Spring Security 过滤器链（一）创建FilterChainProxy

超、凢脫俗 2023-02-13 14:41 288阅读 0赞

### 过滤器链（一） ###

*  一.简介
 *  二.FilterChainProxy的创建
 *   *  1.WebSecurityConfiguration
     *   *  1.1 setFilterChainProxySecurityConfigurer()
         *  1.2 springSecurityFilterChain()
     *  2.AbstractConfiguredSecurityBuilder
     *   *  2.1 apply(C configurer)，add(C configurer)
         *  2.2 doBuild()
         *  2.3 init()，configure()
     *  3. WebSecurity
     *   *  3.1 performBuild()
     *  4.WebSecurityConfigurerAdapter
     *   *  4.1 init()，getHttp() 
         *  4.2 配置WebSecurityConfigurerAdapter
         *   *  4.2.1 configure(HttpSecurity http)
             *  4.2.2 configure(WebSecurity web)
             *  4.2.3 configure(AuthenticationManagerBuilder auth)
     *  5. HttpSecurity 16.2
     *   *  5.1 默认的过滤器链
         *  5.2 addFilter(Filter) 添加自定义的过滤器

# 一.简介 #

[官网][Link 1]，[官网文档][Link 2]

参考：  
[深入浅出Spring Security（二）：FilterChainProxy的创建过程][Spring Security_FilterChainProxy]  
[Spring Security 源码分析（一）：过滤器链][Spring Security]  
[Spring Security源码解析（二.创建FilterChainProxy）][Spring Security_._FilterChainProxy]  
[Spring Security(六)—SpringSecurityFilterChain 加载流程深度解析][Spring Security_SpringSecurityFilterChain]

**文中源码均为伪代码，删除了一些的细节**

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70]

> 在SpringSecurity框架中，用户想要访问资源需要经过`FilterChainProxy`（本质上是个Filter，名字叫springSecurityFilterChain）来过滤。  
> 里面包含一组SecuriyFilterChains，每个uri都对应一个`SecurityFilterChain`，SecurityFilterChain包含多个`SecurityFilter`

# 二.FilterChainProxy的创建 #

虚线继承/实现，如有错乱以你为准。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 2]  
从图中可以看出

1.  `WebSecurity`和`HttpSecurity`都是Builder，  
    `WebSecurity`是SecurityBuilder< Filter >为了创建`FilterChainProxy`，  
    `HttpSecurity`是SecurityBuilder< DefaultSecurityFilterChain >为了创建 `FilterChainProxy`的filterChains。
2.  `WebSecurityConfigurerAdapter`是WebSecurity的Configurer  
    在`WebSecurityConfiguration`创建`WebSecurity`后，赋值给`WebSecurity`的配置configurers，  
    并在`WebSecurity`要创建`FilterChainProxy`时，初始化，将`HttpSecurity`赋值给`WebSecurity`的securityFilterChainBuilders用于创建过滤器。

## 1.WebSecurityConfiguration ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 3]

### 1.1 setFilterChainProxySecurityConfigurer() ###

public void setFilterChainProxySecurityConfigurer(ObjectPostProcessor<Object> objectPostProcessor, @Value("#{@autowiredWebSecurityConfigurersIgnoreParents.getWebSecurityConfigurers()}") List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers) throws Exception { 
            this.webSecurity = (WebSecurity)objectPostProcessor.postProcess(new WebSecurity(objectPostProcessor));
    webSecurityConfigurers.sort(WebSecurityConfiguration.AnnotationAwareOrderComparator.INSTANCE);
            Iterator var5;
            SecurityConfigurer config;
            for(var5 = webSecurityConfigurers.iterator(); var5.hasNext(); previousConfig = config) { 
                config = (SecurityConfigurer)var5.next();
                Integer order = WebSecurityConfiguration.AnnotationAwareOrderComparator.lookupOrder(config);
                previousOrder = order;
            }
    
            var5 = webSecurityConfigurers.iterator();
    
            while(var5.hasNext()) { 
                config = (SecurityConfigurer)var5.next();
                this.webSecurity.apply(config);
            }
    
            this.webSecurityConfigurers = webSecurityConfigurers;
    }

> 该方法负责收集配置类对象列表`webSecurityConfigurers`，并创建`WebSecurity`，用于后面建造`FilterChainProxy`过滤器

@Value("\#\{@autowiredWebSecurityConfigurersIgnoreParents. getWebSecurityConfigurers()\}")  
List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers

> @Value("\#\{\}") 是SpEl表达式通常用来获取bean的属性或者调用bean的某个方法。  
> 方法执行时,会先得到webSecurityConfigurers并排序（所有实现了WebSecurityConfigurerAdapter的配置类实例）

public List<SecurityConfigurer<Filter, WebSecurity>> getWebSecurityConfigurers() { 
            List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers = new ArrayList();
            Map<String, WebSecurityConfigurer> beansOfType = this.beanFactory.getBeansOfType(WebSecurityConfigurer.class);
            Iterator var3 = beansOfType.entrySet().iterator();
    
            while(var3.hasNext()) { 
                Entry<String, WebSecurityConfigurer> entry = (Entry)var3.next();
                webSecurityConfigurers.add(entry.getValue());
            }
    
            return webSecurityConfigurers;
        }

*  获取类型为`WebSecurityConfigurer`的bean
 *  this.webSecurity.apply(config)将`WebSecurityConfigurerAdapter`赋值给`AbstractConfiguredSecurityBuilder`（webSecurity的父类）的configurersAddedInInitializing 和 configurers 【2.1】。

### 1.2 springSecurityFilterChain() ###

@Bean( name = { "springSecurityFilterChain"})
    public Filter springSecurityFilterChain() throws Exception { 
        boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();
        if (!hasConfigurers) { 
            WebSecurityConfigurerAdapter adapter = (WebSecurityConfigurerAdapter)this.objectObjectPostProcessor.postProcess(new WebSecurityConfigurerAdapter() { 
            });
            this.webSecurity.apply(adapter);
        }
    
        return (Filter)this.webSecurity.build();
    }

> 调用`webSecurity`.build()，建造出`FilterChainProxy`过滤器对象  
> 并将其命名为"springSecurityFilterChain"

`webSecurity`.build()–>AbstractSecurityBuilder.build()–>  
`AbstractConfiguredSecurityBuilder`.doBuild()【2.2】

*  init()，configure()  
    将 `HttpSecurity`添加到`webSecurity`的属性securityFilterChainBuilders集合里。
 *  `WebSecurity`.performBuild()【3.1】  
    securityFilterChainBuilders创建filterchains  
    创建`FilterChainProxy` ;

## 2.AbstractConfiguredSecurityBuilder ##

`WebSecurity`继承`AbstractConfiguredSecurityBuilder`  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 4]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 5]

### 2.1 apply(C configurer)，add(C configurer) ###

public <C extends SecurityConfigurer<O, B>> C apply(C configurer) throws Exception { 
            this.add(configurer);
            return configurer;
    }
    private <C extends SecurityConfigurer<O, B>> void add(C configurer) { 
         Class<? extends SecurityConfigurer<O, B>> clazz = configurer.getClass();
         LinkedHashMap var3 = this.configurers;
         synchronized(this.configurers) { 
              List<SecurityConfigurer<O, B>> configs = this.allowConfigurersOfSameType ? (List)this.configurers.get(clazz) : null;
              ((List)configs).add(configurer);
              
              this.configurers.put(clazz, configs);
              this.configurersAddedInInitializing.add(configurer);
         }
     }

### 2.2 doBuild() ###

protected final O doBuild() throws Exception { 
            LinkedHashMap var1 = this.configurers;
            synchronized(this.configurers) { 
                this.buildState = AbstractConfiguredSecurityBuilder.BuildState.INITIALIZING;
                this.beforeInit();
                this.init();
                this.buildState = AbstractConfiguredSecurityBuilder.BuildState.CONFIGURING;
                this.beforeConfigure();
                this.configure();
                this.buildState = AbstractConfiguredSecurityBuilder.BuildState.BUILDING;
                O result = this.performBuild();
                this.buildState = AbstractConfiguredSecurityBuilder.BuildState.BUILT;
                return result;
            }
        }

### 2.3 init()，configure() ###

*  this.init() - >configurer.init(this) - > `WebSecurityConfigurerAdapter`.init(WebSecurity web) 【4.1】
 *  this.configure(this)\-> `WebSecurityConfigurerAdapter`.configure(WebSecurity web) 【4.2.2】;

private void init() throws Exception { 
          Collection<SecurityConfigurer<O, B>> configurers = this.getConfigurers();
          Iterator var2 = configurers.iterator();
          SecurityConfigurer configurer;
          while(var2.hasNext()) { 
              configurer = (SecurityConfigurer)var2.next();
              configurer.init(this);
          }
          var2 = this.configurersAddedInInitializing.iterator();
    
          while(var2.hasNext()) { 
              configurer = (SecurityConfigurer)var2.next();
              configurer.init(this);
          }
      }
      private void configure() throws Exception { 
            Collection<SecurityConfigurer<O, B>> configurers = this.getConfigurers();
            Iterator var2 = configurers.iterator();
    
            while(var2.hasNext()) { 
                SecurityConfigurer<O, B> configurer = (SecurityConfigurer)var2.next();
                configurer.configure(this);
            }
    
        }

## 3. WebSecurity ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 6]

### 3.1 performBuild() ###

protected Filter performBuild() throws Exception { 
        // ...
        int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();
        List<SecurityFilterChain> securityFilterChains = new ArrayList<>(chainSize);
        // 上文配置的需要忽略的请求
        for (RequestMatcher ignoredRequest : ignoredRequests) { 
          securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));
        }
        // 上文配置的 HttpSecurity 实例
        for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : securityFilterChainBuilders) { 
          // 调用 build 方法生成 DefaultSecurityFilterChain
          securityFilterChains.add(securityFilterChainBuilder.build());
        }
        // 过滤器链代理
        FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
    
        // ...
      }

创建了`FilterChainProxy`并用securityFilterChainBuilder配置了`FilterChainProxy`的过滤器链securityFilterChains

## 4.WebSecurityConfigurerAdapter ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 7]

### 4.1 init()，getHttp()  ###

public void init(WebSecurity web) throws Exception { 
         HttpSecurity http = this.getHttp();
         web.addSecurityFilterChainBuilder(http).postBuildAction(() -> { 
             FilterSecurityInterceptor securityInterceptor = (FilterSecurityInterceptor)http.getSharedObject(FilterSecurityInterceptor.class);
             web.securityInterceptor(securityInterceptor);
         });
    }
    protected final HttpSecurity getHttp() throws Exception { 
          AuthenticationManager authenticationManager = this.authenticationManager();
          this.authenticationBuilder.parentAuthenticationManager(authenticationManager);
          this.http = new HttpSecurity(this.objectPostProcessor, this.authenticationBuilder, sharedObjects);
    }

`WebSecurityConfigurerApdater`.init()方法，通过getHttp()方法获得配置好的 `HttpSecurity`。  
然后 web.addSecurityFilterChainBuilder(http)将 `HttpSecurity`添加到`webSecurity`的属性securityFilterChainBuilders集合里。

public WebSecurity addSecurityFilterChainBuilder(SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder) { 
            this.securityFilterChainBuilders.add(securityFilterChainBuilder);
            return this;
        }

### 4.2 配置WebSecurityConfigurerAdapter ###

如果需要干预 spring security 配置，创建MyWebSecurityConfig 继承`WebSecurityConfigurerAdapter`并装配到 Spring 容器中。比如

@Configuration
    @EnableWebSecurity
    @Slf4j
    public class MyWebSecurityConfig extends WebSecurityConfigurerAdapter { 
    }

这里我们可能会重写WebSecurityConfigurerAdapter 中的绿框中的三个configure方法。

#### 4.2.1 configure(HttpSecurity http) ####

原方法

protected void configure(HttpSecurity http) throws Exception { 
            this.logger.debug("Using default configure(HttpSecurity). If subclassed this will potentially override subclass configure(HttpSecurity).");
            ((HttpSecurity)((HttpSecurity)((AuthorizedUrl)http.authorizeRequests().anyRequest()).authenticated().and()).formLogin().and()).httpBasic();
        }

例子：修改HttpSecurity，重新设置登录，添加filter，修改拦截的路径等

@Override
        protected void configure(HttpSecurity http) throws Exception { 
                http
                    .formLogin()
                    .loginPage("/login")
                    .loginProcessingUrl("/login/submit")
                    .failureUrl("/login_error").permitAll()
                    .and()
                    .authorizeRequests()
                        .antMatchers(HttpMethod.GET, "/login").permitAll()
                        .anyRequest().authenticated()
                    .and()
                    .csrf().disable();
    
            http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);
        }

#### 4.2.2 configure(WebSecurity web) ####

原方法

public void configure(WebSecurity web) throws Exception { 
        }

例子：修改WebSecurity 忽略静态资源

@Override
    public void configure(WebSecurity web) throws Exception { 
        web.ignoring().antMatchers(HttpMethod.GET,  "/*.html","/**/favicon.ico",
                "/**/*.html", "/**/*.css", "/**/*.*.woff", "/**/*.*.woff2", "/**/*.*.ttf","/**/*.js", "/**/*.png",
                "/**/*.jpg", "/**/*.ttf", "/**/*.map","/**/*.tpl","/**/*.map","/**/*.mp4", "/*.txt", "/**/*.txt",
                "/webjars/**","/csrf","/v2/api-docs",
                "/swagger-ui.html", "/swagger-resources/**");
    }

#### 4.2.3 configure(AuthenticationManagerBuilder auth) ####

原方法

protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
            this.disableLocalConfigureAuthenticationBldr = true;
        }

例子： 使用customUserService进行用户信息的查询。

@Override
    protected void configure (AuthenticationManagerBuilder auth) throws Exception{ 
          auth.userDetailsService(customUserService()).passwordEncoder(passwordEncoder());
        }

## 5. HttpSecurity 16.2 ##

参考  
[Spring Security : 配置 HttpSecurity 的 SecurityConfigurer][Spring Security _ _ HttpSecurity _ SecurityConfigurer]  
[Spring Security原理篇(三) HttpSecurity][Spring Security_ HttpSecurity]

用于配置 web 请求的安全配置，默认会应用到所有请求  
在上面的configure(HttpSecurity http)中。我们可以修改HttpSecurity 的一些设置。

### 5.1 默认的过滤器链 ###

Spring Security中`HttpSecurity`是一个安全构建器`SecurityBuilder`,目的是构建一个对HTTP请求进行安全控制的`DefaultSecurityFilterChain`。  
对HttpSecurity进行配置，是通过一组安全配置器来完成的。这组安全配置器有一个共同的抽象基类`AbstractHttpConfigurer`。如下:

<table> 
 <thead> 
  <tr> 
   <th align="left">名称</th> 
   <th align="left">简介</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="left"><code>AnonymousConfigurer</code></td> 
   <td align="left">配置匿名认证。 具体来讲，是向<code>HttpSecurity</code>配置一对协调工作的<code>AnonymousAuthenticationFilter</code>和<code>AnonymousAuthenticationProvider</code>,所有属性采用合理的缺省值。这样请求处理时，如果<code>SecurityContextHolder</code>中认证对象未设置(<code>null</code>的情况)，则向其设置一个匿名认证对象<code>AnonymousAuthenticationToken</code>。</td> 
  </tr> 
  <tr> 
   <td align="left"><code>ChannelSecurityConfigurer</code></td> 
   <td align="left">配置<code>ChannelProcessingFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>CorsConfigurer</code></td> 
   <td align="left">配置<code>CorsFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>CsrfConfigurer</code></td> 
   <td align="left">配置<code>CsrfFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>DefaultLoginPageConfigurer</code></td> 
   <td align="left">配置<code>DefaultLoginPageGeneratingFilter</code>/<code>DefaultLogoutPageGeneratingFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>ExceptionHandlingConfigurer</code></td> 
   <td align="left">配置<code>ExceptionTranslationFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><font>ExpressionUrlAuthorizationConfigurer</font></td> 
   <td align="left">配置<code>FilterSecurityInterceptor</code></td> 
  </tr> 
  <tr> 
   <td align="left"><font>FormLoginConfigurer</font></td> 
   <td align="left">配置<code>UsernamePasswordAuthenticationFilter</code>/<code>DefaultLoginPageGeneratingFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>HeadersConfigurer</code></td> 
   <td align="left">配置<code>HeaderWriterFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><font>HttpBasicConfigurer</font></td> 
   <td align="left">配置<code>BasicAuthenticationFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>JeeConfigurer</code></td> 
   <td align="left">配置<code>J2eePreAuthenticatedProcessingFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>LogoutConfigurer</code></td> 
   <td align="left">配置<code>LogoutFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>PortMapperConfigurer</code></td> 
   <td align="left">配置共享对象<code>PortMapper</code>,用于<code>HTTP</code>/<code>HTTPS</code>两种协议之间跳转时的端口检测。</td> 
  </tr> 
  <tr> 
   <td align="left"><code>RememberMeConfigurer</code></td> 
   <td align="left">配置<code>RememberMeAuthenticationFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>RequestCacheConfigurer</code></td> 
   <td align="left">配置<code>RequestCacheAwareFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>SecurityContextConfigurer</code></td> 
   <td align="left">配置<code>SecurityContextPersistenceFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>ServletApiConfigurer</code></td> 
   <td align="left">配置<code>SecurityContextHolderAwareRequestFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>SessionManagementConfigurer</code></td> 
   <td align="left">配置<code>SessionManagementFilter</code>/<code>ConcurrentSessionFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>X509Configurer</code></td> 
   <td align="left">配置<code>X509AuthenticationFilter</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>OAuth2ClientConfigurer</code></td> 
   <td align="left">配置<code>OAuth2AuthorizationRequestRedirectFilter</code>/<code>OAuth2AuthorizationCodeGrantFilter</code>;<br>配置共享对象:<code>ClientRegistrationRepository</code><br>/<code>OAuth2AuthorizedClientRepository</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>OAuth2LoginConfigurer</code></td> 
   <td align="left">配置<code>OAuth2AuthorizationRequestRedirectFilter</code>/<code>OAuth2LoginAuthenticationFilter</code>;<br>配置共享对象:<br><code>ClientRegistrationRepository</code>/<br><code>OAuth2AuthorizedClientRepository</code><br>/<code>GrantedAuthoritiesMapper</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>OAuth2ResourceServerConfigurer</code></td> 
   <td align="left">配置<code>BearerTokenAuthenticationFilter</code>;<br>配置共享对象:<code>SessionCreationPolicy</code></td> 
  </tr> 
  <tr> 
   <td align="left"><code>OpenIDLoginConfigurer</code></td> 
   <td align="left">配置<code>OpenIDAuthenticationFilter</code>;<br>配置共享对象:<code>AuthenticationEntryPoint</code><br>/<code>OpenIDAuthenticationProvider</code></td> 
  </tr> 
 </tbody> 
</table>

> 比如 http.authorizeRequests()、http.formLogin()、http.httpBasic()分别创建了`ExpressionUrlAuthorizationConfigurer`，`FormLoginConfigurer`，`HttpBasicConfigurer`。在三个类从父级一直往上找，会发现它们都是SecurityConfigurer建造器的子类。  
> SecurityConfigurer中又有configure()方法。该方法被子类实现就用于创建各个过滤器，并将过滤器添加进HttpSecurity中维护的装有Filter的List中

### 5.2 addFilter(Filter) 添加自定义的过滤器 ###

![在这里插入图片描述][20200610145951456.png]

http.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class);

在过滤器链中`UsernamePasswordAuthenticationFilter`前插入我们自定义的`authenticationTokenFilter`。

[Link 1]: https://spring.io/projects/spring-security#learn
[Link 2]: https://docs.spring.io/spring-security/site/docs/5.4.0-M1/reference/html5/#servlet-authentication
[Spring Security_FilterChainProxy]: https://blog.csdn.net/zimou5581/article/details/102457794?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-11.nonecase&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-11.nonecase
[Spring Security]: https://www.jianshu.com/p/2bd4265dbde9
[Spring Security_._FilterChainProxy]: https://blog.csdn.net/qq_30905661/article/details/81561976
[Spring Security_SpringSecurityFilterChain]: https://www.cnkirito.moe/spring-security-7/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200604161526482.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200611110924889.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200611111341268.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200609160928347.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200611123743114.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200611123914731.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/202006091624258.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20200609143746638.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlbmdxaW5neXVlYmFpMTk=,size_16,color_FFFFFF,t_70
[Spring Security _ _ HttpSecurity _ SecurityConfigurer]: https://blog.csdn.net/andy_zhang2007/article/details/90166996?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522159177327919725219949135%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fall.%2522%257D&request_id=159177327919725219949135&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_ecpm_v3~pc_rank_v2-20-90166996.first_rank_ecpm_v3_pc_rank_v2&utm_term=HttpSecurity
[Spring Security_ HttpSecurity]: https://www.jianshu.com/p/6f1b129442a1
[20200610145951456.png]: https://img-blog.csdnimg.cn/20200610145951456.png