Spring Security 源码分析（一）【结构总览】

骑猪看日落 2023-07-24 14:37 93阅读 0赞

> [https://docs.spring.io/spring-security/site/docs/5.2.2.RELEASE/reference/htmlsingle/][https_docs.spring.io_spring-security_site_docs_5.2.2.RELEASE_reference_htmlsingle]

> Spring Security所解决的问题就是**安全访问控制**，而安全访问控制功能其实就是对所有进入系统的请求进行拦截，校验每个请求是否能够访问它所期望的资源；我们可以通过Filter或AOP等技术来实现，Spring Security对Web资源的保护是靠Filter实现的，所以从Filter来入手，逐步深入Spring Security原理
> 
> 当初始化Spring Security时，会创建一个名为SpringSecurityFilterChain的Servlet过滤器，类型为  
> org.springframework.security.web.FilterChainProxy，它实现了javax.servlet.Filter，因此外部的请求会经过此类

//org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration
    @Configuration(proxyBeanMethods = false)
    public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
    	private WebSecurity webSecurity;
    	//
    	private List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers;
    	//SpringSecurityFilterChain
    	@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
    	public Filter springSecurityFilterChain() throws Exception {
    		//webSecurityConfigurers就是我们写的配置类
    		boolean hasConfigurers = webSecurityConfigurers != null&& !webSecurityConfigurers.isEmpty();
    		if (!hasConfigurers) {
    			WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor.postProcess(new WebSecurityConfigurerAdapter() {});
    			webSecurity.apply(adapter);
    		}
    		return webSecurity.build();
    	}

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwNzk0OTcz_size_16_color_FFFFFF_t_70][]

![Spring Security过虑器链结构图][Spring Security] Spring Security过虑器链结构图

> FilterChainProxy是一个代理，真正起作用的是FilterChainProxy中SecurityFilterChain所包含的各个Filter，同时 这些Filter作为Bean被Spring管理，它们是Spring Security核心，各有各的职责，但他们并不直接处理用户的认证，也不直接处理用户的授权，而是把它们交给了认证管理器（AuthenticationManager）和决策管理器 （AccessDecisionManager）进行处理

//org.springframework.security.web.FilterChainProxy
    public class FilterChainProxy extends GenericFilterBean {
    	private List<SecurityFilterChain> filterChains;

![FilterChainProxy相关类的UML图示][FilterChainProxy_UML] FilterChainProxy相关类的UML图示

> spring Security功能的实现主要是由一系列过滤器链相互配合完成

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwNzk0OTcz_size_16_color_FFFFFF_t_70 1][] 过滤器链

> 下面介绍过滤器链中主要的几个过滤器及其作用：
> 
> **SecurityContextPersistenceFilter** 这个Filter是整个拦截过程的入口和出口（也就是第一个和最后一个拦截器），会在请求开始时从配置好的 SecurityContextRepository 中获取 SecurityContext，然后把它设置给SecurityContextHolder；在请求完成后将 SecurityContextHolder 持有的 SecurityContext 再保存到配置好的 SecurityContextRepository，同时清除 securityContextHolder 所持有的 SecurityContext
> 
> **UsernamePasswordAuthenticationFilter** 用于处理来自表单提交的认证。该表单必须提供对应的用户名和密码，其内部还有登录成功或失败后进行处理的 AuthenticationSuccessHandler 和AuthenticationFailureHandler，这些都可以根据需求做相关改变
> 
> **FilterSecurityInterceptor** 是用于保护web资源的，使用AccessDecisionManager对当前用户进行授权访问，前面已经详细介绍过了
> 
> **ExceptionTranslationFilter** 能够捕获来自 FilterChain 所有的异常，并进行处理；但是它只会处理两类异常：  
> AuthenticationException 和 AccessDeniedException，其它的异常它会继续抛出

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwNzk0OTcz_size_16_color_FFFFFF_t_70 2][] org.springframework.security.web.FilterChainProxy\#FilterChainProxy(java.util.List<org.springframework.security.web.SecurityFilterChain>)

//org.springframework.security.web.access.ExceptionTranslationFilter#doFilter
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws     IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        try {
            chain.doFilter(request, response); // 执行后面的filter
            logger.debug("Chain processed normally");
        }catch (IOException ex) { // IOException直接抛出
            throw ex;
        }catch (Exception ex) {
            // Try to extract a SpringSecurityException from the stacktrace
            Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
            RuntimeException ase = (AuthenticationException)throwableAnalyzer.getFirstThrowableOfType(AuthenticationException.class, causeChain);
            if (ase == null) {
                ase = (AccessDeniedException)throwableAnalyzer.getFirstThrowableOfType(AccessDeniedException.class, causeChain);
            }
            //是AuthenticationException或者AccessDeniedException
            if (ase != null) {
                if (response.isCommitted()) {
                    throw new ServletException("Unable to handle the Spring Security Exception because the     response is already committed.", ex);
                }
                handleSpringSecurityException(request, response, chain, ase);
            }
            //非AuthenticationException 非AccessDeniedException
            else { 
                // Rethrow ServletExceptions and RuntimeExceptions as-is
                if (ex instanceof ServletException) {
                throw (ServletException) ex;
            }else if (ex instanceof RuntimeException) {
                 throw (RuntimeException) ex;
            }
               // Wrap other Exceptions. This shouldn't actually happen
               // as we've already covered all the possibilities for doFilter
               throw new RuntimeException(ex);
            }
        }
    }

[https_docs.spring.io_spring-security_site_docs_5.2.2.RELEASE_reference_htmlsingle]: https://docs.spring.io/spring-security/site/docs/5.2.2.RELEASE/reference/htmlsingle/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwNzk0OTcz_size_16_color_FFFFFF_t_70]: /images/20230528/d1ec54d978de435ca7d70f61a4ca09b7.png
[Spring Security]: /images/20230528/f8aa6723ceaa45ca9b8c095e46d9ea21.png
[FilterChainProxy_UML]: /images/20230528/6e5c4a9baa3b4165b430f3929a7a5b7d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwNzk0OTcz_size_16_color_FFFFFF_t_70 1]: /images/20230528/bfe99ac2f0aa479b9996c54b5db8bc2c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwNzk0OTcz_size_16_color_FFFFFF_t_70 2]: /images/20230528/82f3c1ca0f6340748bd10ab33d8f926a.png