Spring Security 介绍

Spring Security介绍

开源
提供企业级的安全认证和授权

Spring安全拦截器

认证管理器
- 认证模式
  - Basic
    
    HTTP 1.0中使用的认证方法，使用用户名和密码Base64编码的方式
    
    浏览器弹出对话框，用户输入用户名和密码，加入头部
    
    无状态
    
    安全性不足
  - Digest
    
    解决安全性问题
    
    浏览器对用户名和密码请求方法，URL等进行MD5运算，发送到服务器
    
    服务器获取到用户名密码，请求方法，URL等MD5运算，查看是否相等
    
    安全性问题依然存在
  - X.509
访问决策管理器
运行身份管理器

常用权限拦截器

Spring-Security拦截器链流程图

介绍几个常用的Filter

SecurityContextPersistenceFilter

基于ThreadLocal
LogoutFilter

发送注销请求时，清空用户的session,cookie，重定向
AbstractAuthenticationProcessingFilter

用户登录的请求
DefaultLoginPageGeneratingFilter

生成登录页面
BasicAuthencationFilter
SecurityContextHolderAwareRequestFilter

包装，提供额外的数据
RememberMeAuthemticationFilter

提供RememberMe功能，当cookie中存在rememberme时，登录成功后生成唯一cookie
ExceptionTranlationFilter

请求到对应的页面，响应异常

ExceptionTranslationFilter异常处理过滤器,该过滤器用来处理在系统认证授权过程中抛出的异常（也就是下一个过滤器FilterSecurityInterceptor）,主要是处理 AuthenticationException 和AccessDeniedException
SessionManagerFilter
FilterSecurityInterceptor（授权）

用户没有登录，抛出未登录异常

用户登录，但是没有权限访问该资源，抛出拒绝访问的异常

用户登录，有权限，则放行

此过滤器为认证授权过滤器链中最后一个过滤器，该过滤器之后就是请求真正的服务

Filter如何执行

FilterChainProxy会按照顺序调用一组Filter，完成授权验证

请求首先经过Servlet Filter链，这里面包含6个Filter

可以看到如下的一个Filter

ApplicationFilterConfig[name=springSecurityFilterChain, filterClass=org.springframework.boot.web.servlet.DelegatingFilterProxyRegistrationBean$1]

这个就是Spring Security Filter的入口，它的类型是DelegationFilterProxy

那么，这个DelegationFilterProxy到底执行了什么样的操作呢？可以简单看一下源码

重点看一下部分的源码：

public class DelegatingFilterProxy extends GenericFilterBean {

    // 类中的属性

    @Nullable

	private String contextAttribute;

	@Nullable

	private WebApplicationContext webApplicationContext;

	@Nullable

	private String targetBeanName;

	private boolean targetFilterLifecycle = false;

    /**

    * 重点在于这个属性

    */

	@Nullable

	private volatile Filter delegate;

	private final Object delegateMonitor = new Object();

    @Override

	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)

			throws ServletException, IOException {

		// Lazily initialize the delegate if necessary.

		Filter delegateToUse = this.delegate;

		if (delegateToUse == null) {

			synchronized (this.delegateMonitor) {

				delegateToUse = this.delegate;

				if (delegateToUse == null) {

					WebApplicationContext wac = findWebApplicationContext();

					if (wac == null) {

						throw new IllegalStateException("No WebApplicationContext found: " +

								"no ContextLoaderListener or DispatcherServlet registered?");

					}

					delegateToUse = initDelegate(wac);

				}

				this.delegate = delegateToUse;

			}

		}

		// Let the delegate perform the actual doFilter operation.

		invokeDelegate(delegateToUse, request, response, filterChain);

	}

    // .......

    /**

	 * Initialize the Filter delegate, defined as bean the given Spring

	 * application context.

	 * <p>The default implementation fetches the bean from the application context

	 * and calls the standard {@code Filter.init} method on it, passing

	 * in the FilterConfig of this Filter proxy.

	 * @param wac the root application context

	 * @return the initialized delegate Filter

	 * @throws ServletException if thrown by the Filter

	 */

	protected Filter initDelegate(WebApplicationContext wac) throws ServletException 	{

		String targetBeanName = getTargetBeanName();

		Assert.state(targetBeanName != null, "No target bean name set");

		Filter delegate = wac.getBean(targetBeanName, Filter.class);

		if (isTargetFilterLifecycle()) {

			delegate.init(getFilterConfig());

		}

		return delegate;

	}

    // 调用delegate的doFilter方法

    protected void invokeDelegate(

			Filter delegate, ServletRequest request, ServletResponse response, FilterChain filterChain)

			throws ServletException, IOException {

		delegate.doFilter(request, response, filterChain);

	}

}

根据以上代码的注释我们可以看出大概的执行流程

那类中的Filter delegate是什么呢？断点调式运行可以找到以下东西

这是Spring Security 提供的一个FilterChainProxy,关注其中的关键源码

public class FilterChainProxy extends GenericFilterBean {

    // 包含一组SecurityFilterChain

    private List<SecurityFilterChain> filterChains;

    @Override

	public void doFilter(ServletRequest request, ServletResponse response,

			FilterChain chain) throws IOException, ServletException {

		boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;

		if (clearContext) {

			try {

				request.setAttribute(FILTER_APPLIED, Boolean.TRUE);

				doFilterInternal(request, response, chain);

			}

			finally {

				SecurityContextHolder.clearContext();

				request.removeAttribute(FILTER_APPLIED);

			}

		}

		else {

			doFilterInternal(request, response, chain);

		}

	}

	private void doFilterInternal(ServletRequest request, ServletResponse response,

			FilterChain chain) throws IOException, ServletException {

		FirewalledRequest fwRequest = firewall

				.getFirewalledRequest((HttpServletRequest) request);

		HttpServletResponse fwResponse = firewall

				.getFirewalledResponse((HttpServletResponse) response);

        // 根据请求获取匹配的一组Filter

        // 这里返回的Filter就是上述的那些AuthenticationFilter,比如UsernamePasswordAuthenticationFilter

		List<Filter> filters = getFilters(fwRequest);

		if (filters == null || filters.size() == 0) {

			if (logger.isDebugEnabled()) {

				logger.debug(UrlUtils.buildRequestUrl(fwRequest)

						+ (filters == null ? " has no matching filters"

								: " has an empty filter list"));

			}

			fwRequest.reset();

			chain.doFilter(fwRequest, fwResponse);

			return;

		}

		VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters);

		vfc.doFilter(fwRequest, fwResponse);

	}

    /**

	 * Returns the first filter chain matching the supplied URL.

	 *

	 * @param request the request to match

	 * @return an ordered array of Filters defining the filter chain

	 */

	private List<Filter> getFilters(HttpServletRequest request) {

		for (SecurityFilterChain chain : filterChains) {

			if (chain.matches(request)) {

				return chain.getFilters();

			}

		}

		return null;

	}

}

到此，我们可以总结出如下的流程图：

巴特西

Spring Security 介绍

Spring Security介绍

常用权限拦截器

Filter如何执行

最新文章

热门文章