Laravel5.5源码详解 -- Auth中间件

旧城等待， 2022-06-02 00:57 294阅读 0赞

# Laravel5.5源码详解 – Auth中间件 #

为了体现全貌，前面的代码部分没有做太多删减，重点关注特别加入的注释部分。原文的注释删除，以减少阅读篇幅。本文重点在后面的流程讲解，这些比较详细。

如果光看官方的文档，碰到问题的时候往往还是不知所云。所以，熟练的运用，应该建立在对源码的深刻了解的基础上。而其流程是了解源码的第一步。了解这些，开发时才能游刃有余。

在App\\Http\\Kernel中注册的

<?php
    namespace App\Http;
    use Illuminate\Foundation\Http\Kernel as HttpKernel;
    class Kernel extends HttpKernel
    { 
        // 全局Http中间件
        protected $middleware = [ \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class, \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class, \App\Http\Middleware\TrimStrings::class, \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class, \App\Http\Middleware\TrustProxies::class, ]; // 路由中间件 protected $middlewareGroups = [
            'web' => [
                \App\Http\Middleware\EncryptCookies::class,
                \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
                \Illuminate\Session\Middleware\StartSession::class,
                // \Illuminate\Session\Middleware\AuthenticateSession::class,
                \Illuminate\View\Middleware\ShareErrorsFromSession::class,
                \App\Http\Middleware\VerifyCsrfToken::class,
                \Illuminate\Routing\Middleware\SubstituteBindings::class,
            ],
    
            'api' => [
                'throttle:60,1',
                'bindings',
            ],
        ];
    
       // 可能需要分组或单独使用的中间件
        protected $routeMiddleware = [ 'auth' => \Illuminate\Auth\Middleware\Authenticate::class, 'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class, 'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class, 'can' => \Illuminate\Auth\Middleware\Authorize::class, 'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class, 'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class, ]; }

可见，Auth中间件属于可能需要分组或单独使用的中间件，当然你也可以根据需要调整。

'auth' => \Illuminate\Auth\Middleware\Authenticate::class

关于中间件的运行机理，请参考另文，

[Laravel5.5源码详解 – 中间件MiddleWare分析][Laravel5.5_ _ _MiddleWare]

打开\\Illuminate\\Auth\\Middleware\\Authenticate，

<?php
    namespace Illuminate\Auth\Middleware;
    use Closure;
    use Illuminate\Auth\AuthenticationException;
    use Illuminate\Contracts\Auth\Factory as Auth;
    
    class Authenticate { 
        protected $auth;
        public function __construct(Auth $auth) { 
            // 注入Illuminate\Auth\AuthManager工厂类
            $this->auth = $auth;
        }
    
        public function handle($request, Closure $next, ...$guards) { 
            $this->authenticate($guards);
    
            return $next($request);
        }
    
        protected function authenticate(array $guards) { 
            // 如果没有指定guard 则使用默认的设置
            if (empty($guards)) {
    
                // 使用Illuminate\Auth\AuthManager\__call()获取SessionGuard 实例，
                // 并调用其(实际是GuardHelpers的) authenticate() 方法进行认证
                return $this->auth->authenticate();
    
            }
    
            // 如果有指定guard,则使用其中第一个能成功认证的
            foreach ($guards as $guard) {
                if ($this->auth->guard($guard)->check()) {
    
                    // 获得本次请求guard，（后续请求也都会通过这个guard）
                    return $this->auth->shouldUse($guard);
                }
            }
    
            throw new AuthenticationException('Unauthenticated.', $guards);
        }
    }

注释中说明，`$this->auth`在构造时传入的是`Illuminate\Contracts\Auth\Factory`接口，其实现类在`Illuminate\Auth\AuthManager`，接下来，我们看一下这个类，特别注意`resolve`函数中的注释，

<?php namespace Illuminate\Auth; use Closure; use InvalidArgumentException; use Illuminate\Contracts\Auth\Factory as FactoryContract; class AuthManager implements FactoryContract { use CreatesUserProviders; protected $app; protected $customCreators = []; protected $guards = []; protected $userResolver; public function __construct($app) { $this->app = $app; $this->userResolver = function ($guard = null) { return $this->guard($guard)->user(); }; } public function guard($name = null) { // getDefaultDriver() 返回来的就是 "web" $name = $name ?: $this->getDefaultDriver(); return $this->guards[$name] ?? $this->guards[$name] = $this->resolve($name); } protected function resolve($name) { // array:2 ["driver" => "session", "provider" => "users"] // array:2 ["driver" => "token","provider" => "users"] $config = $this->getConfig($name); if (is_null($config)) { throw new InvalidArgumentException("Auth guard [{$name}] is not defined."); } if (isset($this->customCreators[$config['driver']])) { return $this->callCustomCreator($name, $config); } // "web" => "createSessionDriver" // "api" => "createTokenDriver" $driverMethod = 'create'.ucfirst($config['driver']).'Driver'; if (method_exists($this, $driverMethod)) { // SessionGuard("web", ["driver" => "session", "provider" => "users"]) // TokenGuard("api", ["driver" => "token","provider" => "users"]) return $this->{ $driverMethod}($name, $config); } throw new InvalidArgumentException("Auth guard driver [{$name}] is not defined."); } protected function callCustomCreator($name, array $config) { return $this->customCreators[$config['driver']]($this->app, $name, $config); } public function createSessionDriver($name, $config) { $provider = $this->createUserProvider($config['provider'] ?? null); // 在这里创建SessionGuard, $guard = new SessionGuard($name, $provider, $this->app['session.store']); if (method_exists($guard, 'setCookieJar')) { $guard->setCookieJar($this->app['cookie']); } // 在这里调用SessionGuard的setDispatcher()函数，关联了Dispatcher，后面再述。 if (method_exists($guard, 'setDispatcher')) { $guard->setDispatcher($this->app['events']); } if (method_exists($guard, 'setRequest')) { $guard->setRequest($this->app->refresh('request', $guard, 'setRequest')); } return $guard; } public function createTokenDriver($name, $config) { $guard = new TokenGuard( $this->createUserProvider($config['provider'] ?? null), $this->app['request'] ); $this->app->refresh('request', $guard, 'setRequest'); return $guard; } protected function getConfig($name) { return $this->app['config']["auth.guards.{$name}"]; } public function getDefaultDriver() { return $this->app['config']['auth.defaults.guard']; } public function shouldUse($name) { $name = $name ?: $this->getDefaultDriver(); $this->setDefaultDriver($name); $this->userResolver = function ($name = null) { return $this->guard($name)->user(); }; } public function setDefaultDriver($name) { $this->app['config']['auth.defaults.guard'] = $name; } public function viaRequest($driver, callable $callback) { return $this->extend($driver, function () use ($callback) { $guard = new RequestGuard($callback, $this->app['request'], $this->createUserProvider()); $this->app->refresh('request', $guard, 'setRequest'); return $guard; }); } public function userResolver() { return $this->userResolver; } public function resolveUsersUsing(Closure $userResolver) { $this->userResolver = $userResolver; return $this; } public function extend($driver, Closure $callback) { $this->customCreators[$driver] = $callback; return $this; } public function provider($name, Closure $callback) { $this->customProviderCreators[$name] = $callback; return $this; } public function __call($method, $parameters) { return $this->guard()->{ $method}(...$parameters); } }

在本例中，相当于`__call("authenticate"， [])`，这里，`$this->guard()`就是`SessionGuard`，它是通过`AuthManager`的函数`resolve('web')`得到，

简单说，在AuthManager里面，函数`guard()`调用了函数`resolve('web')`，其中又调用了`createSessionDriver`实例化了`SessionGuard`.

SessionGuard {
       #329 ▼
      #name: "web"
      #lastAttempted: null
      #viaRemember: false
      #session: Store {
       #314 ▶}
      #cookie: CookieJar {
       #302 ▶}
      #request: Request {
       #42 ▶}
      #events: Dispatcher {
       #26 ▶}
      #loggedOut: false
      #recallAttempted: false
      #user: null
      #provider: EloquentUserProvider {
       #326 ▶}
    }

对这个过程深入一点的话，就是在 `Illuminate\Auth\AuthManager`中，`createSessionDriver()`调用了`SessionGuard`的`setDispatcher()`函数，进行了一次注入（关联），

// 在这里调用SessionGuard的setDispatcher()函数
        if (method_exists($guard, 'setDispatcher')) {
            $guard->setDispatcher($this->app['events']); }

在`SessionGuard`的`setDispatcher`里，

public function setDispatcher(Dispatcher $events) { 
            $this->events = $events;
        }

这里`\$events`的原型是 `Illuminate\Contracts\Events\Dispatcher`这个接口，其实例是

`\Illuminate\Events\Dispatcher`， 这种关联在`Illuminate\Foundation\Application`中可以看得很明白，

'events' => [ \Illuminate\Events\Dispatcher::class, \Illuminate\Contracts\Events\Dispatcher::class ],

AuthManager并没有`authenticate()`，所以`\Illuminate\Auth\Middleware\Authenticate`里面的这一句

`$this->guard()->authenticate()` 在执行时，实际找不到`AuthManager的authenticate()`，便会通过AuthManager的

public function __call($method, $parameters)
    {
        return $this->guard()->{$method}(...$parameters);
    }

来调用`SessionGuard`里的`authenticate()`函数，`SessionGuard`也没有`authenticate`，它是通过宏`use GuardHelpers, Macroable;` 调用了`Illuminate\Auth\GuardHelpers`中的`authenticate()`，

<?php namespace Illuminate\Auth; use Illuminate\Contracts\Auth\UserProvider; use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract; trait GuardHelpers { protected $user; protected $provider; public function authenticate() { if (! is_null($user = $this->user())) { return $user; } throw new AuthenticationException; }

从`$this->user()`这里进入了真正进行身份验证的地方，其他Auth验证函数也是同样的原理，比如你在使用Auth::check()判断一个用户是否已经登录时，实际调用的函数也是`Illuminate\Auth\GuardHelpers`中的`check()`,

public function check() { 
            return ! is_null($this->user());
        }

同样，这个`GuardHelpers`中还有`Auth::id()`， `Auth::guest()`等，

所以，最关键的，还是看在`Illuminate\Auth\SessionGuard`中的`user()`函数，如下，

public function user()
        {
            if ($this->loggedOut) {
                return;
            }
    
            if (! is_null($this->user)) {
                return $this->user;
            }
    
            // 从session中获取用户ID。已登录用户的用户ID会被存储在Session内。
            $id = $this->session->get($this->getName());
    
            if (! is_null($id)) {
                 // 通过Illuminate\Auth\EloquentUserProvider 的retrieveById() 方法，
                 // 获取用户信息，并返回User Model
                 // 换句话说：在这里SessionGuard拿到了用户信息
                if ($this->user = $this->provider->retrieveById($id)) {
                    $this->fireAuthenticatedEvent($this->user);
                }
            }
    
            // 获取认证cookie（登录时选中记住我，服务端会向浏览器设置一个认证cookie，
            // 其中包括 remember_token，下次可以直接使用这个认证cookie进行登录） 
            $recaller = $this->recaller();
    
            if (is_null($this->user) && ! is_null($recaller)) {
                // 使用 remember_token 从数据库中获取用户信息
                // 最终委托 Illuminate\Auth\EloquentUserProvider::retrieveByToken()方法取数据
                $this->user = $this->userFromRecaller($recaller);
    
                if ($this->user) {
    
                    //将用户ID保存到Session
                    $this->updateSession($this->user->getAuthIdentifier());
    
                    $this->fireLoginEvent($this->user, true);
                }
            }
    
            return $this->user;
        }

### 第一步，如何拿到用户id ###

先看如何从session获取用户id，session接口在`Illuminate\Contracts\Session\Session`，其门面在`Illuminate\Foundation\Application.php`中有定义

'session'              => [\Illuminate\Session\SessionManager::class],
    'session.store'        => [\Illuminate\Session\Store::class, \Illuminate\Contracts\Session\Session::class],

当然， 真正的session是`\Illuminate\Session\Store`，这个在session的源码详解中已经讲过，

参考另文：[Laravel5.5源码详解 – Session的启动分析][Laravel5.5_ _ Session]

它实现了session的接口，如下

...
    namespace Illuminate\Session;
    use Illuminate\Contracts\Session\Session;
    class Store implements Session
    {
       ...}

先是SessionGuard得到一个当前的登陆相关的信息，这里还没有用户的信息

public function getName() { 
            return 'login_'.$this->name.'_'.sha1(static::class); }

打印出来是如下的结果，

"login_web_59ba36addc2b2f9401580f014c7f58ea4e30989d"

翻译开来就是`login_web_Illuminate\Auth\SessionGuard`，后面会用作登陆用户信息的识别。

前面说过，session就是\\Illuminate\\Session\\Store，得到用户id在其get函数中，

public function get($key, $default = null) { 
            return Arr::get($this->attributes, $key, $default);
        }

进一步追踪，发现用户信息在session加载时就已经放入attributes属性中，

protected function loadSession() { 
            $this->attributes = array_merge($this->attributes, $this->readFromHandler());
        }

其中$this->readFromHandler()又是信息来源，

protected function readFromHandler()
    {
        if ($data = $this->handler->read($this->getId())) {
            $data = @unserialize($this->prepareForUnserialize($data));
    
            if ($data !== false && ! is_null($data) && is_array($data)) {
                return $data;
            }
        }
    
        return [];
    }

再id是在这里拿到的，

public function getId() { 
            return $this->id;
        }
    
        public function setId($id) { 
            $this->id = $this->isValidId($id) ? $id : $this->generateSessionId();
        }

那么又是谁调用了setId来设置用户id呢？是`Illuminate\Session\Middleware\StartSession`，

public function handle($request, Closure $next)
        {
            $this->sessionHandled = true;
    
            if ($this->sessionConfigured()) {
                $request->setLaravelSession(
                    $session = $this->startSession($request)
                );
    
                $this->collectGarbage($session);
            }
    
            $response = $next($request);
    
            if ($this->sessionConfigured()) {
                $this->storeCurrentUrl($request, $session);
    
                $this->addCookieToResponse($response, $session);
            }
    
            return $response;
        }
    
        protected function startSession(Request $request)
        {
            return tap($this->getSession($request), function ($session) use ($request) {
                $session->setRequestOnHandler($request);
    
                $session->start();
            });
        }
    
        public function getSession(Request $request)
        {
            return tap($this->manager->driver(), function ($session) use ($request) {
                $session->setId($request->cookies->get($session->getName()));
            });
        }

可以看到，这个函数调用链的关系为`handle() ==> startSession() ==> getSession()`，handle是中间件的主函数，对所有经过的request进行处理。所以，当Request创建的时候，中间件实例化后，会首先在这里拿到用户的某个特征信息，并记录相关详情。

### 第二步，根据用户id获取用户信息 ###

上面拿到了用户id。再来看如何根据这个id获取用户信息。前面注释中提到，`$this->provider` 是这个  
`Illuminate\Contracts\Auth\UserProvider` 接口，其实现类是  
`Illuminate\Auth\EloquentUserProvider`，它的`retrieveById()`函数如下，

namespace Illuminate\Auth;
    
    use Illuminate\Support\Str;
    use Illuminate\Contracts\Auth\UserProvider;
    use Illuminate\Contracts\Hashing\Hasher as HasherContract;
    use Illuminate\Contracts\Auth\Authenticatable as UserContract;
    
    class EloquentUserProvider implements UserProvider {    
        protected $hasher;
        protected $model;
    
        public function __construct(HasherContract $hasher, $model) { 
            $this->model = $model;
            $this->hasher = $hasher;
        }
    
        public function retrieveById($identifier) { 
            $model = $this->createModel();
    
            return $model->newQuery()
                ->where($model->getAuthIdentifierName(), $identifier)
                ->first();
        }

可见，这里实质上是对模型相关的数据库进行了一次查询，然后获取了所有相关属性。要特别注意的是，重点进行查询的函数是这里的first()，上面那三句，

return $model->newQuery()
                ->where($model->getAuthIdentifierName(), $identifier)
                ->first();

重新写一下，相当于下面的执行语句，

// 实例化一个QueryBuilder
    $query = $model->newQuery();
    // 执行一些准备工作
    $query = $query->where($model->getAuthIdentifierName(), $identifier);
    // 查询数据库，获取当前用户属性及相关信息 ---- 这里才是重点
    $user = $query->first();
    // 获得用户信息之后，返回查询结果
    return $user;

关于数据库的查询，详情可查阅另文，里面对来龙去脉进行了非常详尽的描述。

Laravel5.5源码详解 – 一次查询的详细执行：从Auth-Login-web中间件到数据库查询结果的全过程

附：laravel自带的Auth路由参考

如果使用的是laravel默认的Auth路由，那么就是下面的情况，可以根据需要选择。

Illuminate\\Routing\\Router

public function auth()
    {
        // Authentication Routes...
        $this->get('login', 'Auth\LoginController@showLoginForm')->name('login');
        $this->post('login', 'Auth\LoginController@login');
        $this->post('logout', 'Auth\LoginController@logout')->name('logout');
    
        // Registration Routes...
        $this->get('register', 'Auth\RegisterController@showRegistrationForm')->name('register');
        $this->post('register', 'Auth\RegisterController@register');
    
        // Password Reset Routes...
        $this->get('password/reset', 'Auth\ForgotPasswordController@showLinkRequestForm')->name('password.request');
        $this->post('password/email', 'Auth\ForgotPasswordController@sendResetLinkEmail')->name('password.email');
        $this->get('password/reset/{token}', 'Auth\ResetPasswordController@showResetForm')->name('password.reset');
        $this->post('password/reset', 'Auth\ResetPasswordController@reset');
    }

App\\Http\\Controllers\\Auth\\LonginController里面几乎没有有用的信息

class LoginController extends Controller { 
        use AuthenticatesUsers;

其父类App\\Http\\Controllers\\Controller 继承了 Illuminate\\Routing\\Controller

<?php namespace App\Http\Controllers; use Illuminate\Foundation\Bus\DispatchesJobs; use Illuminate\Routing\Controller as BaseController; use Illuminate\Foundation\Validation\ValidatesRequests; use Illuminate\Foundation\Auth\Access\AuthorizesRequests; class Controller extends BaseController { use AuthorizesRequests, DispatchesJobs, ValidatesRequests; }

在Illuminate\\Foundation\\Auth\\AuthenticatesUsers.php:

public function showLoginForm() { 
        return view('auth.login');
    }

[Laravel5.5_ _ _MiddleWare]: http://blog.csdn.net/tanmx219/article/details/78903521
[Laravel5.5_ _ Session]: http://blog.csdn.net/tanmx219/article/details/78807251