// 1.创建FilterChainProxy过程
public class WebSecurityConfiguration {
  @Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
  public Filter springSecurityFilterChain() throws Exception {
    // 当前环境中是否有自定义SecurityConfigurer类（WebSecurityConfigurerAdapter）；这里是自动注入的
    boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();
    // 当前环境中是否有自定义的SecurityFilterChain过滤器链Bean（这里是自动注入的）
    boolean hasFilterChain = !this.securityFilterChains.isEmpty();
    // 如果当前环境上面的两种情况都存在则会抛出异常。只能有一个成立即可
    Assert.state(!(hasConfigurers && hasFilterChain), "Found WebSecurityConfigurerAdapter as well as SecurityFilterChain. Please select just one.");
    // 如果都不存在，则会创建一个默认的SecurityConfigurer
    // 当我们项目中只是引入Spring Security包时就是该中情况
    if (!hasConfigurers && !hasFilterChain) {
      WebSecurityConfigurerAdapter adapter = this.objectObjectPostProcessor.postProcess(new WebSecurityConfigurerAdapter() {});
      this.webSecurity.apply(adapter);
    }
    // ...
    // 查找当前环境中是否有自定义的WebSecurityCustomizer类型的Bean
    // 我们可以自定义WebSecurityCustomizer然后设置WebSecurity忽略的请求URI
    for (WebSecurityCustomizer customizer : this.webSecurityCustomizers) {
      customizer.customize(this.webSecurity);
    }
    // 通过WebSecurity#build方法来构建FilterChainProxy
    return this.webSecurity.build();
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.

public final class WebSecurity {
  private final List<RequestMatcher> ignoredRequests = new ArrayList<>();
  protected Filter performBuild() throws Exception {
    // 计算过滤器链的大小，这两个集合是如何被设置的？
    // ignoredRequests 可以通过自定义WebSecurityCustomizer
    // 通过web.ignoring().antMatchers("/demos/home") ;方法添加
    // securityFilterChainBuilders 就是通过我们自定义WebSecurityConfigurerAdapter#init中构建的HttpSecurity
    int chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();
    List<SecurityFilterChain> securityFilterChains = new ArrayList<>(chainSize);
    // 为每一个忽略的uri配置一个过滤器链（注意：该中过滤器链中是没有过滤器的）
    for (RequestMatcher ignoredRequest : this.ignoredRequests) {
      securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));
    }
    // securityFilterChainBuilders上面已经说过基本就是我们自定义的WebSecurityConfigurerAdapter
    // 而该类在执行build方法的时候其实就是为HttpSecurity构建过滤器链
    for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : this.securityFilterChainBuilders) {
      securityFilterChains.add(securityFilterChainBuilder.build());
    }
    FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
    // 执行Bean的初始化过程
    filterChainProxy.afterPropertiesSet();
    Filter result = filterChainProxy;
    return result;
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.

@Component
public class CustomSecurityFilterChain implements SecurityFilterChain {
  @Override
  public boolean matches(HttpServletRequest request) {
    return false;
  }
  @Override
  public List<Filter> getFilters() {
    return new ArrayList<>() ;
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.

@Component
public class CustomWebSecurity implements WebSecurityCustomizer {
  @Override
  public void customize(WebSecurity web) {
    web.ignoring().antMatchers("/demos/home") ;
  }
}
1.
2.
3.
4.
5.
6.
7.

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  // ...
}
1.
2.
3.
4.

for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : this.securityFilterChainBuilders) {
  // HttpSecurity#build构建Filter过滤器练
  securityFilterChains.add(securityFilterChainBuilder.build());
}
1.
2.
3.
4.

public abstract class WebSecurityConfigurerAdapter  {
  public void init(WebSecurity web) throws Exception {
    // 构建HttpSecurity对象
    HttpSecurity http = getHttp();
    web.addSecurityFilterChainBuilder(http).postBuildAction(() -> {
      FilterSecurityInterceptor securityInterceptor = http.getSharedObject(FilterSecurityInterceptor.class);
      web.securityInterceptor(securityInterceptor);
    });
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

public final class HttpSecurity {
  protected DefaultSecurityFilterChain performBuild() {
    this.filters.sort(OrderComparator.INSTANCE);
    List<Filter> sortedFilters = new ArrayList<>(this.filters.size());
    for (Filter filter : this.filters) {
      sortedFilters.add(((OrderedFilter) filter).filter);
    }
    return new DefaultSecurityFilterChain(this.requestMatcher, sortedFilters);
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

@Component
public class AutoAuthenticationFilter extends OncePerRequestFilter {
  @Resource
  private AuthenticationManager authenticationManager ;
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
   UsernamePasswordAuthenticationToken authenication = new UsernamePasswordAuthenticationToken("admin", "123123") ;
    authenication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)) ;
    Authentication auth = authenticationManager.authenticate(authenication) ;
    if (auth != null) {
      SecurityContextHolder.getContext().setAuthentication(auth) ;
      request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext()) ;
    }
    System.out.println("--------------------------Auto Authenticaton Filter...") ;
    filterChain.doFilter(request, response) ;
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  @Resource
  private AutoAuthenticationFilter authFilter;
  protected void configure(HttpSecurity http) throws Exception {
    // 将自定义的过滤器添加到UsernamePasswordAuthenticationFilter过滤器的前面
    http.addFilterBefore(authFilter, UsernamePasswordAuthenticationFilter.class) ;  
  }
}
1.
2.
3.
4.
5.
6.
7.
8.
9.