[网络协议]spring security-源码流程分析（三）

spring security经常在项目中用到，但是平常只是简单的使用肯定是不够的，我们需要了解深层次的东西，才能在使用的过程中不畏惧，本次打算从demo入手，跟踪源码，剖析security内在

一、模拟一次请求，过滤器执行流程

本次重点关注以上几个过滤器的部分执行过程

• SecurityContextPersistenceFilter
  

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

		if (request.getAttribute(FILTER_APPLIED) != null) {
			// 确保该过滤器一次请求只执行一次
			chain.doFilter(request, response);
			return;
		}
		request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
		HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request,
				response);
				//加载当前请求对应的SecurityContext，repo是SecurityContextRepository，
				//默认创建的是HttpSessionSecurityContextRepository
		SecurityContext contextBeforeChainExecution = repo.loadContext(holder);

		try {
			SecurityContextHolder.setContext(contextBeforeChainExecution);

			chain.doFilter(holder.getRequest(), holder.getResponse());

		}
		finally {
			SecurityContext contextAfterChainExecution = SecurityContextHolder
					.getContext();
			// Crucial removal of SecurityContextHolder contents - do this before anything
			// else.
			SecurityContextHolder.clearContext();
			repo.saveContext(contextAfterChainExecution, holder.getRequest(),
					holder.getResponse());
			request.removeAttribute(FILTER_APPLIED);

			
		}
	}

HttpSessionSecurityContextRepository会修改响应对象！此对象会将认证信息保存到session中

• LogoutFilter

	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
		//判断当前请求路径是否和配置的logout地址对应，默认的为/logout,简单代码可以看上面的配置类
		
		if (requiresLogout(request, response)) {
			Authentication auth = SecurityContextHolder.getContext().getAuthentication();

		

			this.handler.logout(request, response, auth);

			logoutSuccessHandler.onLogoutSuccess(request, response, auth);

			return;
		}

		chain.doFilter(request, response);
	}

• UsernamePasswordAuthenticationFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {

		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
		//判断是否是认证地址，默认认证地址/login
		if (!requiresAuthentication(request, response)) {
			chain.doFilter(request, response);

			return;
		}
	
		Authentication authResult;

		try {
		//获取认证结果
			authResult = attemptAuthentication(request, response);
			if (authResult == null) {
			
				return;
			}
			//认证成功的回调
			//默认的策略见上图初始化sessionmanagerConfigurer配置时创建
			//CompositeSessionAuthenticationStrategy
			//主要是控制并发用户登录的处理
			sessionStrategy.onAuthentication(authResult, request, response);
		}
		catch (InternalAuthenticationServiceException failed) {
			
			unsuccessfulAuthentication(request, response, failed);

			return;
		}
		catch (AuthenticationException failed) {
			// Authentication failed
			unsuccessfulAuthentication(request, response, failed);

			return;
		}

		// Authentication success
		if (continueChainBeforeSuccessfulAuthentication) {
			chain.doFilter(request, response);
		}
		//成功后处理逻辑，见下图
		successfulAuthentication(request, response, chain, authResult);
	}

认证成功后会重定向，此时会将context保存到session中！！！

• SessionManagementFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;

		if (request.getAttribute(FILTER_APPLIED) != null) {
			chain.doFilter(request, response);
			return;
		}

		request.setAttribute(FILTER_APPLIED, Boolean.TRUE);

		if (!securityContextRepository.containsContext(request)) {
		//session中没有SecurityContext
			Authentication authentication = SecurityContextHolder.getContext()
					.getAuthentication();

			if (authentication != null && !trustResolver.isAnonymous(authentication)) {
				// 用户已认证且不是默认用户anonymous
				try {
				//进行Session的校验 比如是否超过最大限制 
					sessionAuthenticationStrategy.onAuthentication(authentication,
							request, response);
				}
				catch (SessionAuthenticationException e) {
				
					SecurityContextHolder.clearContext();
					failureHandler.onAuthenticationFailure(request, response, e);

					return;
				}
				//认证信息保存到session
				securityContextRepository.saveContext(SecurityContextHolder.getContext(),
						request, response);
			}
			else {
				// 默认认证用户
				//判断会话是否有效
				if (request.getRequestedSessionId() != null
						&& !request.isRequestedSessionIdValid()) {
					if (invalidSessionStrategy != null) {
						invalidSessionStrategy
								.onInvalidSessionDetected(request, response);
						return;
					}
				}
			}
		}

		chain.doFilter(request, response);
	}