SpringSecurity 源码剖析

//GlobalAuthenticationConfigurerAdapter EnableGlobalAuthenticationAutowiredConfigurer(context)

FilterChainProxy委托securityFilterChains执行doFilter()

Spring Security是一个提供身份验证，授权和保护以防止常见攻击的框架本质上，Spring Security是一个过滤链

将webSecurityConfigurer添加到webSecurity中

@Import

自动配置条件

//InitializeUserDetailsBeanManagerConfigurerInitializeUserDetailsBeanManagerConfigurer(context)

创建实例ObjectPostProcessor

spring创建一个bean

new AutowireBeanFactoryObjectPostProcessor(beanFactory)

@Bean

判断

performBuild()

FilterChainProxy

OAuth2ImportSelector

Security Filter

整合SpringData时配置SecurityDataConfiguration

result instanceof DisposableBean

result instanceof SmartInitializingSingleton

ChannelProcessingFilterWebAsyncManagerIntegrationFilterSecurityContextPersistenceFilterHeaderWriterFilterCorsFilterCsrfFilterLogoutFilterOAuth2AuthorizationRequestRedirectFilterSaml2WebSsoAuthenticationRequestFilterX509AuthenticationFilterAbstractPreAuthenticatedProcessingFilterCasAuthenticationFilterOAuth2LoginAuthenticationFilterSaml2WebSsoAuthenticationFilterUsernamePasswordAuthenticationFilterOpenIDAuthenticationFilterDefaultLoginPageGeneratingFilterDefaultLogoutPageGeneratingFilterConcurrentSessionFilterDigestAuthenticationFilterBearerTokenAuthenticationFilterBasicAuthenticationFilterRequestCacheAwareFilterSecurityContextHolderAwareRequestFilterJaasApiIntegrationFilterRememberMeAuthenticationFilterAnonymousAuthenticationFilterOAuth2AuthorizationCodeGrantFilterSessionManagementFilterExceptionTranslationFilterFilterSecurityInterceptorSwitchUserFilter

configurer.configure((B) this)

defaultSecurityFilterChain(HttpSecurity http)

// AuthenticationManagerBuilderDefaultPasswordEncoderAuthenticationManagerBuilder

创建一个WebSecurity

ObjectPostProcessorConfiguration

SecurityFilterChain

beforeInit();

DelegatingFilterProxy

springSecurityFilterChain()

DefaultWebSecurityCondition

有EnableWebSecurity类就进行下面配置@ConditionalOnClass({EnableWebSecurity.class})

返回FilterChainProxy

运行一个线程

postBuildAction.run();

Filter

SpringWebMvcImportSelector

AuthenticationConfiguration

smartSingletons.add((SmartInitializingSingleton) result)

disposableBeans.add((DisposableBean) result)

@ConditionalOnDefaultWebSecurity

没有配置的话，会自动配置一个WebSecurityConfigurerAdapterSecurityFilterChain

/hello/**

securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));

WebSecurityEnablerConfiguration

this.webSecurity.apply(webSecurityConfigurer)

找到org.springframework.boot.autoconfigure.EnableAutoConfiguration

建造者模式

开始创建

return filterChainProxy

空方法可拓展

Client

在spring-boot-autoconfigure的依赖包下，找到META-INF/spring.factories文件

init();

@EnableGlobalAuthentication

调用所有SecurityConfigurer的init()方法

@EnableWebSecurity

WebSecurityConfiguration

HttpSecurityConfiguration

@Conditional

Spring Security过滤器加载的的完整过程

Filter Chain

//InitializeAuthenticationProviderBeanManagerConfigurerInitializeAuthenticationProviderBeanManagerConfigurer(context)

@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)

beforeConfigure();

configure();

httpSecurity在这里build

new FilterChainProxy(securityFilterChains)

configurer.init((B) this);

Servlet

this.webSecurity.build();

securityFilterChains.add(securityFilterChainBuilder.build())

autowireBeanFactory.autowireBean(object);

SpringBootWebSecurityConfiguration

objectPostProcessor.postProcess(new WebSecurity(objectPostProcessor));

filterChainProxy.afterPropertiesSet();

自动配置一个SecurityFilterChain

/api/**

调用所有SecurityConfigurer的configure()方法

发现SpringBoot自动装配org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration