Spring Security 自定义过滤链filters

编程语言 2018-05-12 06:14:35 阅读次数: 0
  • spring security过滤链filter的顺序参考, 查看org.springframework.security.config.http.HttpSecurityBeanDefinitionParser.createFilterChain代码： 
            //定义未排序filter集合。该集合中的对象为OrderDecorator实例。 
        List<OrderDecorator> unorderedFilterChain = new ArrayList<OrderDecorator>();
        //添加http、认证相关的filter集合
        unorderedFilterChain.addAll(httpBldr.getFilters());
        unorderedFilterChain.addAll(authBldr.getFilters());
        unorderedFilterChain.addAll(buildCustomFilterList(element, pc));
        //根据排序规则进行排序
        Collections.sort(unorderedFilterChain, new OrderComparator());
        //检查每个filter与前一个filter的位置是否相同  
        //这里的检查主要是防止自定义filter直接配置position属性，造成与默认的filter产生order冲突
        checkFilterChainOrder(unorderedFilterChain, pc, pc.extractSource(element));

        // The list of filter beans
        List<BeanMetadataElement> filterChain = new ManagedList<BeanMetadataElement>();
        //重新定义filterChain，把经过排序的filter依次添加到filterChain集合中
        for (OrderDecorator od : unorderedFilterChain) {
            filterChain.add(od.bean);
        }

        return createSecurityFilterChainBean(element, pc, filterChain);
     
  •         unorderedFilterChain.addAll(httpBldr.getFilters());
        unorderedFilterChain.addAll(authBldr.getFilters());
        unorderedFilterChain.addAll(buildCustomFilterList(element, pc));
     上述代码返回的过滤链已经是经过OrderDecorator类包装的带有过滤链order顺序属性的集合。
  • Collections.sort(unorderedFilterChain, new OrderComparator());
     OrderComparator就是过滤链的排序比较器了，比较算法部分代码： 
    public int compare(Object o1, Object o2) {
		boolean p1 = (o1 instanceof PriorityOrdered);
		boolean p2 = (o2 instanceof PriorityOrdered);
		if (p1 && !p2) {
			return -1;
		}
		else if (p2 && !p1) {
			return 1;
		}

		// Direct evaluation instead of Integer.compareTo to avoid unnecessary object creation.
		int i1 = getOrder(o1);
		int i2 = getOrder(o2);
		return (i1 < i2) ? -1 : (i1 > i2) ? 1 : 0;
	}
     检查自定义过滤链当指定position属性时有可能做成的位置冲突
  • private void checkFilterChainOrder(List<OrderDecorator> filters, ParserContext pc, Object source) {
        logger.info("Checking sorted filter chain: " + filters);

        for(int i=0; i < filters.size(); i++) {
            OrderDecorator filter = filters.get(i);

            if (i > 0) {
                OrderDecorator previous = filters.get(i-1);
                if (filter.getOrder() == previous.getOrder()) {
                    pc.getReaderContext().error("Filter beans '" + filter.bean + "' and '" +
                            previous.bean + "' have the same 'order' value. When using custom filters, " +
                                    "please make sure the positions do not conflict with default filters. " +
                                    "Alternatively you can disable the default filters by removing the corresponding " +
                                    "child elements from <http> and avoiding the use of <http auto-config='true'>.", source);
                }
            }
        }
    }
     
  • Spring Security用枚举类型org.springframework.security.config.http.SecurityFilters来维护filter的顺序，再用org.springframework.security.config.http.OrderDecorator来包装filter及filter的顺序，再由org.springframework.core.OrderComparator比较filter的先后顺序。
  • 要自定义Spring Security的过滤链就必须了解filter的先后顺序，否者Spring Security不会正常运作。
  • 在web.xml添加spring security过滤器代理 
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
<filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
     
  • 在web.xml添加session 事件发布 
    <listener>
        <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    </listener>
     
  • spring security 配置文件如下： 
    <?xml version="1.0" encoding="UTF-8"?>
<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns="http://www.springframework.org/schema/beans"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd">
    <bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
        <security:filter-chain-map request-matcher="ant">
            <security:filter-chain pattern="/**" filters="
                securityContextPersistenceFilter,
                currentSessionFilter,
                asyncManagerIntegrationFilter,
                logoutFilter,
                usernamePasswordAuthenticationFilter,
                basicAuthenticationFilter,
                requestCacheAwareFilter,
                contextHolderAwareRequestFilter,
                rememberMeAuthenticationFilter,
                anonymousAuthenticationFilter,
                sessionManagementFilter,
                exceptionTranslationFilter,
                filterSecurityInterceptor
            "/>
        </security:filter-chain-map>
    </bean>
    <bean id="securityContextPersistenceFilter"
          class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
        <constructor-arg ref="securityContextRepository"/>
        <property name="forceEagerSessionCreation" value="false"/>
    </bean>
    <bean id="securityContextRepository"
          class="org.springframework.security.web.context.HttpSessionSecurityContextRepository">
        <property name="allowSessionCreation" value="true"/>
    </bean>
    <bean id="usernamePasswordAuthenticationFilter"
          class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="customAuthenticationManager"/>
        <property name="usernameParameter" value="username"/>
        <property name="passwordParameter" value="password"/>
        <property name="rememberMeServices" ref="enhancedPersistentTokenBasedRememberMeServices"/>
        <property name="sessionAuthenticationStrategy" ref="compositeSessionAuthenticationStrategy"/>
        <property name="authenticationSuccessHandler" ref="savedRequestAwareAuthenticationSuccessHandler" />
        <property name="authenticationFailureHandler" ref="simpleUrlAuthenticationFailureHandler" />
        <property name="requiresAuthenticationRequestMatcher" ref="filterProcessUrlRequestMatcher" />
        <property name="allowSessionCreation" value="true"/>
    </bean>
    <bean id="savedRequestAwareAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler" >
        <property name="requestCache" ref="httpSessionRequestCache" />
        <property name="defaultTargetUrl" value="/home.html" />
    </bean>
    <bean id="anonymousAuthenticationFilter"
          class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
        <constructor-arg value="BF93JFJ091N00Q7HF"/>
    </bean>
    <bean id="filterSecurityInterceptor"
          class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="customAuthenticationManager"/>
        <property name="accessDecisionManager" ref="affirmativeBased"/>
        <property name="securityMetadataSource">
            <security:filter-security-metadata-source use-expressions="true">
                <security:intercept-url pattern="/css/*" access="permitAll"/>
                <security:intercept-url pattern="/js/*" access="permitAll"/>
                <security:intercept-url pattern="/fonts/*" access="permitAll"/>
                <security:intercept-url pattern="/signup.html*" access="permitAll"/>
                <security:intercept-url pattern="/login.html*" access="permitAll"/>
                <security:intercept-url pattern="/category.html*" access="permitAll"/>
                <security:intercept-url pattern="/category.html*" access="permitAll"/>
                <security:intercept-url pattern="/*" access="hasRole('ROLE_USER')"/>

            </security:filter-security-metadata-source>
        </property>
    </bean>
    <bean id="affirmativeBased" class="org.springframework.security.access.vote.AffirmativeBased">
        <constructor-arg type="java.util.List">
            <list>
                <ref bean="expressionVoter"/>
                <ref bean="roleVoter"/>
                <ref bean="authenticatedVoter"/>
            </list>
        </constructor-arg>
    </bean>
    <bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"/>
    <bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter"/>
    <bean id="daoAuthenticationProvider"
          class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userDao"/>
        <property name="passwordEncoder" ref="passwordEncoder"/>
    </bean>
    <bean id="anonymousAuthenticationProvider"
          class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
        <constructor-arg type="java.lang.String" value="BF93JFJ091N00Q7HF"/>
    </bean>
    <bean id="customAuthenticationManager" class="org.springframework.security.authentication.ProviderManager">
        <constructor-arg type="java.util.List">
            <list>
                <ref bean="daoAuthenticationProvider"/>
                <ref bean="anonymousAuthenticationProvider"/>
                <ref bean="rememberMeAuthenticationProvider"/>
            </list>
        </constructor-arg>
        <property name="authenticationEventPublisher" ref="defaultAuthenticationEventPublisher" />
    </bean>
    <bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <constructor-arg type="java.lang.String" value="/"/>
        <constructor-arg>
            <array>
                <ref bean="logoutHandler"/>
                <ref bean="enhancedPersistentTokenBasedRememberMeServices"/>
            </array>
        </constructor-arg>
        <property name="logoutRequestMatcher" ref="logoutFilterProcessUrlRequestMatcher" />
    </bean>


    <bean id="rememberMeAuthenticationFilter"
          class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
        <constructor-arg ref="customAuthenticationManager"/>
        <constructor-arg ref="enhancedPersistentTokenBasedRememberMeServices"/>
    </bean>
    <bean id="enhancedPersistentTokenBasedRememberMeServices"
          class="com.aasonwu.mycompany.EnhancedPersistentTokenBasedRememberMeServices">
        <constructor-arg type="java.lang.String"
                         value="BoSk70Yar38~veg91DoCKs=sLaIn!metE55bURgs71rug;ILEa=Ikon79sept+ree$Fuel99baKER;wOe43JackS=TinS79babA73tiLmibs10bIsE*"/>
        <constructor-arg type="org.springframework.security.core.userdetails.UserDetailsService"
                         ref="userDao"/>
        <constructor-arg
                type="org.springframework.security.web.authentication.rememberme.PersistentTokenRepository"
                ref="jdbcTokenRepository"/>
        <property name="cookieName" value="MYCOMPANY_REMEMBER_ME"/>
        <property name="parameter" value="remember_me"/>
    </bean>

    <bean id="jdbcTokenRepository"
          class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
        <property name="dataSource" ref="dataSource"/>
    </bean>

    <bean id="rememberMeAuthenticationProvider"
          class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
        <constructor-arg
                value="BoSk70Yar38~veg91DoCKs=sLaIn!metE55bURgs71rug;ILEa=Ikon79sept+ree$Fuel99baKER;wOe43JackS=TinS79babA73tiLmibs10bIsE*"/>
    </bean>

    <bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
        <constructor-arg ref="loginUrlAuthenticationEntryPoint"/>
        <constructor-arg ref="httpSessionRequestCache"/>
        <property name="accessDeniedHandler" ref="accessDeniedHandler"/>
    </bean>

    <bean id="loginUrlAuthenticationEntryPoint"
          class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <constructor-arg value="/login.html"/>
    </bean>

    <bean id="accessDeniedHandler" class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
        <property name="errorPage" value="/accessDenied.html"/>
    </bean>

    <bean id="expressionHandler"
          class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>

    <bean id="expressionVoter" class="org.springframework.security.web.access.expression.WebExpressionVoter">
        <property name="expressionHandler" ref="expressionHandler"/>
    </bean>
    <!--session manager-->
    <bean id="currentSessionFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <constructor-arg type="org.springframework.security.core.session.SessionRegistry" ref="sessionRegistry"/>
        <constructor-arg type="java.lang.String" value="/login.html"/>
        <property name="logoutHandlers" ref="logoutHandler"/>
    </bean>
    <bean id="logoutHandler"
          class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler">
        <property name="invalidateHttpSession" value="true"/>
        <property name="clearAuthentication" value="true"/>
    </bean>
    <bean id="sessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter">
        <constructor-arg ref="securityContextRepository"/>
        <constructor-arg ref="compositeSessionAuthenticationStrategy"/>
        <property name="authenticationFailureHandler" ref="simpleUrlAuthenticationFailureHandler"/>
        <!--<property name="invalidSessionStrategy" ref="simpleRedirectInvalidSessionStrategy" />-->
    </bean>
    <bean id="contextHolderAwareRequestFilter"
          class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter">
        <property name="authenticationManager" ref="customAuthenticationManager"/>
    </bean>

    <bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

    <bean id="sessionFixationProtectionStrategy"
          class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
        <property name="migrateSessionAttributes" value="true"/>
    </bean>

    <bean id="compositeSessionAuthenticationStrategy"
          class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
        <constructor-arg>
            <list>
                <ref bean="sessionControlAuthenticationStrategy"/>
                <ref bean="sessionFixationProtectionStrategy"/>
                <ref bean="registerSessionAuthenticationStrategy"/>
            </list>
        </constructor-arg>
    </bean>
    <bean id="sessionControlAuthenticationStrategy"
          class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
        <constructor-arg ref="sessionRegistry"/>
        <property name="maximumSessions" value="1"/>
        <!--<property name="exceptionIfMaximumExceeded" value="false" />-->
    </bean>
    <bean id="registerSessionAuthenticationStrategy"
          class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
        <constructor-arg ref="sessionRegistry"/>
    </bean>
    <bean id="simpleUrlAuthenticationFailureHandler"
          class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
        <constructor-arg value="/login.html"/>
        <property name="allowSessionCreation" value="true" />
    </bean>
    <bean id="simpleRedirectInvalidSessionStrategy"
          class="org.springframework.security.web.session.SimpleRedirectInvalidSessionStrategy">
        <constructor-arg value="/accessDenied.html"/>
    </bean>
    <bean id="asyncManagerIntegrationFilter"
          class="org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter"/>
    <bean id="basicAuthenticationFilter"
          class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
        <constructor-arg ref="customAuthenticationManager"/>
        <constructor-arg ref="basicAuthenticationEntryPoint"/>
    </bean>
    <bean id="basicAuthenticationEntryPoint"
          class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
        <property name="realmName" value="Spring Security Application"/>
    </bean>

    <bean id="httpSessionRequestCache" class="org.springframework.security.web.savedrequest.HttpSessionRequestCache">
        <property name="createSessionAllowed" value="true"/>
    </bean>
    <bean id="requestCacheAwareFilter" class="org.springframework.security.web.savedrequest.RequestCacheAwareFilter">
        <constructor-arg ref="httpSessionRequestCache"/>
    </bean>
    <bean id="defaultAuthenticationEventPublisher" class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher" />

    <bean id="filterProcessUrlRequestMatcher" class="org.springframework.security.web.authentication.logout.LogoutFilter$FilterProcessUrlRequestMatcher">
        <constructor-arg value="/login" />
    </bean>

    <bean id="logoutFilterProcessUrlRequestMatcher" class="org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter$FilterProcessUrlRequestMatcher">
        <constructor-arg value="/logout"/>
    </bean>

    <security:global-method-security pre-post-annotations="enabled" />
</beans>
     
  • 这个配置接近使用命名空间配置上下文的环境，并实现了自定义的userDetailServics, remember me 功能。

猜你喜欢

转载自aasonwu.iteye.com/blog/2066991
今日推荐
美国拟限制 AI 大模型出口中国和俄罗斯
苹果将与 OpenAI 达成协议，将 ChatGPT 应用于 iPhone
openKylin 社区生态委员会第六次会议圆满召开
阿里云正式发布通义千问 2.5
Python 3.13 发布首个 Beta：实验性自由线程模式和 JIT、改进交互式解释器
Stack Overflow 拿我的代码去训练 AI 大模型，还封了我的账号
Pop!_OS 的 COSMIC 桌面完成 App Store 上架工作
报告：Django 仍然是 74% 开发者的首选
《2024 年一季度互联网投融资运行情况》研究报告
15 年前上了“FFmpeg 耻辱柱”，今天他还得谢谢咱——腾讯QQPlayer一雪前耻？
TIOBE 5 月榜单：Fortran “复活”进入 Top 10
GCC 14.1 发布
周排行
NEFU 117 素数个数的位数
Closest Common Ancestors (Lca,tarjan)
ELK部署
【转载】Hive笔记整理（三）
SQL语句（一）基本表的定义
关于Java web开发中的MySQL的事务语句
MFC创建自定义窗体
如何用一句话激怒程序员？
《逆袭大学》文摘——9.4 基础和应用的平衡中找到大学的节奏
【spring源码分析】@Value注解原理
每日归档
更多
2024-05-11(38)
2024-05-10(38)
2024-05-09(35)
2024-05-08(42)
2024-05-07(14)
2024-05-06(40)
2024-05-05(0)
2024-05-04(7)
2024-05-03(19)
2024-05-02(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022