SpringSecurity的Filter链式调用机制

本文通过书写自定义拦截器的方式模仿SpringSecurity中Filter的链式调用机制

在web.xml中配置拦截器，自定义拦截器

<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>com.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

被拦截器拦截下的请求会进入DelegatingFilterProxy 中

package com.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.web.filter.GenericFilterBean;

public class DelegatingFilterProxy extends GenericFilterBean {
    private Filter delegate=new FilterChainProxy();
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain filterChain) throws IOException, ServletException {
        // TODO Auto-generated method stub
        // Let the delegate perform the actual doFilter operation.
        invokeDelegate(delegate,request,response,filterChain);
    }
    private void invokeDelegate(Filter delagate, ServletRequest request,
            ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        // TODO Auto-generated method stub
        delagate.doFilter(request, response, filterChain);
    }

}

实现链式调用的核心环节

package com.filter;

import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.springframework.security.web.FilterInvocation;
import org.springframework.web.filter.GenericFilterBean;

public class FilterChainProxy extends GenericFilterBean implements Filter {

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain fc) throws IOException, ServletException {
        // TODO Auto-generated method stub
        // 此处的List为举例数据，实际情况中可以动态获取
        FilterInvocation fi=new FilterInvocation(request,response,fc);
        List<Filter> filters = getFilters(fi.getRequest());

        if (filters == null || filters.size() == 0) {
            fc.doFilter(request, response);
            return;
        }

        VirtualFilterChain virtualFilterChain = new VirtualFilterChain(fi, filters);
        virtualFilterChain.doFilter(fi.getRequest(), fi.getResponse());
    }
    private List<Filter> getFilters(HttpServletRequest request) {
        // TODO Auto-generated method stub
        List<Filter> filters=new ArrayList<Filter>();
        filters.add(new UsernamePasswordAuthenticationFilter());
        return filters;
    }
    private static class VirtualFilterChain implements FilterChain {
            private final FilterInvocation fi;
            private final List<Filter> additionalFilters;
            private final int size;
            private int currentPosition = 0;


            private VirtualFilterChain(FilterInvocation filterInvocation, List<Filter> additionalFilters) {
                this.fi = filterInvocation;
                this.additionalFilters = additionalFilters;
                this.size = additionalFilters.size();
            }

            public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
                if (currentPosition == size) {

                    fi.getChain().doFilter(request, response);
                } else {
                    currentPosition++;
                    Filter nextFilter = additionalFilters.get(currentPosition - 1);
                    nextFilter.doFilter(request, response, this);
                }
            }
        }
}

样例UsernamePasswordAuthenticationFilter 类，作为链中的一环出现

package com.filter;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.web.filter.GenericFilterBean;

public class UsernamePasswordAuthenticationFilter extends GenericFilterBean {

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain fc) throws IOException, ServletException {
        // TODO Auto-generated method stub
        System.out.println("-----------");
        fc.doFilter(request, response);
        System.out.println("-----------");
    }

}