Spring Security 未认证请求处理源码解析

痛定思痛。 2024-03-22 13:36 66阅读 0赞

Spring Security 的过滤器都不是直接内嵌到 Servlet Filter 中的，而是通过 FilterChainProxy 来统一管理，即所有 Filter 的执行都是在 FilterChainProxy 中进行管理的

// FilterChainProxy.VirtualFilterChain
    		@Override
    		public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
    			if (this.currentPosition == this.size) {
    				if (logger.isDebugEnabled()) {
    					logger.debug(LogMessage.of(() -> "Secured " + requestLine(this.firewalledRequest)));
    				}
    				// Deactivate path stripping as we exit the security filter chain
    				this.firewalledRequest.reset();
                      // 执行 web 中的过滤器
    				this.originalChain.doFilter(request, response);
    				return;
    			}
                // 执行 Spring Security过滤器链中的过滤器
    			this.currentPosition++;
                //additionalFilters中定义了SpringSecurity过滤器链中的所有过滤器
    			Filter nextFilter = this.additionalFilters.get(this.currentPosition - 1);
    			if (logger.isTraceEnabled()) {
    				logger.trace(LogMessage.format("Invoking %s (%d/%d)", nextFilter.getClass().getSimpleName(),
    						this.currentPosition, this.size));
    			}
    			nextFilter.doFilter(request, response, this);
    		}
    
    	}

**默认过滤器**

![17c9638aac4b4a7198ada62484da7338.png][]

###  ###

### **ExceptionTranslationFilter** ###

![61a64b7f57044135b416f955a5c01aa0.png][]

![79dd0872cd334bc9ac46d58142440f17.png][]

### **AuthorizationFilter** ###

当我们使用自定义认证成功后，会将用户信息转换成 \`Authentication\` 对象，并将该对象保存到线程上下文中

UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(token);
            filterChain.doFilter(request, response);

AuthorizationFilter 会获取 Authentication 信息来校验当前用户是否通过该次访问

![6ac791d670614260a4b86eeca45c8107.png][]

![0e0b0bfe41c940928e34822962014208.png][]

![cc6123d6a79c48fb8dcee4eddc1536e9.png][]

![2807041ae88249b599a66d651262bb35.png][]

![937edb259e5945f59a71bf6758fe7ae7.png][]

![0b8421ad14b14e439a523a342d32a77b.png][]

![7a9bc89e98df445eb8e7ec9263b110b2.png][]

![48e5f26f55ed4b6ebff3bd1593886443.png][]

![86c71e5cb0a24731840d68131ad8c920.png][]

// LoginUrlAuthenticationEntryPoint.java	
    	/**
    	 * Performs the redirect (or forward) to the login form URL.
    	 */
    	@Override
    	public void commence(HttpServletRequest request, HttpServletResponse response,
    			AuthenticationException authException) throws IOException, ServletException {
    		if (!this.useForward) {
    			// redirect to login page. Use https if forceHttps true
    			String redirectUrl = buildRedirectUrlToLoginPage(request, response, authException);
    			this.redirectStrategy.sendRedirect(request, response, redirectUrl);
    			return;
    		}
    		String redirectUrl = null;
    		if (this.forceHttps && "http".equals(request.getScheme())) {
    			// First redirect the current request to HTTPS. When that request is received,
    			// the forward to the login page will be used.
    			redirectUrl = buildHttpsRedirectUrlForRequest(request);
    		}
    		if (redirectUrl != null) {
    			this.redirectStrategy.sendRedirect(request, response, redirectUrl);
    			return;
    		}
    		String loginForm = determineUrlToUseForThisRequest(request, response, authException);
    		logger.debug(LogMessage.format("Server side forward to: %s", loginForm));
    		RequestDispatcher dispatcher = request.getRequestDispatcher(loginForm);
    		dispatcher.forward(request, response);
    		return;
    	}

### 自定义未认证处理器 ###

public class UnAuthenticationHandler implements AuthenticationEntryPoint {
    
        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
            response.setContentType("application/json;charset=UTF-8");
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            response.getWriter().println("必须认证之后才能访问!");
        }
    }

@Bean
        public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            http.authorizeHttpRequests()
                    .mvcMatchers("/index")
                    .permitAll()
                    .anyRequest().authenticated()
                    .and().formLogin()
                    .successHandler(new LoginSuccessHandler())
                    .failureHandler(new LoginFailureHandler())
                	// 添加自定义处理器
                    .and().exceptionHandling().authenticationEntryPoint(new UnAuthenticationHandler())
                
                    .accessDeniedHandler(new UnAbleAccessHandler())
                    .and().logout().logoutSuccessHandler(new LogoutHandler())
                    .and().userDetailsService(userDetailsService()); // 注销登入处理器
            return http.csrf().disable().build();
        }
    }

![2de1bfee449c4c8c9f3f2d893dfe2aa2.png][]

[17c9638aac4b4a7198ada62484da7338.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/cf178cf4b93e4c7096ad18d46b52176f.png
[61a64b7f57044135b416f955a5c01aa0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/1395d2b551bd434f90cbfc545c35e6a4.png
[79dd0872cd334bc9ac46d58142440f17.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/482ac34070f94635ab35314903e50e5d.png
[6ac791d670614260a4b86eeca45c8107.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/c4bcbc55d4634c9b91c8368ad9a3ac43.png
[0e0b0bfe41c940928e34822962014208.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/15900b46201d42d28d9bd0be4acb0abf.png
[cc6123d6a79c48fb8dcee4eddc1536e9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/6f63fe9b72c64fe6800236da53e5b9bf.png
[2807041ae88249b599a66d651262bb35.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/8c1dd3494b68413187882c5d98c0fd72.png
[937edb259e5945f59a71bf6758fe7ae7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/749a8468452444acaf1f4bfdeb293565.png
[0b8421ad14b14e439a523a342d32a77b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/f2f685ed858d45de8dd8a9eb3303a161.png
[7a9bc89e98df445eb8e7ec9263b110b2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/c383b83f6c194b06bdd8f144c4f6baa4.png
[48e5f26f55ed4b6ebff3bd1593886443.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/38a4808104ed4b27926c4dae31a89ddc.png
[86c71e5cb0a24731840d68131ad8c920.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/b8af6fb408814b1c8dcefc69beb68724.png
[2de1bfee449c4c8c9f3f2d893dfe2aa2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/22/deab65e7a6c6478c85eaa8a9e81370ac.png