SpringSecurity6 | 核心过滤器

<beans:bean id="disableUrlEncodingFilter" class="org.springframework.security.web.servletapi.DisableEncodeUrlFilter"/>
<http>
    <intercept-url pattern="/somepattern" access="permitAll" />
    <custom-filter ref="disableUrlEncodingFilter" before="SECURITY_CONTEXT_FILTER" />
</http>

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
            .authorizeRequests()
                .antMatchers("/somepattern").permitAll()
                // 添加 DisableEncodeUrlFilter 到过滤器链中
                .and()
                .addFilterBefore(new DisableEncodeUrlFilter(), SecurityContextPersistenceFilter.class);
}

  private static final class DisableEncodeUrlResponseWrapper extends HttpServletResponseWrapper {
      private DisableEncodeUrlResponseWrapper(HttpServletResponse response) {
          super(response);
      }
// 直接返回，不重写
      public String encodeRedirectURL(String url) {
          return url;
      }
// 直接返回，不重写
      public String encodeURL(String url) {
          return url;
      }
  }

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             // ...其他配置
            .addFilter(new WebAsyncManagerIntegrationFilter()) // 添加WebAsyncManagerIntegrationFilter到过滤器链中
            // ...其他配置
}

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
	// shouldWriteHeadersEagerly 直接添加
    if (this.shouldWriteHeadersEagerly) {
        this.doHeadersBefore(request, response, filterChain);
    } else {
        this.doHeadersAfter(request, response, filterChain);
    }

}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
            // ...其他配置
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .and()
            .httpBasic();
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             // ...其他配置
            .csrf().disable(); // 禁用 CSRF 防护
}

// 请求之间持久化	 SecurityContext
private final SecurityContextRepository securityContextRepository;
// 一种针对线程存储 SecurityContext 策略。
private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
		.getContextHolderStrategy();

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
		throws ServletException, IOException {
	// 1. 获取属性 SecurityContextHolderFilter.class.getName() + ".APPLIED"
	// 存在说明当前请求已执行该过滤器
	if (request.getAttribute(FILTER_APPLIED) != null) {
		chain.doFilter(request, response);
		return;
	}
	// 2. 设置属性
	request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
	// 3. 存储中加载 SecurityContext
	Supplier<SecurityContext> deferredContext = this.securityContextRepository.loadDeferredContext(request);
	try {
		// 4. 将SecurityContext 设置到ContextHolder中
		this.securityContextHolderStrategy.setDeferredContext(deferredContext);
		chain.doFilter(request, response);
	}
	finally {
		// 完成后，清理上下文，移除属性
		this.securityContextHolderStrategy.clearContext();
		request.removeAttribute(FILTER_APPLIED);
	}
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             // ...其他配置
            .addFilterBefore(new SecurityContextHolderFilter(), UsernamePasswordAuthenticationFilter.class)
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin();
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	// 1. 查看当前请求路径是否登出，默认登出路径为/logout
	if (requiresLogout(request, response)) {
		// 2. 获取线程中的认证信息
		Authentication auth = this.securityContextHolderStrategy.getContext().getAuthentication();
		if (this.logger.isDebugEnabled()) {
			this.logger.debug(LogMessage.format("Logging out [%s]", auth));
		}
		// 3. 调用登出处理器处理
		this.handler.logout(request, response, auth);
		// 4. 登出成功处理器，跳转到指定页面
		this.logoutSuccessHandler.onLogoutSuccess(request, response, auth);
		return;
	}
	chain.doFilter(request, response);
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
            // ...其他配置
            .logout()
                .logoutUrl("/custom-logout") // 自定义注销 URL
                .logoutSuccessUrl("/logout-success") // 注销成功后的跳转页面
                .addLogoutHandler(new CustomLogoutHandler()) // 添加自定义的注销处理器
                .invalidateHttpSession(true) // 使当前会话失效
                .deleteCookies("JSESSIONID") // 删除指定的 Cookie
                .permitAll()
                .and()
            // ...其他配置
}

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
		throws AuthenticationException {
	// 1. 校验请求方式
	if (this.postOnly && !request.getMethod().equals("POST")) {
		throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
	}
	// 2. 获取请求参数中的用户名、密码
	String username = obtainUsername(request);
	username = (username != null) ? username.trim() : "";
	String password = obtainPassword(request);
	password = (password != null) ? password : "";
	// 3. 创建认证令牌
	UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username,
			password);
	// Allow subclasses to set the "details" property
	setDetails(request, authRequest);
	// 4. 认证管理器进行认证
	return this.getAuthenticationManager().authenticate(authRequest);
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login") // 自定义登录页面
                .permitAll()
                .and()
            .addFilterBefore(new UsernamePasswordAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	boolean loginError = isErrorPage(request); // 是否登录错误 /login?error
	boolean logoutSuccess = isLogoutSuccess(request); // 是否登录成功 /login?logout
	if (isLoginUrlRequest(request) || loginError || logoutSuccess) {
		//1.  /login?error、/login?logout、/login 三种请求URL中的任意一种会进入该方法
		//2. 生成登录页
		String loginPageHtml = generateLoginPageHtml(request, loginError, logoutSuccess);
		response.setContentType("text/html;charset=UTF-8");
		response.setContentLength(loginPageHtml.getBytes(StandardCharsets.UTF_8).length);
		//3. 直接写出，并结束
		response.getWriter().write(loginPageHtml);
		return;
	}
	chain.doFilter(request, response);
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
              .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .and()
            .addFilterBefore(new DefaultLoginPageGeneratingFilter(), UsernamePasswordAuthenticationFilter.class);
}

@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		try {
			UsernamePasswordAuthenticationToken authRequest = this.authenticationConverter.convert(request);
			if (authRequest == null) {
				this.logger.trace("Did not process authentication request since failed to find "
						+ "username and password in Basic Authorization header");
				chain.doFilter(request, response);
				return;
			}
			String username = authRequest.getName();
			this.logger.trace(LogMessage.format("Found username '%s' in Basic Authorization header", username));
			if (authenticationIsRequired(username)) {
				Authentication authResult = this.authenticationManager.authenticate(authRequest);
				SecurityContext context = this.securityContextHolderStrategy.createEmptyContext();
				context.setAuthentication(authResult);
				this.securityContextHolderStrategy.setContext(context);
				if (this.logger.isDebugEnabled()) {
					this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", authResult));
				}
				this.rememberMeServices.loginSuccess(request, response, authResult);
				this.securityContextRepository.saveContext(context, request, response);
				onSuccessfulAuthentication(request, response, authResult);
			}
		}
		catch (AuthenticationException ex) {
			this.securityContextHolderStrategy.clearContext();
			this.logger.debug("Failed to process authentication request", ex);
			this.rememberMeServices.loginFail(request, response);
			onUnsuccessfulAuthentication(request, response, ex);
			if (this.ignoreFailure) {
				chain.doFilter(request, response);
			}
			else {
				this.authenticationEntryPoint.commence(request, response, ex);
			}
			return;
		}

		chain.doFilter(request, response);
	}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             // ... 其他配置
            .addFilterBefore(new RequestCacheAwareFilter(), UsernamePasswordAuthenticationFilter.class);
}

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	// 1. 获取缓存请求
	HttpServletRequest wrappedSavedRequest = this.requestCache.getMatchingRequest((HttpServletRequest) request,
			(HttpServletResponse) response);
	// 2. 存在则传递之前缓存的请求对象
	chain.doFilter((wrappedSavedRequest != null) ? wrappedSavedRequest : request, response);
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             // ... 其他配置
            .addFilterBefore(new RequestCacheAwareFilter(), UsernamePasswordAuthenticationFilter.class);
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
               // ... 其他配置
            .addFilterBefore(new SecurityContextHolderAwareRequestFilter(), UsernamePasswordAuthenticationFilter.class);
}

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
		throws IOException, ServletException {
	Supplier<SecurityContext> deferredContext = this.securityContextHolderStrategy.getDeferredContext();
	this.securityContextHolderStrateg.setDeferredContext(defaultWithAnonymous((HttpServletRequest) req, deferredContext));
	chain.doFilter(req, res);
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .and()
            .addFilterBefore(new AnonymousAuthenticationFilter("anonymousUser"), UsernamePasswordAuthenticationFilter.class);
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	try {
		chain.doFilter(request, response);
	}
	catch (IOException ex) {
		throw ex;
	}
	catch (Exception ex) {
		// 1. 尝试从堆栈中提取 SpringSecurity异常
		// Try to extract a SpringSecurityException from the stacktrace
		Throwable[] causeChain = this.throwableAnalyzer.determineCauseChain(ex);
		// 2. 分析异常是否 AuthenticationException
		RuntimeException securityException = (AuthenticationException) this.throwableAnalyzer
				.getFirstThrowableOfType(AuthenticationException.class, causeChain);
		// 3. 没有AuthenticationException,则获取AccessDeniedException
		if (securityException == null) {
			securityException = (AccessDeniedException) this.throwableAnalyzer
					.getFirstThrowableOfType(AccessDeniedException.class, causeChain);
		}
		// 4. 不是AuthenticationException、AccessDeniedException直接抛出
		if (securityException == null) {
			rethrow(ex);
		}
		if (response.isCommitted()) {
			throw new ServletException("Unable to handle the Spring Security Exception "
					+ "because the response is already committed.", ex);
		}
		// 5. 处理异常
		handleSpringSecurityException(request, response, chain, securityException);
	}
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
             .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .and()
            .exceptionHandling()
                .accessDeniedPage("/403") // 配置访问拒绝时的页面
                .and()
            .addFilterBefore(new ExceptionTranslationFilter(), FilterSecurityInterceptor.class);
}

 public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
     HttpServletRequest request = (HttpServletRequest)servletRequest;
     HttpServletResponse response = (HttpServletResponse)servletResponse;
     // 1. 如果设置了监控每一次请求，并且当前过滤器已经执行，则直接跳过
     if (this.observeOncePerRequest && this.isApplied(request)) {
         chain.doFilter(request, response);
     } else if (this.skipDispatch(request)) {
     	// 2. 如果是访问错误页面，则直接跳过
         chain.doFilter(request, response);
     } else {
// 3. 设置已执行当前过滤器 
// org.springframework.security.web.access.intercept.AuthorizationFilter@5707f613.APPLIED
         String alreadyFilteredAttributeName = this.getAlreadyFilteredAttributeName();
         request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);

         try {
         	// 4. 调用AuthorizationManager 检查当前是否有权限
             AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, request);
             // 5. 发布授权事件
             this.eventPublisher.publishAuthorizationEvent(this::getAuthentication, request, decision);
             // 6. 如果未被授权，抛出 AccessDeniedException
             if (decision != null && !decision.isGranted()) {
                 throw new AccessDeniedException("Access Denied");
             }
             chain.doFilter(request, response);
         } finally {
             request.removeAttribute(alreadyFilteredAttributeName);
         }

     }
 }

public FilterChainProxy(List<SecurityFilterChain> filterChains) {
 // 上下文持有者（当前认证主体一些信息）策略，默认：ThreadLocal
 this.securityContextHolderStrategy = SecurityContextHolder.getContextHolderStrategy();
 // 过滤器链校验
	this.filterChainValidator = new NullFilterChainValidator();
 // Http防火墙
 this.firewall = new StrictHttpFirewall();
 // 请求被拒绝处理程序
 this.requestRejectedHandler = new HttpStatusRequestRejectedHandler();
 // 异常解析器
 this.throwableAnalyzer = new ThrowableAnalyzer();
 // 虚拟的过滤器链装饰器
 this.filterChainDecorator = new VirtualFilterChainDecorator();
 // Security 过滤器链集合，默认只有一个DefaultSecurityFilterChain
 this.filterChains = filterChains;
}

private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	// 1. 防火墙校验，将请求和响应进行包装
	// 1.1 请求方式是否被允许
	// 1.2 URL 是否规范
	// 1.3 远程IP是否黑名单
	// 1.4 拒绝字段名称中的不可打印Ascii字符
	// 1.5 请求对象是否规范
	FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest) request);
	HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse) response);
	// 取出所有过滤器链中的所有过滤器
	List<Filter> filters = getFilters(firewallRequest);
	FilterChain reset = (req, res) -> {
		if (logger.isDebugEnabled()) {
			logger.debug(LogMessage.of(() -> "Secured " + requestLine(firewallRequest)));
		}
		// Deactivate path stripping as we exit the security filter chain
		firewallRequest.reset();
		chain.doFilter(req, res);
	};
	// 对过滤器链进行装饰，并调用装饰类的doFilter 方法
	this.filterChainDecorator.decorate(reset, filters).doFilter(firewallRequest, firewallResponse);
}

public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
	// 1. 当前被调用过滤器的位置（初始值为0）是否等于过滤器数量（默认15）
	if (this.currentPosition == this.size) {
		// 位置变为过滤器数量大小时，说明全部执行完毕，调用过滤器链执行过滤器（不再是Spring Security 中的过滤器了）
		this.originalChain.doFilter(request, response);
		return;
	}
	// 2. 位置加1
	this.currentPosition++;
	// 3. 获取当前过滤器
	Filter nextFilter = this.additionalFilters.get(this.currentPosition - 1);
	if (logger.isTraceEnabled()) {
		String name = nextFilter.getClass().getSimpleName();
		logger.trace(LogMessage.format("Invoking %s (%d/%d)", name, this.currentPosition, this.size));
	}
	// 4. 执行过滤器
	nextFilter.doFilter(request, response, this);
}