SpringSecurity AbstractAuthenticationProcessingFilter

1.AbstractAuthenticationProcessingFilter从HttpServletRequest中创建Authentication
Authentication的类型根据AbstractAuthenticationProcessingFilter的子类决定,比如:
1)UsernamePasswordAuthenticationFilter 创建一个UsernamePasswordAuthenticationToken
所以如果遇到不能认证的Token就会抛出异常

2.Authentication传入AuthenticationManager认证

3.如果认证失败:
1)清空上下文
2)调用RememberMeServices.loginFail
2)调用AuthenticationFailureHandler

4.如果成功
1)SessionAuthenticationStrategy注意新的登录
2)SecurityContextHolder中保存Authentication,接下来还会保存到HttpSession中
3)调用RememberMeServices.loginSuccess
4)调用ApplicationEventPublisher
5)调用AuthenticationSuccessHandler

参考:
https://docs.spring.io/spring-security/site/docs/5.4.5/reference/html5/#servlet-authentication-abstractprocessingfilter