorizationSuccess) {
publishEvent(new AuthorizedEvent(object, attributes, authenticated));
}
// Attempt to run as a different user
Authentication runAs = this.runAsManager.buildRunAs(authenticated, object,
attributes);
if (runAs == null) {
if (debug) {
logger.debug("RunAsManager did not change Authentication object");
}
// no further work post-invocation
return new InterceptorStatusToken(SecurityContextHolder.getContext(), false,
attributes, object);
}
else {
if (debug) {
logger.debug("Switching to RunAs Authentication: " + runAs);
}
SecurityContext origCtx = SecurityContextHolder.getContext();
SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
SecurityContextHolder.getContext().setAuthentication(runAs);
// need to revert to token.Authenticated post-invocation
return new InterceptorStatusToken(origCtx, true, attributes, object);
}
}
this.obtainSecurityMetadataSource()会调用默认的权限资源管理器，由于我们配置了任何请求都需要经过授权:
.anyRequest() // 所有请求
.authenticated(); // 都需要认证
因此/hello需要的权限为authenticated，此处我们可以通过实现FilterInvocationSecurityMetadataSource接口配置自己权限资源管理器，通过查询数据库来实现权限的动态配置，感兴趣的可以阅读：SpringSecurity动态配置权限。
由于用户没有登录，经过AnonymousAuthenticationFilter匿名过滤器处理之后，我们从上下文中可以获取到用户的主体信息为：
此时匿名用户具有的权限为ROLE_ANONYMOUS；然后经过访问决策管理器判断用户有无权限：
this.accessDecisionManager.decide(authenticated, object, attributes);
Spring提供了3个决策管理器：
- AffirmativeBased 一票通过，只要有一个投票器通过就允许访问；
- ConsensusBased 有一半以上投票器通过才允许访问资源；
- UnanimousBased 所有投票器都通过才允许访问；
这里使用默认的决策管理进行判断有无权限，可以看到决策管理中在引入了投票器（AccessDecisionVoter）的概念，有无权限访问的最终觉得权是由投票器来决定的，这里权限无法通过：
会抛出权限拒绝的异常，该异常会被ExceptionTranslateFilter捕获；
3、跳转到登陆页面
由于用户未登录直接访问/hello，所以抛出用户未认证的异常，所以接下来跳转到Spring Security提供的默认登录页 GET：http://localhost:8080/login，最终请求被DefaultLoginPageGeneratingFilter拦截进行处理，返回默认的登录页面：
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
//登录失败
boolean loginError = isErrorPage(request);
//登出请求
boolean logoutSuccess = isLogoutSuccess(request);
//是否是登录请求
if (isLoginUrlRequest(request) || loginError || logoutSuccess) {
String loginPageHtml = generateLoginPageHtml(request, loginError,
logoutSuccess);
response.setContentType("text/html;charset=UTF-8");
response.setContentLength(loginPageHtml.length());
response.getWriter().write(loginPageHtml);
return;
}
chain.doFilter(request, response);
}
isLoginUrlRequest(request)方法中，如果判断是/login请求则接下来生成默认的登录页面返回:
private boolean isLoginUrlRequest(HttpServletRequest request) {
return matches(request, loginPageUrl);
}
private boolean matches(HttpServletRequest request, String url) {
//首先判断是不是GET请求
if (!"GET".equals(request.getMethod()) || url == null) {
return false;
}
String uri = request.getRequestURI();
int pathParamIndex = uri.indexOf(\';\');
if (pathParamIndex > 0) {
// strip everything after the first semi-colon
uri = uri.substring(0, pathParamIndex);
}
if (request.getQueryString() != null) {
uri += "?" + request.getQueryString();
}
if ("".equals(request.getContextPath())) {
return uri.equals(url);
}
return uri.equals(request.getContextPath() + url);
}
generateLoginPageHtml方法中生成默认登录页面：
private String generateLoginPageHtml(HttpServletRequest request, boolean loginError,
boolean logoutSuccess) {
String errorMsg = "none";
if (loginError) {
HttpSession session = request.getSession(false);
if (session != null) {
AuthenticationException ex = (AuthenticationException) session
.getAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
errorMsg = ex != null ? ex.getMessage() : "none";
}
}
StringBuilder sb = new StringBuilder();
sb.append("<html><head><title>Login Page</title></head>");
if (formLoginEnabled) {
sb.append("<body οnlοad=\'document.f.").append(usernameParameter)
.append(".focus();\'>\n");
}
if (loginError) {
sb.append("<p><font color=\'red\'>Your login attempt was not successful, try again.<br/><br/>Reason: ");
sb.append(errorMsg);
sb.append("</font></p>");
}
if (logoutSuccess) {
sb.append("<p><font color=\'green\'>You have been logged out</font></p>");
}
if (formLoginEnabled) {
sb.append("<h3>Login with Username and Password</h3>");
sb.append("<form name=\'f\' action=\'").append(request.getContextPath())
.append(authenticationUrl).append("\' method=\'POST\'>\n");
sb.append("<table>\n");
sb.append(" <tr><td>User:</td><td><input type=\'text\' name=\'");
sb.append(usernameParameter).append("\' value=\'").append("\'></td></tr>\n");
sb.append(" <tr><td>Password:</td><td><input type=\'password\' name=\'")
.append(passwordParameter).append("\'/></td></tr>\n");
if (rememberMeParameter != null) {
sb.append(" <tr><td><input type=\'checkbox\' name=\'")
.append(rememberMeParameter)
.append("\'/></td><td>Remember me on this computer.</td></tr>\n");
}
sb.append(" <tr><td colspan=\'2\'><input name=\"submit\" type=\"submit\" value=\"Login\"/></td></tr>\n");
renderHiddenInputs(sb, request);
sb.append("</table>\n");
sb.append("</form>");
}
if (openIdEnabled) {
sb.append("<h3>Login with OpenID Identity</h3>");
sb.append("<form name=\'oidf\' action=\'").append(request.getContextPath())
.append(openIDauthenticationUrl).append("\' method=\'POST\'>\n");
sb.append("<table>\n");
sb.append(" <tr><td>Identity:</td><td><input type=\'text\' size=\'30\' name=\'");
sb.append(openIDusernameParameter).append("\'/></td></tr>\n");
if (openIDrememberMeParameter != null) {
sb.append(" <tr><td><input type=\'checkbox\' name=\'")
.append(openIDrememberMeParameter)
.append("\'></td><td>Remember me on this computer.</td></tr>\n");
}
sb.append(" <tr><td colspan=\'2\'><input name=\"submit\" type=\"submit\" value=\"Login\"/></td></tr>\n");
sb.append("</table>\n");
renderHiddenInputs(sb, request);
sb.append("</form>");
}
sb.append("</body></html>");
return sb.toString();
}
4、开始登录
当我们输入完用户名、密码点击登录时，将会发送post请求：http://localhost:8080/login，该请求页面是在form标签action中指定的，POST请求会提交用户名和密码登录信息，此时由UsernamePasswordAuthenticationFilter的父类AbstractAuthenticationProcessingFilter处理，简单来说就是从请求request中获取用户名和密码进行认证操作（这里有一点需要注意，默认情况下UsernamePasswordAuthenticationFilter该过滤器默认只有当请求方法为post、请求页面为/login时过滤器才生效，如果想修改其默认拦截页面，需要在BrowserSecurityConfig中配置该过滤器的拦截url：.loginProcessingUrl("url")，也就是说只有当form标签action指定的url和.loginProcessingUrl配置的相同时，UsernamePasswordAuthenticationFilter过滤器才生效）：
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
//当不是登录请求 POST:/login时则直接跳过
if (!requiresAuthentication(request, response)) {
chain.doFilter(request, response);
return;
}
//如果是登录请求 POST:/login则进行验证处理
if (logger.isDebugEnabled()) {
logger.debug("Request is to process authentication");
}
Authentication authResult;
try {
//从请求中获取用户名密码进行校验
authResult = attemptAuthentication(request, response);
if (authResult == null) {
// return immediately as subclass has indicated that it hasn\'t completed
// authentication
return;
}
sessionStrategy.onAuthentication(authResult, request, response);
}
catch (InternalAuthenticationServiceException failed) {
logger.error(
"An internal error occurred while trying to authenticate the user.",
failed);
//校验失败则跳转到登录页面
unsuccessfulAuthentication(request, response, failed);
return;
}
catch (AuthenticationException failed) {
// Authentication failed
//校验失败则跳转到登录页面
unsuccessfulAuthentication(request, response, failed);
return;
}
// Authentication success
if (continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
//校验成功则跳转到成功之后页面
successfulAuthentication(request, response, chain, authResult);
}
在doFilter方法中，首先会调用requiresAuthentication方法判断是不是登录请求，如果不是则直接跳过这个Filter，如果是则进行身份验证：
如果请求是登录操作，则接下来进行身份验证相关的操作，
UsernamePasswordAuthenticationFilter处理表单方式的用户认证。在UsernamePasswordAuthenticationFilter的attemptAuthentication方法上打个断点： 调用authResult = attemptAuthentication(request, response)方法进行验证，在attemptAuthentication中会从请求中获取用户名和密码构建UsernamePasswordAuthenticationToken ：
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
if (postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException(
"Authentication method not supported: " + request.getMethod());
}
//获取用户名密码
String username = obtainUsername(request);
String password = obtainPassword(request);
if (username == null) {
username = "";
}
if (password == null) {
password = "";
}
username = username.trim();
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
username, password);
// Allow subclasses to set the "details" property
setDetails(request, authRequest);
//调用AuthenticationManager的实现类进行校验
return this.getAuthenticationManager().authenticate(authRequest);
}
5、认证管理器（AuthenticationManager）进行认证
在接口AuthenticationManager的实现类ProviderManager调用authenticate方法进行校验操作。在authenticate方法中提供了一个List<AuthenticationProvider>，开发者可以提供不同的校验方式（用户名密码、手机号密码、邮箱密码等）只要其中有一个AutenticationProvider调用authenticate方法校验通过即可，当校验不通过时会抛出AuthenticationException ，当所有的AuthenticationProvider校验不通过时，直接抛出异常由ExceptionTranslationFilter捕捉处理，跳转到登录页面。
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
Class<? extends Authentication> toTest = authentication.getClass();
AuthenticationException lastException = null;
Authentication result = null;
boolean debug = logger.isDebugEnabled();
//可以提供多个验证器，只要其中有一个校验通过接口
for (AuthenticationProvider provider : getProviders()) {
if (!provider.supports(toTest)) {
continue;
}
if (debug) {
logger.debug("Authentication attempt using "
+ provider.getClass().getName());
}
try {
//进行校验，校验不通过则直接抛出AuthenticationException
result = provider.authenticate(authentication);
if (result != null) {
copyDetails(authentication, result);
break;
}
}
catch (AccountStatusException e) {
prepareException(e, authentication);
// SEC-546: Avoid polling additional providers if auth failure is due to
// invalid account status
throw e;
}
catch (InternalAuthenticationServiceException e) {
prepareException(e, authentication);
throw e;
}
catch (AuthenticationException e) {
lastException = e;
}
}
if (result == null && parent != null) {
// Allow the parent to try.
try {
result = parent.authenticate(authentication);
}
catch (ProviderNotFoundException e) {
// ignore as we will throw below if no other exception occurred prior to
// calling parent and the parent
// may throw ProviderNotFound even though a provider in the child already
// handled the request
}
catch (AuthenticationException e) {
lastException = e;
}
}
if (result != null) {
if (eraseCredentialsAfterAuthentication
&& (result instanceof CredentialsContainer)) {
// Authentication is complete. Remove credentials and other secret data
// from authentication
((CredentialsContainer) result).eraseCredentials();
}
eventPublisher.publishAuthenticationSuccess(result);
return result;
}
// Parent was null, or didn\'t authenticate (or throw an exception).
//最终校验不通过则抛出异常，由ExceptionTranslationFilter捕捉处理
if (lastException == null) {
lastException = new ProviderNotFoundException(messages.getMessage(
"ProviderManager.providerNotFound",
new Object[] { toTest.getName() },
"No AuthenticationProvider found for {0}"));
}
prepareException(lastException, authentication);
throw lastException;
}
在接口AuthenticationProvider的实现类AbstractUserDetailsAuthenticationProvider中调用authenticate进行用户名密码等的校验
- 首先从缓存userCahce中获取，如果获取不到，则从子类DaoAuthenticationProvider的retirveUser方法中获取，该方法利用loadUserByUsername函数根据用户名从数据库获得用户详情，如果获取不到则直接抛出异常；
- 将获取的user和authentication(从浏览器输入的用户和密码，用户名和密码会传递到Spring Security内部，最终封装成UsernamePasswordAuthenticationToken对象authentication)进行匹配，匹配成功调用createSuccessAuthentication方法创建Authentication返回。；
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.onlySupports",
"Only UsernamePasswordAuthenticationToken is supported"));
// Determine username
String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
: authentication.getName();
boolean cacheWasUsed = true;
UserDetails user = this.userCache.getUserFromCache(username);
if (user == null) {
cacheWasUsed = false;
try {
user = retrieveUser(username,
(UsernamePasswordAuthenticationToken) authentication);
}
catch (UsernameNotFoundException notFound) {
logger.debug("User \'" + username + "\' not found");
if (hideUserNotFoundExceptions) {
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"));
}
else {
throw notFound;
}
}
Assert.notNull(user,
"retrieveUser returned null - a violation of the interface contract");
}
try {
preAuthenticationChecks.check(user);
//判断用户名和密码等信息是否完全匹配
additionalAuthenticationChecks(user,
(UsernamePasswordAuthenticationToken) authentication);
}
catch (AuthenticationException exception) {
if (cacheWasUsed) {
// There was a problem, so try again after checking
// we\'re using latest data (i.e. not from the cache)
cacheWasUsed = false;
user = retrieveUser(username,
(UsernamePasswordAuthenticationToken) authentication);
preAuthenticationChecks.check(user);
additionalAuthenticationChecks(user,
(UsernamePasswordAuthenticationToken) authentication);
}
else {
throw exception;
}
}
postAuthenticationChecks.check(user);
if (!cacheWasUsed) {
this.userCache.putUserInCache(user);
}
Object principalToReturn = user;
if (forcePrincipalAsString) {
principalToReturn = user.getUsername();
}
return createSuccessAuthentication(principalToReturn, authentication, user);
}
在子类DaoAuthenticationProvider中调用接口的UserDetailsService的loadUserByUsername方法根据用户名来查找用户信息(在正式项目中实现此接口来完成从数据库等中查找)，如果查找不到还是直接抛出异常，由上层去处理：
protected final UserDetails retrieveUser(String username,
UsernamePasswordAuthenticationToken authentication)
throws AuthenticationException {
UserDetails loadedUser;
try {
//调用默认实现InMemoryUserDetailsManager查找用户名密码
loadedUser = this.getUserDetailsService().loadUserByUsername(username);
}
catch (UsernameNotFoundException notFound) {
if (authentication.getCredentials() != null) {
String presentedPassword = authentication.getCredentials().toString();
passwordEncoder.isPasswordValid(userNotFoundEncodedPassword,
presentedPassword, null);
}
throw notFound;
}
catch (Exception repositoryProblem) {
throw new InternalAuthenticationServiceException(
repositoryProblem.getMessage(), repositoryProblem);
}
if (loadedUser == null) {
throw new InternalAuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
}
return loadedUser;
}
当找到用户信息后，还需要根据用户信息和password字段进行匹配，在additionalAuthenticationChecks中完成完整的用户名和密码认证：
protected void additionalAuthenticationChecks(UserDetails userDetails,
UsernamePasswordAuthenticationToken authentication)
throws AuthenticationException {
Object salt = null;
if (this.saltSource != null) {
salt = this.saltSource.getSalt(userDetails);
}
if (authentication.getCredentials() == null) {
logger.debug("Authentication failed: no credentials provided");
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"));
}
String presentedPassword = authentication.getCredentials().toString();
if (!passwordEncoder.isPasswordValid(userDetails.getPassword(),
presentedPassword, salt)) {
logger.debug("Authentication failed: password does not match stored value");
throw new BadCredentialsException(messages.getMessage(
"AbstractUserDetailsAuthenticationProvider.badCredentials",
"Bad credentials"));
}
}
6、权限校验
当认证通过时，进行权限校验，执行FilterSecurityInterceptor代码的doFilter方法：
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain);
invoke(fi);
}
在invoke方法中会调用父类AbstractSecurityInterceptor的beforeInvocation对Authentication对象进行权限校验：
public void invoke(FilterInvocation fi) throws IOException, ServletException {
if ((fi.getRequest() != null)
&& (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
&& observeOncePerRequest) {
// filter already applied to this request and user wants us to observe
// once-per-request handling, so don\'t re-do security checking
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
}
else {
// first time this request being called, so perform security checking
if (fi.getRequest() != null) {
fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
}
//调用父类的beforeInvocation进行权限校验
InterceptorStatusToken token = super.beforeInvocation(fi);
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
}
finally {
super.finallyInvocation(token);
}
super.afterInvocation(token, null);
}
}
在beforeInvocation中调用接口AccessDecisionManager的实现类，校验角色：
protected InterceptorStatusToken beforeInvocation(Object object) {
//省略部分代码
//获取当前线程的Authentication对象
Authentication authenticated = authenticateIfRequired();
// Attempt authorization
try {
//权限角色校验
this.accessDecisionManager.decide(authenticated, object, attributes);
}
//校验失败抛出异常
catch (AccessDeniedException accessDeniedException) {
publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
accessDeniedException));
throw accessDeniedException;
}
//省略部分代码
}
最终调用子类AffirmativeBased的decide方法，在decide方法中会获取AccessDecisionVoter对权限进行投票处理，获取投票结果，当投票结果是1时则表示有权限，否则等于-1表示没有权限，拒绝：
public void decide(Authentication authentication, Object object,
Collection<ConfigAttribute> configAttributes) throws AccessDeniedException {
int deny = 0;
for (AccessDecisionVoter voter : getDecisionVoters()) {
//投票获取结果
int result = voter.vote(authentication, object, configAttributes);
if (logger.isDebugEnabled()) {
logger.debug("Voter: " + voter + ", returned: " + result);
}
//当有权限时直接返回
switch (result) {
case AccessDecisionVoter.ACCESS_GRANTED:
return;
//否则拒绝
case AccessDecisionVoter.ACCESS_DENIED:
deny++;
break;
default:
break;
}
}
//
if (deny > 0) {
throw new AccessDeniedException(messages.getMessage(
"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
}
// To get this far, every AccessDecisionVoter abstained
checkAllowIfAllAbstainDecisions();
}
在实现类WebExpressionVoter会根据authentication结果进行校验判断，根据Authentication对象创建接口SecurityExpressionOperations的实现类SecurityExpressionRoot：
- 当请求url被配置为permitAll，则直接返回true，校验通过；
- 其他需要登录请求url会调用isAuthenticated方法，最终调用AuthenticationTrustResolver的AuthenticationTrustResolverImpl的方法进行判断；
public abstract class SecurityExpressionRoot implements SecurityExpressionOperations {
protected final Authentication authentication;
private AuthenticationTrustResolver trustResolver;
private RoleHierarchy roleHierarchy;
private Set<String> roles;
private String defaultRolePrefix = "ROLE_";
/** Allows "permitAll" expression */
public final boolean permitAll = true;
/** Allows "denyAll" expression */
public final boolean denyAll = false;
private PermissionEvaluator permissionEvaluator;
public final String read = "read";
public final String write = "write";
public final String create = "create";
public final String delete = "delete";
public final String admin = "administration";
/**
* Creates a new instance
* @param authentication the {@link Authentication} to use. Cannot be null.
*/
public SecurityExpressionRoot(Authentication authentication) {
if (authentication == null) {
throw new IllegalArgumentException("Authentication object cannot be null");
}
this.authentication = authentication;
}
public final boolean hasAuthority(String authority) {
return hasAnyAuthority(authority);
}
public final boolean hasAnyAuthority(String... authorities) {
return hasAnyAuthorityName(null, authorities);
}
public final boolean hasRole(String role) {
return hasAnyRole(role);
}
public final boolean hasAnyRole(String... roles) {
return hasAnyAuthorityName(defaultRolePrefix, roles);
}
private boolean hasAnyAuthorityName(String prefix, String... roles) {
Set<String> roleSet = getAuthoritySet();
for (String role : roles) {
String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
if (roleSet.contains(defaultedRole)) {
return true;
}
}
return false;
}
public final Authentication getAuthentication() {
return authentication;
}
public final boolean permitAll() {
return true;
}
public final boolean denyAll() {
return false;
}
public final boolean isAnonymous() {
return trustResolver.isAnonymous(authentication);
}
public final boolean isAuthenticated() {
return !isAnonymous();
}
public final boolean isRememberMe() {
return trustResolver.isRememberMe(authentication);
}
public final boolean isFullyAuthenticated() {
return !trustResolver.isAnonymous(authentication)
&& !trustResolver.isRememberMe(authentication);
}
/**
* Convenience method to access {@link Authentication#getPrincipal()} from
* {@link #getAuthentication()}
* @return
*/
public Object getPrincipal() {
return authentication.getPrincipal();
}
public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
this.trustResolver = trustResolver;
}
public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
this.roleHierarchy = roleHierarchy;
}
/**
* <p>
* Sets the default prefix to be added to {@link #hasAnyRole(String...)} or
* {@link #hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN")
* is passed in, then the role ROLE_ADMIN will be used when the defaultRolePrefix is
* "ROLE_" (default).
* </p>
*
* <p>
* If null or empty, then no default role prefix is used.
* </p>
*
* @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
*/
public void setDefaultRolePrefix(String defaultRolePrefix) {
this.defaultRolePrefix = defaultRolePrefix;
}
private Set<String> getAuthoritySet() {
if (roles == null) {
roles = new HashSet<String>();
Collection<? extends GrantedAuthority> userAuthorities = authentication
.getAuthorities();
if (roleHierarchy != null) {
userAuthorities = roleHierarchy
.getReachableGrantedAuthorities(userAuthorities);
}
roles = AuthorityUtils.authorityListToSet(userAuthorities);
}
return roles;
}
public boolean hasPermission(Object target, Object permission) {
return permissionEvaluator.hasPermission(authentication, target, permission);
}
public boolean hasPermission(Object targetId, String targetType, Object permission) {
return permissionEvaluator.hasPermission(authentication, (Serializable) targetId,
targetType, permission);
}
public void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
this.permissionEvaluator = permissionEvaluator;
}
/**
* Prefixes role with defaultRolePrefix if defaultRolePrefix is non-null and if role
* does not already start with defaultRolePrefix.
*
* @param defaultRolePrefix
* @param role
* @return
*/
private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
if (role == null) {
return role;
}
if (defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
return role;
}
if (role.startsWith(defaultRolePrefix)) {
return role;
}
return defaultRolePrefix + role;
}
}
在AuthenticationTrustResolverImpl方法isAnonymous中就是判断传递过来的Authentication对象是不是AnonymousAuthenticationToken，如果是AnonymousAuthenticationToken则表示没有登录，因为登录之后生成的对象是UsernamePasswordAuthenticationToken或其他Authentication对象，这也是Spring Security设计的最精华也是最难以理解也是最简单的方式。
private Class<? extends Authentication> anonymousClass = AnonymousAuthenticationToken.class;
public boolean isAnonymous(Authentication authentication) {
if ((anonymousClass == null) || (authentication == null)) {
return false;
}
return anonymousClass.isAssignableFrom(authentication.getClass());
}
总结：Spring Security对url的权限判断有两种方式，一种是请求是permitAll的则直接返回校验通过，另外一个是判断Authentication是不是AnonymousAuthenticationToken，因为正常登录等产生的不是这个对象，如果不是这个类型的对象则表示登录成功了。
7、权限验证通过
如果权限通过，代码最终跳转到/hello上：
浏览器页面将显示hello spring security信息;
六、代码下载
参考文章：
[1] Spring Boot中开启Spring Security(部分转载)
[2] Spring Security原理学习--用户名和密码认证(三)
[3] Spring Security原理学习--权限校验(四)
[4] Spring Security Config : 注解 EnableWebSecurity 启用Web安全
[5] Spring Security实现原理剖析（一）：filter的构造和初始化
[6] Spring Security 实现原理的理解记录(推荐)