Spring-Security的自定义过滤器

分手后的思念是犯贱 2021-08-19 20:44 428阅读 0赞

**一 参考文章**

[http://www.spring4all.com/article/422][http_www.spring4all.com_article_422]

**二 代码位置**

[https://github.com/cakin24/spring-security-demos/tree/master/02%20-%20%E8%87%AA%E5%AE%9A%E4%B9%89%E7%99%BB%E5%BD%95][https_github.com_cakin24_spring-security-demos_tree_master_02_20-_20_E8_87_AA_E5_AE_9A_E4_B9_89_E7_99_BB_E5_BD_95]

**三 关键代码**

1 过滤器定义

package com.spring4all.config;
    
    import org.springframework.http.HttpMethod;
    import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
    import org.springframework.security.core.Authentication;
    import org.springframework.security.core.AuthenticationException;
    import org.springframework.security.core.authority.SimpleGrantedAuthority;
    import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
    import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
    
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    import java.util.ArrayList;
    import java.util.List;
    
    
    /**
    * 自定义表单登录
    */
    public class CustomFromLoginFilter extends AbstractAuthenticationProcessingFilter {
    
    
        CustomFromLoginFilter(String defaultFilterProcessesUrl) {
            super(new AntPathRequestMatcher(defaultFilterProcessesUrl, HttpMethod.POST.name()));
        }
    
    
        @Override
        public Authentication attemptAuthentication(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) throws AuthenticationException, IOException, ServletException {
            String username = httpServletRequest.getParameter("username");
            String password = httpServletRequest.getParameter("password");
            customCheck(username, password);
            List<SimpleGrantedAuthority> simpleGrantedAuthorities = new ArrayList<>();
            simpleGrantedAuthorities.add(new SimpleGrantedAuthority("USER"));
            return new UsernamePasswordAuthenticationToken(username, password, simpleGrantedAuthorities);
        }
    
        private void customCheck(String username, String password){
            if (!("anoyi".equals(username) && "anoyi".equals(password))){
                throw new RuntimeException("用户名或密码错误！");
            }
        }
    }

2 过滤器配置

package com.spring4all.config;
    
    
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    
    @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
    
    
        /**
         * 匹配 "/" 路径，不需要权限即可访问
         * 匹配 "/user" 及其以下所有路径，都需要 "USER" 权限
         * 退出登录的地址为 "/logout"，退出成功后跳转到页面 "/login"
         * 默认启用 CSRF
         */
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .authorizeRequests()
                    .antMatchers("/").permitAll()
                    .antMatchers("/user/**").hasAuthority("USER")
                    .and()
                    .logout().logoutUrl("/logout").logoutSuccessUrl("/login");
    
    
            http.addFilterAt(customFromLoginFilter(), UsernamePasswordAuthenticationFilter.class);
        }
    
    
        /**
         * 自定义认证过滤器
         */
        private CustomFromLoginFilter customFromLoginFilter() {
            return new CustomFromLoginFilter("/login");
        }
    
    
    }

addFilterAt该函数的用法参考： [https://blog.csdn.net/qq\_36882793/article/details/102869583][https_blog.csdn.net_qq_36882793_article_details_102869583]

**四 调试**

我们调试下看看有哪些过滤器，以及过滤器的执行顺序。

1 在下面两个过滤器中设置断点

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 1][]

2 浏览器输入： [http://localhost:8080/login][http_localhost_8080_login]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 2][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 3][]

从调试结果看，先执行优先级高的过滤器。

[http_www.spring4all.com_article_422]: http://www.spring4all.com/article/422
[https_github.com_cakin24_spring-security-demos_tree_master_02_20-_20_E8_87_AA_E5_AE_9A_E4_B9_89_E7_99_BB_E5_BD_95]: https://github.com/cakin24/spring-security-demos/tree/master/02%20-%20%E8%87%AA%E5%AE%9A%E4%B9%89%E7%99%BB%E5%BD%95
[https_blog.csdn.net_qq_36882793_article_details_102869583]: https://blog.csdn.net/qq_36882793/article/details/102869583
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70]: /images/20210724/eefc4aed9ac54c7ea8059f8d6ccbd010.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 1]: /images/20210724/14c8775fc5d442508dc22aabf18782fe.png
[http_localhost_8080_login]: http://localhost:8080/login
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 2]: /images/20210724/3068f2e9879b433781dbef74cd2faf63.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2NoZW5ncWl1bWluZw_size_16_color_FFFFFF_t_70 3]: /images/20210724/95f06580ef0949918efac8516bf53d88.png