Spring Security 过滤器
- Spring Security 内置过滤器
- ChannelProcessingFilter
- ConcurrentSessionFilter
- WebAsyncManagerIntegrationFilter
- SecurityContextPersistenceFilter
- HeaderWriterFilter
- CorsFilter
- CsrfFilter
- LogoutFilter
- OAuth2AuthorizationRequestRedirectFilter
- Saml2WebSsoAuthenticationRequestFilter
- X509AuthenticationFilter
- AbstractPreAuthenticatedProcessingFilter
- CasAuthenticationFilter
- OAuth2LoginAuthenticationFilter
- Saml2WebSsoAuthenticationFilter
- UsernamePasswordAuthenticationFilter
- ConcurrentSessionFilter
- OpenIDAuthenticationFilter
- DefaultLoginPageGeneratingFilter
- DefaultLogoutPageGeneratingFilter
- DigestAuthenticationFilter
- BasicAuthenticationFilter
- RequestCacheAwareFilter
- SecurityContextHolderAwareRequestFilter
- JaasApiIntegrationFilter
- RememberMeAuthenticationFilter
- AnonymousAuthenticationFilter
- SessionManagementFilter
- ExceptionTranslationFilter
- FilterSecurityInterceptor
- SwitchUserFilter
常用内置过滤器讲解
- LogoutFilter
- LogoutFilter 处理注销的过滤器,可以通过 HttpSecurity.logout() 来定制注销逻辑
- UsernamePasswordAuthenticationFilter
- 处理用户以及密码认证的核心过滤器。认证请求提交的username和 password,被封装成token进行一系列的认证
- RememberMeAuthenticationFilter
- 处理 记住我 功能的过滤器,RememberMeAuthenticationFilter 通过 HttpSecurity.rememberMe() 及相关方法引入其配置对象 RememberMeConfigurer 来进行配置
- AnonymousAuthenticationFilter
- 匿名认证过滤器
- 对于 Spring Security 来说,所有对资源的访问都是有 Authentication 的。对于无需登录(UsernamePasswordAuthenticationFilter )直接可以访问的资源,会授予其匿名用户身份
- AnonymousAuthenticationFilter 通过 HttpSecurity.anonymous() 及相关方法引入其配置对象 AnonymousConfigurer 来进行配置
- 匿名认证过滤器
- SessionManagementFilter
- Session 管理器过滤器,内部维护了一个 SessionAuthenticationStrategy 用于管理 Session
- SessionManagementFilter 通过 HttpSecurity#sessionManagement() 及相关方法引入其配置对象 SessionManagementConfigurer 来进行配置
过滤器案例
- 定义过滤器
public class CaptchaAuthenticationFilter implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse resp = (HttpServletResponse) response;
if ("/doLogin".equals(req.getRequestURI()) && "POST".equals(req.getMethod().toUpperCase())) {
String captcha = req.getParameter("captcha");
if (captcha == null || captcha.trim().length() < 1) {
ForwardAuthenticationFailureHandler failureHandler = new ForwardAuthenticationFailureHandler("/loginFail");
failureHandler.onAuthenticationFailure(req, resp, new BadCaptchaAuthenticationException("验证码不能为空"));
return;
}
String code = req.getSession().getAttribute("captcha").toString();
if (captcha.equals(code)) {
chain.doFilter(request, response);
} else {
ForwardAuthenticationFailureHandler failureHandler = new ForwardAuthenticationFailureHandler("/loginFail");
failureHandler.onAuthenticationFailure(req, resp, new BadCaptchaAuthenticationException("验证码错误"));
}
} else {
chain.doFilter(request, response);
}
}
@Override
public void destroy() {
}
}
- 配置过滤器
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
//配置自定义认证和授权处理类
http.addFilterBefore(new CaptchaAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
}
}