SpringSecurity基本原理

我会带着你远行 2024-02-19 17:28 48阅读 0赞

SpringSecurity原理图：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70][]

SpringSecurity中存在各种各样的拦截器用于处理不同的业务请求，如UsernamePasswordAuthenticationFilter：用于处理用户名和密码登陆；RememberMeAuthenticationFilter：用于实现记住我功能；OAuth2AuthenticationProcessingFilter：用于实现Spring Security Oauth2令牌功能；ExceptionTranslationFilter：用于异常拦截等等。

SecurityContextPersistenceFilter:**获取SecurityContext上下文 和退出登陆删除SecurityContext上下文信息;每一个请求都会先进入该拦截器中获取或者删除SecurityContext.**

//获取SecurityContext上下文 和退出登陆删除SecurityContext上下文信息
    //每一个请求都会先进入该拦截器中获取或者删除SecurityContext
    public class SecurityContextPersistenceFilter extends GenericFilterBean {
    
    	static final String FILTER_APPLIED = "__spring_security_scpf_applied";
    
    	private SecurityContextRepository repo;
    
    	private boolean forceEagerSessionCreation = false;
    
    	public SecurityContextPersistenceFilter() {
    		this(new HttpSessionSecurityContextRepository());
    	}
    
    	public SecurityContextPersistenceFilter(SecurityContextRepository repo) {
    		this.repo = repo;
    	}
    
    	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
    			throws IOException, ServletException {
    		HttpServletRequest request = (HttpServletRequest) req;
    		HttpServletResponse response = (HttpServletResponse) res;
    		//判断 request是否存在FILTER_APPLIED
    		if (request.getAttribute(FILTER_APPLIED) != null) {
    			//确保每个请求只应用一次筛选器 第一次请求设置完后在请求参数中设置了FILTER_APPLIED，每次过来先判断
                //request 中是否有FILTER_APPLIED值，如果有则说明 SecurityContext存在		
    			chain.doFilter(request, response);
    			return;
    		}
    
    		final boolean debug = logger.isDebugEnabled();
            //往请求中设置该属性 FILTER_APPLIED
    		request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
            //强制紧急会话创建
    		if (forceEagerSessionCreation) {
    			HttpSession session = request.getSession();
    
    			if (debug && session.isNew()) {
    				logger.debug("Eagerly created session: " + session.getId());
    			}
    		}
    
    		HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request,
    				response);
    				//获取 SecurityContext
    		SecurityContext contextBeforeChainExecution = repo.loadContext(holder);
    
    		try {
    		   //设置SecurityContextHolder中的SecurityContext 
    			SecurityContextHolder.setContext(contextBeforeChainExecution);
    
    			chain.doFilter(holder.getRequest(), holder.getResponse());
    
    		}finally {
    		    //通过SecurityContext持有者 获取SecurityContext
    			SecurityContext contextAfterChainExecution = SecurityContextHolder
    					.getContext();
    			// SecurityContextHolder内容的关键删除-在任何事情发生之前都要执行此操作
    			SecurityContextHolder.clearContext();
    			// SecurityContextRepository 保存 Context
    			repo.saveContext(contextAfterChainExecution, holder.getRequest(),
    					holder.getResponse());
    			request.removeAttribute(FILTER_APPLIED);
    
    			if (debug) {
    				logger.debug("SecurityContextHolder now cleared, as request processing completed");
    			}
    		}
    	}
    
    	public void setForceEagerSessionCreation(boolean forceEagerSessionCreation) {
    		this.forceEagerSessionCreation = forceEagerSessionCreation;
    	}
    }
    //保存 Context
    public void saveContext(SecurityContext context, HttpServletRequest request,
    			HttpServletResponse response) {
    	SaveContextOnUpdateOrErrorResponseWrapper responseWrapper = WebUtils
    			.getNativeResponse(response,
    					SaveContextOnUpdateOrErrorResponseWrapper.class);
    	if (responseWrapper == null) {
    		throw new IllegalStateException(
    				"Cannot invoke saveContext on response "
    						+ response
    						+ ". You must use the HttpRequestResponseHolder.response after invoking loadContext");
    	}
    	// saveContext() might already be called by the response wrapper
    	// if something in the chain called sendError() or sendRedirect(). This ensures we
    	// only call it
    	//
    	if (!responseWrapper.isContextSaved()) {
    		responseWrapper.saveContext(context);
    	}
    }

FilterSecurityInterceptor：SpringSecurity中拦截器最后会进入该处理器中进行想要数据处理。

public class FilterSecurityInterceptor extends AbstractSecurityInterceptor implements
    		Filter {
    	
    	private static final String FILTER_APPLIED = "__spring_security_filterSecurityInterceptor_filterApplied";
    
    	private FilterInvocationSecurityMetadataSource securityMetadataSource;
    	private boolean observeOncePerRequest = true;
    
    	// ~ Methods
    	// ========================================================================================================
        //初始化方法
    	public void init(FilterConfig arg0) throws ServletException {
    	}
    
    	//销毁方法
    	public void destroy() {
    	}
    
    	//拦截方法
    	public void doFilter(ServletRequest request, ServletResponse response,
    			FilterChain chain) throws IOException, ServletException {
    		FilterInvocation fi = new FilterInvocation(request, response, chain);
    		invoke(fi);
    	}
        。。。。。。。。。。。。。。。。。。。。。。。
    	public void invoke(FilterInvocation fi) throws IOException, ServletException {
    		if ((fi.getRequest() != null)
    				&& (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
    				&& observeOncePerRequest) {
    			
    			fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
    		}
    		else {
    			// 第一次调用此请求时，请执行安全检查
    			if (fi.getRequest() != null) {
    				fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
    			}
    
    			InterceptorStatusToken token = super.beforeInvocation(fi);
    
    			try {
    				fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
    			}
    			finally {
    				super.finallyInvocation(token);
    			}
    
    			super.afterInvocation(token, null);
    		}
    	}
    
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzU0OTU3OA_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/a8dbe3f637d54e4ab945d4f8c1fa188d.png