Spring Security的核心脉络

• SecurityBuilder
• HttpSecurity
• WebSecurity
• SecurityFilterChain
• FilterChainProxy

Spring Security 进入流程：

FilterChainProxy -> 根据请求确定使用哪一个SecurityFilterChain -> 执行SecurityFilterChain中对应的多个filter

核心成员

SecurityBuilder为了构建一个指定的泛型对象，HttpSecurity和WebSecurity、AuthenticationManagerBuilder都实现了此接口

public interface SecurityBuilder<O> {
O build() throws Exception;
}

WebSecurity为了构建一个Filter，最终会调用WebSecurity.performBuild构建一个FilterChainProxy的一个Filter对象。

public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter, WebSecurity>
implements SecurityBuilder<Filter>, ApplicationContextAware, ServletContextAware {

HttpSecurity为了构建一个DefaultSecurityFilterChain，也是通过HttpSecurity.preformBuild来构建的

public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain, HttpSecurity>
implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity> {

// 构建DefaultSecurityFilterChain
protected DefaultSecurityFilterChain performBuild() {}


}

SecurityFilterChain为了匹配一个request请求，并确定当前应用是否可以应用多个Filter。一般情况下应用程序只会构建一个SecurityFilterChain

/**
 * Defines a filter chain which is capable of being matched against an
 * {@code HttpServletRequest}. in order to decide whether it applies to that request.
 */
public interface SecurityFilterChain {

boolean matches(HttpServletRequest request);

List<Filter> getFilters();

}

FilterChainProxy 就是一个普通的Filter,主要匹配request请求获取SecurityFilterChain中的filter集合，挨个的执行filter。

private List<SecurityFilterChain> filterChains;

private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
   FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest) request);
   HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse) response);
// 根据request请求从filterChains中取出匹配到的SecurityFilterChain并将其中对用的Filter返回
   List<Filter> filters = getFilters(firewallRequest);
   VirtualFilterChain virtualFilterChain = new VirtualFilterChain(firewallRequest, chain, filters);
// 通过责任链的方式调用匹配到的filter
   virtualFilterChain.doFilter(firewallRequest, firewallResponse);
}

欢迎加入 DevXTalk 的技术交流群,在这里你可以和大佬们一起交流分享技术,行业经验,提升自我。 结识新的业内朋友，扩大自己的圈子，当你想换工作的时候也许就能拿到不错的 offer 。总之期待你的加入...

「看完本文有收获？转发给更多的朋友吧」

「DevXTalk 不止于技术」