4.1 过滤链源码分析

4.1.1 过滤器链加载流程分析

4.1.2 过滤器链加载流程源码分析

  1. SpringBoot的自动配置会加载spring.factories文件，在文件中有针对Spring Security的过滤器链 的配置信息org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoConfiguration，表明过滤器链的自动配置类是SecurityFilterAutoConfiguration类。
  2. SecurityFilterAutoConfiguration类 以及相关导入的类 ```java @Configuration( proxyBeanMethods = false ) @ConditionalOnWebApplication( type = Type.SERVLET ) @EnableConfigurationProperties({SecurityProperties.class}) @ConditionalOnClass({AbstractSecurityWebApplicationInitializer.class, SessionCreationPolicy.class}) // 在SecurityFilterAutoConfiguration类加载完成后加载SecurityAutoConfiguration类 @AutoConfigureAfter({SecurityAutoConfiguration.class}) public class SecurityFilterAutoConfiguration {

}

  2. ```java
  3. @Configuration(
  4.     proxyBeanMethods = false
  5. )
  6. @ConditionalOnClass({DefaultAuthenticationEventPublisher.class})
  7. @EnableConfigurationProperties({SecurityProperties.class}) // 定义默认的用户名和密码
  8. @Import({SpringBootWebSecurityConfiguration.class, WebSecurityEnablerConfiguration.class, SecurityDataConfiguration.class})
  9. public class SecurityAutoConfiguration {
  10.     public SecurityAutoConfiguration() {
  11.     }
  13.     @Bean
  14.     @ConditionalOnMissingBean({AuthenticationEventPublisher.class})
  15.     public DefaultAuthenticationEventPublisher authenticationEventPublisher(ApplicationEventPublisher publisher) {
  16.         return new DefaultAuthenticationEventPublisher(publisher);
  17.     }
  18. }

SecurityProperties类：定义默认的用户名和密码

  1. @ConfigurationProperties(
  2.     prefix = "spring.security"
  3. )
  4. public class SecurityProperties {
  5.     public static final int BASIC_AUTH_ORDER = 2147483642;
  6.     public static final int IGNORED_ORDER = -2147483648;
  7.     public static final int DEFAULT_FILTER_ORDER = -100;
  8.     private final SecurityProperties.Filter filter = new SecurityProperties.Filter();
  9.     private final SecurityProperties.User user = new SecurityProperties.User();
  11.     public SecurityProperties() {
  12.     }
  14.     public SecurityProperties.User getUser() {
  15.         return this.user;
  16.     }
  18.     public SecurityProperties.Filter getFilter() {
  19.         return this.filter;
  20.     }
  22.     // 定义了自动配置的user，也就是未连接数据库我们启动时可以使用登录的用户密码
  23.     public static class User {
  24.         private String name = "user";
  25.         private String password = UUID.randomUUID().toString();
  26.         private List<String> roles = new ArrayList();
  27.         private boolean passwordGenerated = true;
  29.         public User() {
  30.         }
  32.         public String getName() {
  33.             return this.name;
  34.         }
  36.         public void setName(String name) {
  37.             this.name = name;
  38.         }
  40.         public String getPassword() {
  41.             return this.password;
  42.         }
  44.         public void setPassword(String password) {
  45.             if (StringUtils.hasLength(password)) {
  46.                 this.passwordGenerated = false;
  47.                 this.password = password;
  48.             }
  49.         }
  51.         public List<String> getRoles() {
  52.             return this.roles;
  53.         }
  55.         public void setRoles(List<String> roles) {
  56.             this.roles = new ArrayList(roles);
  57.         }
  59.         public boolean isPasswordGenerated() {
  60.             return this.passwordGenerated;
  61.         }
  62.     }
  64.     public static class Filter {
  65.         private int order = -100;
  66.         private Set<DispatcherType> dispatcherTypes;
  68.         public Filter() {
  69.             this.dispatcherTypes = new HashSet(Arrays.asList(DispatcherType.ASYNC, DispatcherType.ERROR, DispatcherType.REQUEST));
  70.         }
  72.         public int getOrder() {
  73.             return this.order;
  74.         }
  76.         public void setOrder(int order) {
  77.             this.order = order;
  78.         }
  80.         public Set<DispatcherType> getDispatcherTypes() {
  81.             return this.dispatcherTypes;
  82.         }
  84.         public void setDispatcherTypes(Set<DispatcherType> dispatcherTypes) {
  85.             this.dispatcherTypes = dispatcherTypes;
  86.         }
  87.     }
  88. }

WebSecurityEnablerConfiguration类：开启web安全启动配置

  1. @Configuration(
  2.     proxyBeanMethods = false
  3. )
  4. @ConditionalOnMissingBean(
  5.     name = {"springSecurityFilterChain"}
  6. )
  7. @ConditionalOnClass({EnableWebSecurity.class})
  8. @ConditionalOnWebApplication(
  9.     type = Type.SERVLET
  10.     )
  11.     @EnableWebSecurity // 开启Security安全功能
  12.     class WebSecurityEnablerConfiguration {
  13.     WebSecurityEnablerConfiguration() {
  14.     }
  15. }

EnableWebSecurity注解类：开启security安全功能

  1. @Retention(RetentionPolicy.RUNTIME)
  2. @Target({ElementType.TYPE})
  3. @Documented
  4. @Import({WebSecurityConfiguration.class, SpringWebMvcImportSelector.class, OAuth2ImportSelector.class, HttpSecurityConfiguration.class})
  5. @EnableGlobalAuthentication
  6. @Configuration
  7. public @interface EnableWebSecurity {
  8.     boolean debug() default false;
  9. }

WebSecurityConfiguration类：安全配置类，生成过滤器链

  1. @Configuration(
  2.     proxyBeanMethods = false
  3. )
  4. public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
  6.     // 此方法返回的就是过滤器链
  7.     @Bean(
  8.         name = {"springSecurityFilterChain"}
  9.     )
  10.     public Filter springSecurityFilterChain() throws Exception {
  11.         boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();
  12.         boolean hasFilterChain = !this.securityFilterChains.isEmpty();
  13.         Assert.state(!hasConfigurers || !hasFilterChain, "Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.");
  14.         if (!hasConfigurers && !hasFilterChain) {
  15.             WebSecurityConfigurerAdapter adapter = (WebSecurityConfigurerAdapter)this.objectObjectPostProcessor.postProcess(new WebSecurityConfigurerAdapter() {
  16.             });
  17.             this.webSecurity.apply(adapter);
  18.         }
  20.         Iterator var7 = this.securityFilterChains.iterator();
  22.         while(true) {
  23.             while(var7.hasNext()) {
  24.                 SecurityFilterChain securityFilterChain = (SecurityFilterChain)var7.next();
  25.                 this.webSecurity.addSecurityFilterChainBuilder(() -> {
  26.                     return securityFilterChain;
  27.                 });
  28.                 Iterator var5 = securityFilterChain.getFilters().iterator();
  30.                 while(var5.hasNext()) {
  31.                     Filter filter = (Filter)var5.next();
  32.                     if (filter instanceof FilterSecurityInterceptor) {
  33.                         this.webSecurity.securityInterceptor((FilterSecurityInterceptor)filter);
  34.                         break;
  35.                     }
  36.                 }
  37.             }
  39.             var7 = this.webSecurityCustomizers.iterator();
  41.             while(var7.hasNext()) {
  42.                 WebSecurityCustomizer customizer = (WebSecurityCustomizer)var7.next();
  43.                 customizer.customize(this.webSecurity);
  44.             }
  46.             return (Filter)this.webSecurity.build();
  47.         }
  48.     }
  50. }

生成过滤器链的过程，就是会读取我们自己编写的配置类，设置相关的过滤器信息到configure上，还有一些默认的过滤器也设置到configure，然后对configure进行一个个初始化，生成相应的过滤器类，最后对生成的过滤器进行排序返回。

4.2 认证源码分析

4.2.1 认证流程分析

4. Spring Security源码分析 - 图1

4.2.2 认证流程源码跟踪

  • UsernamePasswordAuthenticationFilter

    1. public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    3.   public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
    4.       // 先判断是不是POST请求，不是则抛出异常
    5.       if (this.postOnly && !request.getMethod().equals("POST")) {
    6.           throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
    7.       } else {
    8.           // 从request请求中通过配置的参数获取用户名密码
    9.           String username = this.obtainUsername(request);
    10.           username = username != null ? username : "";
    11.           username = username.trim();
    12.           String password = this.obtainPassword(request);
    13.           password = password != null ? password : "";
    14.           // 创建UsernamePasswordAuthenticationToken
    15.           UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
    16.           this.setDetails(request, authRequest);
    17.           // 调用认证管理器的认证方法
    18.           // 验证完成后就到父类的doFilter()方法，负责把认证信息放入SercurityContext
    19.           // 然后调用SuceessHandler来处理登录成功逻辑
    20.           return this.getAuthenticationManager().authenticate(authRequest);
    21.       }
    22.   }
    23. }

  • ProviderManager

    1. public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
    2.   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    3.       Class<? extends Authentication> toTest = authentication.getClass();
    4.       AuthenticationException lastException = null;
    5.       AuthenticationException parentException = null;
    6.       Authentication result = null;
    7.       Authentication parentResult = null;
    8.       int currentPosition = 0;
    9.       int size = this.providers.size();
    10.       // 获取providers，发现两个都不支持解析UsernamePasswordAuthenticationToken
    11.       Iterator var9 = this.getProviders().iterator();
    13.       while(var9.hasNext()) {
    14.           AuthenticationProvider provider = (AuthenticationProvider)var9.next();
    15.           // 判断支不支持
    16.           if (provider.supports(toTest)) {
    17.               if (logger.isTraceEnabled()) {
    18.                   Log var10000 = logger;
    19.                   String var10002 = provider.getClass().getSimpleName();
    20.                   ++currentPosition;
    21.                   var10000.trace(LogMessage.format("Authenticating request with %s (%d/%d)", var10002, currentPosition, size));
    22.               }
    24.               try {
    25.                   // 验证方法
    26.                   result = provider.authenticate(authentication);
    27.                   if (result != null) {
    28.                       this.copyDetails(authentication, result);
    29.                       break;
    30.                   }
    31.               } catch (InternalAuthenticationServiceException | AccountStatusException var14) {
    32.                   this.prepareException(var14, authentication);
    33.                   throw var14;
    34.               } catch (AuthenticationException var15) {
    35.                   lastException = var15;
    36.               }
    37.           }
    38.       }
    40.       if (result == null && this.parent != null) {
    41.           try {
    42.               // 判断两个认证器都不支持，所以交给父类去验证
    43.               // 父类同样是执行这个方法，发现Providers是DaoAuthenticationProvider
    44.               // provider.supports(toTest)判断时是
    45.               // 支持UsernamePasswordAuthenticationToken的
    46.               parentResult = this.parent.authenticate(authentication);
    47.               result = parentResult;
    48.           } catch (ProviderNotFoundException var12) {
    49.           } catch (AuthenticationException var13) {
    50.               parentException = var13;
    51.               lastException = var13;
    52.           }
    53.       }
    55.       if (result != null) {
    56.           if (this.eraseCredentialsAfterAuthentication && result instanceof CredentialsContainer) {
    57.               ((CredentialsContainer)result).eraseCredentials();
    58.           }
    60.           if (parentResult == null) {
    61.               this.eventPublisher.publishAuthenticationSuccess(result);
    62.           }
    64.           return result;
    65.       } else {
    66.           if (lastException == null) {
    67.               lastException = new ProviderNotFoundException(this.messages.getMessage("ProviderManager.providerNotFound", new Object[]{toTest.getName()}, "No AuthenticationProvider found for {0}"));
    68.           }
    70.           if (parentException == null) {
    71.               this.prepareException((AuthenticationException)lastException, authentication);
    72.           }
    74.           throw lastException;
    75.       }
    76.   }
    77. }

  • AbstractUserDetailsAuthenticationProvider: ProviderManager中调用的的result = provider.authenticate(authentication)方法

    1. public abstract class AbstractUserDetailsAuthenticationProvider implements AuthenticationProvider, InitializingBean, MessageSourceAware {
    2.   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    3.       Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication, () -> {
    4.           return this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.onlySupports", "Only UsernamePasswordAuthenticationToken is supported");
    5.       });
    6.       // 获取用户名
    7.       String username = this.determineUsername(authentication);
    8.       boolean cacheWasUsed = true;
    9.       // 通过用户名查询缓存中的user信息
    10.       UserDetails user = this.userCache.getUserFromCache(username);
    11.       if (user == null) {
    12.           cacheWasUsed = false;
    14.           try {
    15.               // 检查user信息
    16.               user = this.retrieveUser(username, (UsernamePasswordAuthenticationToken)authentication);
    17.           } catch (UsernameNotFoundException var6) {
    18.               this.logger.debug("Failed to find user '" + username + "'");
    19.               if (!this.hideUserNotFoundExceptions) {
    20.                   throw var6;
    21.               }
    23.               throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
    24.           }
    26.           Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
    27.       }
    29.       try {
    30.           // 检查用户是否锁定、启用等等
    31.           this.preAuthenticationChecks.check(user);
    32.           // 检查用户是否合法，比对参数：user是数据库查询的，authentication是前端传的
    33.           this.additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken)authentication);
    34.       } catch (AuthenticationException var7) {
    35.           if (!cacheWasUsed) {
    36.               throw var7;
    37.           }
    39.           cacheWasUsed = false;
    40.           user = this.retrieveUser(username, (UsernamePasswordAuthenticationToken)authentication);
    41.           this.preAuthenticationChecks.check(user);
    42.           this.additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken)authentication);
    43.       }
    45.       this.postAuthenticationChecks.check(user);
    46.       if (!cacheWasUsed) {
    47.           // 检查无误则把user放入缓存
    48.           this.userCache.putUserInCache(user);
    49.       }
    51.       Object principalToReturn = user;
    52.       if (this.forcePrincipalAsString) {
    53.           principalToReturn = user.getUsername();
    54.       }
    55.       // 创建新的UsernamePasswordAuthenticationToken，已认证的，有授权信息的
    56.       return this.createSuccessAuthentication(principalToReturn, authentication, user);
    57.   }
    58. }

  • DaoAuthenticationProvider: 上一步代码调用的检查user方法user = this.retrieveUser(username, (UsernamePasswordAuthenticationToken)authentication)

    1. public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
    2.   protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
    3.       this.prepareTimingAttackProtection();
    5.       try {
    6.           // 调用我们自定义的MyUserDetailsService来获取UserDetails然后返回
    7.           UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
    8.           if (loadedUser == null) {
    9.               throw new InternalAuthenticationServiceException("UserDetailsService returned null, which is an interface contract violation");
    10.           } else {
    11.               return loadedUser;
    12.           }
    13.       } catch (UsernameNotFoundException var4) {
    14.           this.mitigateAgainstTimingAttack(authentication);
    15.           throw var4;
    16.       } catch (InternalAuthenticationServiceException var5) {
    17.           throw var5;
    18.       } catch (Exception var6) {
    19.           throw new InternalAuthenticationServiceException(var6.getMessage(), var6);
    20.       }
    21.   }
    23.   // 上一步代码调用的
    24.   protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
    25.       if (authentication.getCredentials() == null) {
    26.           this.logger.debug("Failed to authenticate since no credentials provided");
    27.           throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
    28.       } else {
    29.           // 获取密码并比对数据库与前端的密码
    30.           String presentedPassword = authentication.getCredentials().toString();
    31.           if (!this.passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {
    32.               this.logger.debug("Failed to authenticate since password does not match stored value");
    33.               throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
    34.           }
    35.       }
    36.   }
    37. }

4.2.3 总结

  1. 调用UsernamePasswordAuthenticationFilter类，从request中通过配置的参数取出账号密码，然后用账号密码生成UsernamePasswordAuthenticationToken，此时的token是未认证的。
  2. 调用认证管理器ProviderManager的认证方法authenticate(Authentication authentication)进行认证。
  • 先匹配provider，通过比对发现DaoAuthenticationProvider支持UsernamePasswordAuthenticationToken的解析，然后调用provider.authenticate(authentication)进行验证。
  1. 验证其实是调用AbstractUserDetailsAuthenticationProvider中的authenticate(authentication)方法
  • 获取用户名，查询user有没有缓存，没有则调用this.retrieveUser(username, (UsernamePasswordAuthenticationToken)authentication)进行user检查。
  • 对user进行前置检查，主要检查用户是否锁定，是否启用等等。
  • this.additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken)authentication)检查用户是否合法，两个参数分别数据库查询的user和前端传的认证信息，来进行密码的比对。
  • 检查无误把user放入缓存。
  • 创建新的UsernamePasswordAuthenticationToken，已认证的，有授权信息的。
  1. 上一步的this.retrieveUser和this.additionalAuthenticationChecks都是在DaoAuthenticationProvider类中实现的。
  • this.retrieveUser：调用我们自定义的UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username)，得到userDetails信息并返回。
  • this.additionalAuthenticationChecks：获取密码并比对前端与数据库的密码是否一致。
  1. 验证完成后就到UsernamePasswordAuthenticationFilter父类的doFilter()方法，负责把认证信息放入SercurityContext，以便后续我们可以通过SercurityContext获取认证信息，然后调用SuceessHandler来处理登录成功逻辑。

4.3 rememberMe源码分析

4.4 Csrf源码分析

4.4.1 csrf流程分析

4. Spring Security源码分析 - 图2

4.4.2 csrf源码跟踪

  • CsrfFilter

    1. public final class CsrfFilter extends OncePerRequestFilter {
    3.   protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    4.       request.setAttribute(HttpServletResponse.class.getName(), response);
    5.       CsrfToken csrfToken = this.tokenRepository.loadToken(request);
    6.       boolean missingToken = csrfToken == null;
    7.       if (missingToken) {
    8.           // 生成token并封装，token值就是通过UUID生成
    9.           csrfToken = this.tokenRepository.generateToken(request);
    10.           this.tokenRepository.saveToken(csrfToken, request, response);
    11.       }
    13.       // 把token放入request请求域中
    14.       request.setAttribute(CsrfToken.class.getName(), csrfToken);
    15.       request.setAttribute(csrfToken.getParameterName(), csrfToken);
    16.       if (!this.requireCsrfProtectionMatcher.matches(request)) {
    17.           if (this.logger.isTraceEnabled()) {
    18.               this.logger.trace("Did not protect against CSRF since request did not match " + this.requireCsrfProtectionMatcher);
    19.           }
    20.           // 执行doFilter放行，放行到页面时要取出csrfToken的值，其实就是执行getToken方法
    21.           // 其实就是执行SaveOnAccessCsrfToken的getToken方法
    22.           filterChain.doFilter(request, response);
    23.       } else {
    24.           String actualToken = request.getHeader(csrfToken.getHeaderName());
    25.           if (actualToken == null) {
    26.               actualToken = request.getParameter(csrfToken.getParameterName());
    27.           }
    29.           if (!equalsConstantTime(csrfToken.getToken(), actualToken)) {
    30.               this.logger.debug(LogMessage.of(() -> {
    31.                   return "Invalid CSRF token found for " + UrlUtils.buildFullRequestUrl(request);
    32.               }));
    33.               AccessDeniedException exception = !missingToken ? new InvalidCsrfTokenException(csrfToken, actualToken) : new MissingCsrfTokenException(actualToken);
    34.               this.accessDeniedHandler.handle(request, response, (AccessDeniedException)exception);
    35.           } else {
    36.               filterChain.doFilter(request, response);
    37.           }
    38.       }
    39.   }
    40. }

  • LazyCsrfTokenRepository

    1. public final class LazyCsrfTokenRepository implements CsrfTokenRepository {
    2.   private static final class SaveOnAccessCsrfToken implements CsrfToken {
    3.       public String getToken() {
    4.           // 把token存到session当中
    5.           this.saveTokenIfNecessary();
    6.           // 获取token返回
    7.           return this.delegate.getToken();
    8.       }
    9.   }
    10. }

第一次请求总结：第一次请求页面的时候，会通过CsrfFilter来拦截请求，生成token并且封装放入request请求域中（token值是通过UUID生成），然后页面通过${_csrf.token}取值的时候，其实就是调用SaveOnAccessCsrfToken的getToken方法，将token保存到session域中，然后返回token值，这样，我们的页面上就有csrfToken的值了，下次请求就会带上这个token值。

第二次请求总结：this.tokenRepository.loadToken(request)可以从session中获取到csrfToken的值并返回，然后通过页面传过来的token值与session域中的token值进行比对，然后放行。

4.5 授权源码分析

在整个过滤器链中, FilterSecurityInterceptor是来处理整个用户授权流程的, 也是距离用户API最后一
个非常重要的过滤器链。

4.5.1 授权流程分析

4. Spring Security源码分析 - 图3

  • AffirmativeBased（基于肯定）的逻辑是: 一票通过权
  • ConsensusBased（基于共识）的逻辑是: 赞成票多于反对票则表示通过,反对票多于赞成票则将抛出 AccessDeniedException
  • UnanimousBased（基于一致）的逻辑:一票否决权

总结：FilterSecurityInterceptor类通过读取系统配置，获得了用户权限，然后交给AccessDecisionManager类去调用决策器AccessDecisionVoter进行权限认证，决策策略如上三种所示，决策通过则可以调用API，决策不通过则抛出异常，可以被异常过滤器ExceptionTranslationFilter捕获。

4.5.2 授权源码跟踪

  • FilterSecurityInterceptor

    1. public class FilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {
    3.   public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    4.       this.invoke(new FilterInvocation(request, response, chain));
    5.   }
    7.   public void invoke(FilterInvocation filterInvocation) throws IOException, ServletException {
    8.       if (this.isApplied(filterInvocation) && this.observeOncePerRequest) {
    9.           filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse());
    10.       } else {
    11.           if (filterInvocation.getRequest() != null && this.observeOncePerRequest) {
    12.               filterInvocation.getRequest().setAttribute("__spring_security_filterSecurityInterceptor_filterApplied", Boolean.TRUE);
    13.           }
    14.           // 前置处理
    15.           InterceptorStatusToken token = super.beforeInvocation(filterInvocation);
    17.           try {
    18.               filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse());
    19.           } finally {
    20.               super.finallyInvocation(token);
    21.           }
    23.           super.afterInvocation(token, (Object)null);
    24.       }
    25.   }
    26. }

  • AbstractSecurityInterceptor

    1. public abstract class AbstractSecurityInterceptor implements InitializingBean, ApplicationEventPublisherAware, MessageSourceAware {
    3.   protected InterceptorStatusToken beforeInvocation(Object object) {
    4.       Assert.notNull(object, "Object was null");
    5.       if (!this.getSecureObjectClass().isAssignableFrom(object.getClass())) {
    6.           throw new IllegalArgumentException("Security invocation attempted for object " + object.getClass().getName() + " but AbstractSecurityInterceptor only configured to support secure objects of type: " + this.getSecureObjectClass());
    7.       } else {
    8.           // 获取我们在配置类中编写的权限列表（antMatch的配置）
    9.           // getAttributes()通过遍历权限列表，匹配到与当前请求url相同的权限，并返回
    10.           Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource().getAttributes(object);
    11.           if (CollectionUtils.isEmpty(attributes)) {
    12.               Assert.isTrue(!this.rejectPublicInvocations, () -> {
    13.                   return "Secure object invocation " + object + " was denied as public invocations are not allowed via this interceptor. This indicates a configuration error because the rejectPublicInvocations property is set to 'true'";
    14.               });
    15.               if (this.logger.isDebugEnabled()) {
    16.                   this.logger.debug(LogMessage.format("Authorized public object %s", object));
    17.               }
    19.               this.publishEvent(new PublicInvocationEvent(object));
    20.               return null;
    21.           } else {
    22.               if (SecurityContextHolder.getContext().getAuthentication() == null) {
    23.                   this.credentialsNotFound(this.messages.getMessage("AbstractSecurityInterceptor.authenticationNotFound", "An Authentication object was not found in the SecurityContext"), object, attributes);
    24.               }
    25.               // 从SecurityContext上下文中获取用户的所有权限信息
    26.               Authentication authenticated = this.authenticateIfRequired();
    27.               if (this.logger.isTraceEnabled()) {
    28.                   this.logger.trace(LogMessage.format("Authorizing %s with attributes %s", object, attributes));
    29.               }
    30.               // 通过this.accessDecisionManager.decide(authenticated, object, attributes)调用决策器去决定权限是否通过，默认是AffirmativeBased（一票通过），投票的返回值0表示弃权，1表示通过，-1表示不通过，通过则返回放行
    31.               this.attemptAuthorization(object, attributes, authenticated);
    32.               if (this.logger.isDebugEnabled()) {
    33.                   this.logger.debug(LogMessage.format("Authorized %s with attributes %s", object, attributes));
    34.               }
    36.               if (this.publishAuthorizationSuccess) {
    37.                   this.publishEvent(new AuthorizedEvent(object, attributes, authenticated));
    38.               }
    40.               Authentication runAs = this.runAsManager.buildRunAs(authenticated, object, attributes);
    41.               if (runAs != null) {
    42.                   SecurityContext origCtx = SecurityContextHolder.getContext();
    43.                   SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
    44.                   SecurityContextHolder.getContext().setAuthentication(runAs);
    45.                   if (this.logger.isDebugEnabled()) {
    46.                       this.logger.debug(LogMessage.format("Switched to RunAs authentication %s", runAs));
    47.                   }
    49.                   return new InterceptorStatusToken(origCtx, true, attributes, object);
    50.               } else {
    51.                   this.logger.trace("Did not switch RunAs authentication since RunAsManager returned null");
    52.                   return new InterceptorStatusToken(SecurityContextHolder.getContext(), false, attributes, object);
    53.               }
    54.           }
    55.       }
    56.   }
    57. }