Shiro 访问源码之OncePerRequestFilter类的解析

Myth丶恋晨 2022-09-04 08:51 287阅读 0赞

分析Shiro源码，最核心的思路是通过接口访问，此时离不开tomcat容器，其ApplicationFilterChain 过滤器链类，后台调用时采用责任链模式，循环遍历系统中每一个 直接或间接实现Filter 接口的类，其中 包含shiro框架 相关的过滤器类，最后调到 RedisSessionDao、OAuthFilter、OAuthRealm等相关的过滤条件的类。

下面我们通过一个登录接口来剖析shiro源码。

1、首先从接口进入到ApplicationFilterChain 时开始：

/**
         * Filters.
         */
        private ApplicationFilterConfig[] filters = new ApplicationFilterConfig[0];

此处 可以看到整个项目中有多少过滤器类（源码、项目代码、tomcat的源码中）。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70][]

从pos为6时开始，因为此时的类和shiro相关，这时的类名是：DelegatingFilterProxy

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 1][]

2、点击

filter.doFilter(request, response, this);进入

public class DelegatingFilterProxy extends GenericFilterBean

@Override
    	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
    			throws ServletException, IOException {
    
    		// Lazily initialize the delegate if necessary.
    		Filter delegateToUse = this.delegate;
    		if (delegateToUse == null) {
    			synchronized (this.delegateMonitor) {
    				delegateToUse = this.delegate;
    				if (delegateToUse == null) {
    					WebApplicationContext wac = findWebApplicationContext();
    					if (wac == null) {
    						throw new IllegalStateException("No WebApplicationContext found: " +
    								"no ContextLoaderListener or DispatcherServlet registered?");
    					}
    					delegateToUse = initDelegate(wac);
    				}
    				this.delegate = delegateToUse;
    			}
    		}
    
    		// Let the delegate perform the actual doFilter operation.
    		invokeDelegate(delegateToUse, request, response, filterChain);//核心代码
    	}

点击进入：

protected void invokeDelegate(
    			Filter delegate, ServletRequest request, ServletResponse response, FilterChain filterChain)
    			throws ServletException, IOException {
    
    		delegate.doFilter(request, response, filterChain);//核心代码
    	}

3、点击进入到shiro相关的类：

public abstract class OncePerRequestFilter extends NameableFilter

public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
                throws ServletException, IOException {
            String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
            if ( request.getAttribute(alreadyFilteredAttributeName) != null ) {
                log.trace("Filter '{}' already executed.  Proceeding without invoking this filter.", getName());
                filterChain.doFilter(request, response);
            } else //noinspection deprecation
                if (/* added in 1.2: */ !isEnabled(request, response) ||
                    /* retain backwards compatibility: */ shouldNotFilter(request) ) {
                log.debug("Filter '{}' is not enabled for the current request.  Proceeding without invoking this filter.",
                        getName());
                filterChain.doFilter(request, response);
            } else {
                // Do invoke this filter...
                log.trace("Filter '{}' not yet executed.  Executing now.", getName());
                request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
    
                try {
                    doFilterInternal(request, response, filterChain);//核心代码，点击
                } finally {
                    // Once the request has finished, we're done and we don't
                    // need to mark as 'already filtered' any more.
                    request.removeAttribute(alreadyFilteredAttributeName);
                }
            }
        }

ctrl+t 看到

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 2][]

4、来到

public abstract class AbstractShiroFilter extends OncePerRequestFilter

protected void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse, final FilterChain chain)
                throws ServletException, IOException {
    
            Throwable t = null;
    
            try {
                final ServletRequest request = prepareServletRequest(servletRequest, servletResponse, chain);
                final ServletResponse response = prepareServletResponse(request, servletResponse, chain);
    
                final Subject subject = createSubject(request, response);//核心代码
    
                //noinspection unchecked 核心代码
                subject.execute(new Callable() {
                    public Object call() throws Exception {
                        updateSessionLastAccessTime(request, response);
                        executeChain(request, response, chain);
                        return null;
                    }
                });
            } catch (ExecutionException ex) {
                t = ex.getCause();
            } catch (Throwable throwable) {
                t = throwable;
            }
    
            if (t != null) {
                if (t instanceof ServletException) {
                    throw (ServletException) t;
                }
                if (t instanceof IOException) {
                    throw (IOException) t;
                }
                //otherwise it's not one of the two exceptions expected by the filter method signature - wrap it in one:
                String msg = "Filtered request failed.";
                throw new ServletException(msg, t);
            }
        }

点击 createSubject(request, response);

protected WebSubject createSubject(ServletRequest request, ServletResponse response) {
            return new WebSubject.Builder(getSecurityManager(), request, response).buildWebSubject();
        }

5、点击进入

public interface WebSubject extends Subject, RequestPairSource

public WebSubject buildWebSubject() {
                Subject subject = super.buildSubject();//核心代码
                if (!(subject instanceof WebSubject)) {
                    String msg = "Subject implementation returned from the SecurityManager was not a " +
                            WebSubject.class.getName() + " implementation.  Please ensure a Web-enabled SecurityManager " +
                            "has been configured and made available to this builder.";
                    throw new IllegalStateException(msg);
                }
                return (WebSubject) subject;
            }

6、点击进入：

public interface Subject

public Subject buildSubject() {
                //核心代码
                return this.securityManager.createSubject(this.subjectContext);
            }

7、点击进入：

public class DefaultSecurityManager extends SessionsSecurityManager

这是一个非常重要的类，里面有几个重要的方法，shiro的功能处理核心代码块。

public Subject createSubject(SubjectContext subjectContext) {
            //create a copy so we don't modify the argument's backing map:
            SubjectContext context = copy(subjectContext);
    
            //ensure that the context has a SecurityManager instance, and if not, add one:
            context = ensureSecurityManager(context);
    
            //Resolve an associated Session (usually based on a referenced session ID), and place it in the context before
            //sending to the SubjectFactory.  The SubjectFactory should not need to know how to acquire sessions as the
            //process is often environment specific - better to shield the SF from these details:
            context = resolveSession(context);//重要
    
            //Similarly, the SubjectFactory should not require any concept of RememberMe - translate that here first
            //if possible before handing off to the SubjectFactory:
            context = resolvePrincipals(context);//重要
    
            Subject subject = doCreateSubject(context);//核心
    
            //save this subject for future reference if necessary:
            //(this is needed here in case rememberMe principals were resolved and they need to be stored in the
            //session, so we don't constantly rehydrate the rememberMe PrincipalCollection on every operation).
            //Added in 1.2:
            save(subject);
    
            return subject;
        }

点击  context = resolveSession(context); 解决session 问题，查询验证：

protected SubjectContext resolveSession(SubjectContext context) {
            if (context.resolveSession() != null) {
                log.debug("Context already contains a session.  Returning.");
                return context;
            }
            try {
                //Context couldn't resolve it directly, let's see if we can since we have direct access to 
                //the session manager:
                Session session = resolveContextSession(context);//核心代码
                if (session != null) {
                    context.setSession(session);
                }
            } catch (InvalidSessionException e) {
                log.debug("Resolved SubjectContext context session is invalid.  Ignoring and creating an anonymous " +
                        "(session-less) Subject instance.", e);
            }
            return context;
        }

点击进入：

protected Session resolveContextSession(SubjectContext context) throws InvalidSessionException {
            SessionKey key = getSessionKey(context);
            if (key != null) {
                return getSession(key);//核心代码
            }
            return null;
        }

8、点击进入

public abstract class SessionsSecurityManager extends AuthorizingSecurityManager

public Session getSession(SessionKey key) throws SessionException {
            return this.sessionManager.getSession(key);//点击进入
        }

点击：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 3][]

9、进入

public abstract class AbstractNativeSessionManager extends AbstractSessionManager implements NativeSessionManager, EventBusAware

public Session getSession(SessionKey key) throws SessionException {
            Session session = lookupSession(key);
            return session != null ? createExposedSession(session, key) : null;
        }
    
        private Session lookupSession(SessionKey key) throws SessionException {
            if (key == null) {
                throw new NullPointerException("SessionKey argument cannot be null.");
            }
            return doGetSession(key);//点击进入
        }

10、点击进入：

public abstract class AbstractValidatingSessionManager extends AbstractNativeSessionManager
            implements ValidatingSessionManager, Destroyable

@Override
        protected final Session doGetSession(final SessionKey key) throws InvalidSessionException {
            enableSessionValidationIfNecessary();
    
            log.trace("Attempting to retrieve session with key {}", key);
    
            Session s = retrieveSession(key);//点击进入
            if (s != null) {
                validate(s, key);
            }
            return s;
        }

11、进入

public class DefaultSessionManager extends AbstractValidatingSessionManager implements CacheManagerAware

protected Session retrieveSession(SessionKey sessionKey) throws UnknownSessionException {
            Serializable sessionId = getSessionId(sessionKey);
            if (sessionId == null) {
                log.debug("Unable to resolve session ID from SessionKey [{}].  Returning null to indicate a " +
                        "session could not be found.", sessionKey);
                return null;
            }
            Session s = retrieveSessionFromDataSource(sessionId);//核心代码
            if (s == null) {
                //session ID was provided, meaning one is expected to be found, but we couldn't find one:
                String msg = "Could not find session with ID [" + sessionId + "]";
                throw new UnknownSessionException(msg);
            }
            return s;
        }

点击来到：

protected Session retrieveSessionFromDataSource(Serializable sessionId) throws UnknownSessionException {
            return sessionDAO.readSession(sessionId);//点击进入
        }

点击显示：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 4][]

12、进入：

public abstract class CachingSessionDAO extends AbstractSessionDAO implements CacheManagerAware

public Session readSession(Serializable sessionId) throws UnknownSessionException {
            Session s = getCachedSession(sessionId);
            if (s == null) {
                s = super.readSession(sessionId);//点击进入父类
            }
            return s;
        }

13、 进入

public abstract class AbstractSessionDAO implements SessionDAO

public Session readSession(Serializable sessionId) throws UnknownSessionException {
            Session s = doReadSession(sessionId);//点击进入业务代码
            if (s == null) {
                throw new UnknownSessionException("There is no session with id [" + sessionId + "]");
            }
            return s;
        }

点击显示：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 5][]

14、点击后进入业务方法查询session

@Slf4j
    @Component
    public class RedisSessionDao extends EnterpriseCacheSessionDAO

// 获取session
        @Override
        protected Session doReadSession(Serializable sessionId) {
            // 从缓存中获取session，如果没有再去数据库中获取
            Session session = super.doReadSession(sessionId);
            if (session == null) {
                session = (Session) redisTemplate.opsForValue().get(Contans.REDIS_SESSION_KEY + sessionId.toString());
            }
            return session;
        }

14、查询之后返回到

public abstract class AbstractShiroFilter extends OncePerRequestFilter

查到首次登录时 session 为空，下面的逻辑会去创建 session

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 6][]

继续进行

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 7][]

15、点击

updateSessionLastAccessTime(request, response);

protected void updateSessionLastAccessTime(ServletRequest request, ServletResponse response) {
            if (!isHttpSessions()) { //'native' sessions
                Subject subject = SecurityUtils.getSubject();
                //Subject should never _ever_ be null, but just in case:
                if (subject != null) {//如果取到的session 为null,就去创建，重点分析
                    Session session = subject.getSession(false);
                    if (session != null) {
                        try {
                            session.touch();//如果session不为null,就去更新一下登录时间（续命）,点击进入，需要重点分析
                        } catch (Throwable t) {
                            log.error("session.touch() method invocation has failed.  Unable to update" +
                                    "the corresponding session's last access time based on the incoming request.", t);
                        }
                    }
                }
            }
        }

16、点击subject.getSession(false); 来到，

public class DelegatingSubject implements Subject

没有去创建 session

public Session getSession(boolean create) {
            if (log.isTraceEnabled()) {
                log.trace("attempting to get session; create = " + create +
                        "; session is null = " + (this.session == null) +
                        "; session has id = " + (this.session != null && session.getId() != null));
            }
    
            if (this.session == null && create) {//符合条件，跳转
    
                //added in 1.2:
                if (!isSessionCreationEnabled()) {
                    String msg = "Session creation has been disabled for the current subject.  This exception indicates " +
                            "that there is either a programming error (using a session when it should never be " +
                            "used) or that Shiro's configuration needs to be adjusted to allow Sessions to be created " +
                            "for the current Subject.  See the " + DisabledSessionException.class.getName() + " JavaDoc " +
                            "for more.";
                    throw new DisabledSessionException(msg);
                }
    
                log.trace("Starting session for host {}", getHost());
                SessionContext sessionContext = createSessionContext();
                 //开始创建 session,点击进入
                Session session = this.securityManager.start(sessionContext);
                this.session = decorate(session);
            }
            return this.session;//直接返回
        }

而是开始遍历下一个过滤器类：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 8][]

17、此时没有来到这里：

public abstract class SessionsSecurityManager extends AuthorizingSecurityManager

public Session start(SessionContext context) throws AuthorizationException {
            return this.sessionManager.start(context);
        }

18、点击来到：

19、下一篇我们继续遍历其他的和shiro相关的过滤器类，敬请期待！

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70]: /images/20220829/04236b58d67c45ce948e34af05a1deff.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 1]: /images/20220829/ba17ba98459e4f61a49ac1da875747d2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 2]: /images/20220829/74731ee57d694232ab3850ac66b55be0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 3]: /images/20220829/0233d8d56e484b169360583379018bd9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 4]: /images/20220829/914eea86d33d405aa5a1a4530b3c98e9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 5]: /images/20220829/bc5e1981797f4099aa7a84896e6d1db0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 6]: /images/20220829/4013785e8f09491a9997c6de9b0ec6be.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 7]: /images/20220829/3297c4a3992c4f52ae20ad5e60614a0c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L25hbmRhbzE1OA_size_16_color_FFFFFF_t_70 8]: /images/20220829/97df32215890463399315b3a712ee48c.png