java

关注公众号 jb51net

关闭
首页 > 软件编程 > java > Java SpringSecurity

Java SpringSecurity入门案例与基本原理详解

作者:Splaying

这篇文章主要介绍了java中Spring Security的实例详解的相关资料,spring security是一个多方面的安全认证框架,提供了基于JavaEE规范的完整的安全认证解决方案,需要的朋友可以参考下

1、入门案例

1.1、创建SpringBoot项目

在这里插入图片描述

1.2、勾选对应的maven依赖

在这里插入图片描述

这里一些依赖可以没有,最主要是要有Web和Security两个依赖即可!

1.3、编写Controller路由

@Controller
public class RouterController {
    @RequestMapping(value = {"/index","/","/index.html"})
    @ResponseBody
    public String success(){
        return "Hello SpringSecurity";
    }
}

在这里插入图片描述

1.4、启动项目

在这里插入图片描述

2、基本原理

2.1、Security的本质

org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter
org.springframework.security.web.context.SecurityContextPersistenceFilter
org.springframework.security.web.header.HeaderWriterFilter
org.springframework.security.web.csrf.CsrfFilter
org.springframework.security.web.authentication.logout.LogoutFilter
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter
org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter
org.springframework.security.web.savedrequest.RequestCacheAwareFilter
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter
org.springframework.security.web.authentication.AnonymousAuthenticationFilter
org.springframework.security.web.session.SessionManagementFilter
org.springframework.security.web.access.ExceptionTranslationFilter
org.springframework.security.web.access.intercept.FilterSecurityInterceptor

2.2、Security装载过程(一)

在这里插入图片描述

// 过滤器执行链
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    Filter delegateToUse = this.delegate;
    if (delegateToUse == null) {
        synchronized(this.delegateMonitor) {
            delegateToUse = this.delegate;
            if (delegateToUse == null) {
                WebApplicationContext wac = this.findWebApplicationContext();
                if (wac == null) {
                    throw new IllegalStateException("No WebApplicationContext found: no ContextLoaderListener or DispatcherServlet registered?");
                }
                delegateToUse = this.initDelegate(wac);
            }
            this.delegate = delegateToUse;
        }
    }
    this.invokeDelegate(delegateToUse, request, response, filterChain);
}
protected Filter initDelegate(WebApplicationContext wac) throws ServletException {
    String targetBeanName = this.getTargetBeanName();			//FilterChainProxy
    Assert.state(targetBeanName != null, "No target bean name set");
    Filter delegate = (Filter)wac.getBean(targetBeanName, Filter.class);
    if (this.isTargetFilterLifecycle()) {
        delegate.init(this.getFilterConfig());
    }
    return delegate;
}

2.3、Security装载过程(二)

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	....
		doFilterInternal(request, response, chain);
	....
}
private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
		throws IOException, ServletException {
	...
	List<Filter> filters = getFilters(firewallRequest);
	...
}

在这里插入图片描述

一共有14个自动装配好的过滤器、拦截器

2.4、UsernamePasswordAuthenticationFilter过滤器

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
		throws AuthenticationException {
	if (this.postOnly && !request.getMethod().equals("POST")) {
		throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
	}
	String username = obtainUsername(request);
	username = (username != null) ? username : "";
	username = username.trim();
	String password = obtainPassword(request);
	password = (password != null) ? password : "";
	UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
	// Allow subclasses to set the "details" property
	setDetails(request, authRequest);
	return this.getAuthenticationManager().authenticate(authRequest);
}

其中核心的方法是authenticate()方法,在这里对用户提交的账号和密码进行验证。

总结

本篇文章就到这里了,希望能够给你带来帮助,也希望您能够多多关注脚本之家的更多内容!

您可能感兴趣的文章:
阅读全文