Spring Security系列-Spring Security生命周期之出征

前言

本往篇是三部曲的最后一篇，本次我们来谈谈Spring Security是怎么对request请求进行拦截处理的。

入口

当客户端发送http request请求时，就会进入之前通过SpringSecurity创建的FilterChainProxy的doFilter方法，再进入doFilterInternal方法。

public class FilterChainProxy extends GenericFilterBean {
	@Override
	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;
		if (clearContext) {
			try {
				request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
				doFilterInternal(request, response, chain);
			}
			finally {
				SecurityContextHolder.clearContext();
				request.removeAttribute(FILTER_APPLIED);
			}
		}
		else {
			doFilterInternal(request, response, chain);
		}
	}
	
	private void doFilterInternal(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {

		FirewalledRequest fwRequest = firewall
				.getFirewalledRequest((HttpServletRequest) request);
		HttpServletResponse fwResponse = firewall
				.getFirewalledResponse((HttpServletResponse) response);

		List<Filter> filters = getFilters(fwRequest);

		if (filters == null || filters.size() == 0) {
			if (logger.isDebugEnabled()) {
				logger.debug(UrlUtils.buildRequestUrl(fwRequest)
						+ (filters == null ? " has no matching filters"
								: " has an empty filter list"));
			}

			fwRequest.reset();

			chain.doFilter(fwRequest, fwResponse);

			return;
		}

		VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters);
		vfc.doFilter(fwRequest, fwResponse);
	}
}

接着，进入VirtualFilterChain类的doFilter方法

private static class VirtualFilterChain implements FilterChain {
	@Override
	publicvoid doFilter(ServletRequest request, ServletResponse response)
			throws IOException, ServletException {
		if (currentPosition == size) {
			if (logger.isDebugEnabled()) {
				logger.debug(UrlUtils.buildRequestUrl(firewalledRequest)
						+ " reached end of additional filter chain; proceeding with original chain");
			}

			// Deactivate path stripping as we exit the security filter chain
			this.firewalledRequest.reset();

			originalChain.doFilter(request, response);
		}
		else {
			currentPosition++;

			Filter nextFilter = additionalFilters.get(currentPosition - 1);

			if (logger.isDebugEnabled()) {
				logger.debug(UrlUtils.buildRequestUrl(firewalledRequest)
						+ " at position " + currentPosition + " of " + size
						+ " in additional filter chain; firing Filter: '"
						+ nextFilter.getClass().getSimpleName() + "'");
			}

			nextFilter.doFilter(request, response, this);
		}
	}
}

上面的additionalFilters就是我们上一讲所讲到的，生成的12个filters。上面的nextFilter就是在循环这12个filters，并在每一次循环中调用它们的doFilter方法。

GenericFilterBean

GenericFilterBean类是继承javax.servlet.Filter接口的。也就会在Tomcat接收到HttpRequest请求时，就调用Filter接口的doFilter方法。

public interface Filter {

    public default void init(FilterConfig filterConfig) throws ServletException {}

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException;

    public default void destroy() {}
}

自定义Filter

有兴趣的读者可以试一下下面的代码，当tomcat收到httpRequest的时候，就会触发doFilter方法。

@Component
public class MyFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        System.out.println("Do Filter");
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {

    }
}

总结

SpringSecurity之所以能过滤，主要还是继承了javax.servlet.Filter接口。