Security principle analysis

Security principle analysis

Spring Security filter chain

Spring Security uses a chain of responsibility design pattern, which has a very long filter chain. Now explain each of this filter chain:

1. WebAsyncManagerIntegrationFilter: Integrate the Security context with the WebAsyncManager used to process asynchronous request mapping in Spring Web.
2. SecurityContextPersistenceFilter: Load the security context information related to the request into the SecurityContextHolder before each request is processed, and then after the request is processed, store the information about the request in the SecurityContextHolder in a "repository", and then store the SecurityContextHolder Clearing information in, for example, maintaining a user's security information in the Session is handled by this filter.
3. HeaderWriterFilter: Used to add header information to the response.
4. CsrfFilter: Used to deal with cross-site request forgery.
5. LogoutFilter: Used to process logout.
6. UsernamePasswordAuthenticationFilter: Used to process form-based login requests and obtain username and password from the form. From the default processing /loginrequest. When the user name and password acquired from the form, the form name of the default value usernameand password, these values can be modified by setting the value of the filter and passwordParameter usernameParameter two parameters.
7. DefaultLoginPageGeneratingFilter: If the login page is not configured, this filter will be configured when the system is initialized and used to generate a login form page when a login is required.
8. BasicAuthenticationFilter: detect and process http basic authentication.
9. RequestCacheAwareFilter: The cache used to process requests.
10. SecurityContextHolderAwareRequestFilter: Mainly wraps the request object request.
11. AnonymousAuthenticationFilter: Detect whether there is an Authentication object in the SecurityContextHolder, and if it does not exist, provide it with an anonymous Authentication.
12. SessionManagementFilter: filter for managing session
13. ExceptionTranslationFilter: handle AccessDeniedException and AuthenticationException exceptions.
14. FilterSecurityInterceptor: can be seen as the exit of the filter chain.
15. RememberMeAuthenticationFilter: When the user directly accesses the resource without logging in, find the user's information from the cookie. If Spring Security can recognize the remember me cookie provided by the user, the user will not need to fill in the user name and password, but directly log in to the system. The filter is disabled by default.

Spring Security flowchart

Let's first look at the following Spring Security execution flow chart. As long as you understand the Spring Security execution process, this framework will become very simple:

Flow Description

1. The client initiates a request to enter the Security filter chain.
2. When it comes to LogoutFilter, judge whether it is the logout path, if it is the logout path, go to logoutHandler, if the logout is successful, go to the logoutSuccessHandler to logout successfully, if the logout fails, then the ExceptionTranslationFilter; if it is not the logout path, go directly to the next A filter.
3. When it comes to UsernamePasswordAuthenticationFilter, it is judged whether it is the login path. If it is, then enter the filter for login operation. If the login fails, go to the AuthenticationFailureHandler to process the login failure handler, if the login is successful, go to the AuthenticationSuccessHandler to process the login success handler, if not login The request does not enter the filter.
4. When you get to FilterSecurityInterceptor, you will get the uri. According to the uri, you will find the corresponding authentication manager. The authentication manager will do the authentication work. If the authentication succeeds, it will go to the Controller layer, otherwise it will go to the AccessDeniedHandler authentication failure handler.

The underlying code of two common filters in the filter chain

1.UsernamePasswordAuthenticationFilter filter

2.ExceptionTranslation filter