SpringSecurity的配置详解——websecurity

Websecurity类主要的继承关系为自Websecurity->AbstractConfiguredSecurityBuilder->AbstractSecurityBuilder,其中上一步调用的build方法就在AbstractSecurityBuilder中 

SpringSecurity在这个类中实现了创建FilterChain的方法——performbuild

/***
*在生成发生后立即执行可运行文件*
*@参数后期生成操作
*@返回@link websecurity进行进一步的自定义
*/
@Override
	protected Filter performBuild() throws Exception {
		Assert.state(
				!securityFilterChainBuilders.isEmpty(),
				"At least one SecurityBuilder needs to be specified. Typically this done by adding a @Configuration that extends WebSecurityConfigurerAdapter. More advanced users can invoke "
						+ WebSecurity.class.getSimpleName()
						+ ".addSecurityFilterChainBuilder directly");
		int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();
		List securityFilterChains = new ArrayList(
				chainSize);
		for (RequestMatcher ignoredRequest : ignoredRequests) {
			securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));
		}
		for (SecurityBuilder securityFilterChainBuilder : securityFilterChainBuilders) {
			securityFilterChains.add(securityFilterChainBuilder.build());
		}
		FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
		if (httpFirewall != null) {
			filterChainProxy.setFirewall(httpFirewall);
		}
		filterChainProxy.afterPropertiesSet();

		Filter result = filterChainProxy;
		if (debugEnabled) {
			logger.warn("\n\n"
					+ "********************************************************************\n"
					+ "**********        Security debugging is enabled.       *************\n"
					+ "**********    This may include sensitive information.  *************\n"
					+ "**********      Do not use in a production system!     *************\n"
					+ "********************************************************************\n\n");
			result = new DebugFilter(filterChainProxy);
		}
		postBuildAction.run();
		return result;
	}

 

在构建FilterChain的过程中，我们可以发现使用了两个关键的对象——ignoredRequest和securityFilterChainBuilders：

int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();
List securityFilterChains = new ArrayList(
      chainSize);

int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();

首先，我们来看一看securityFilterChainBuilders：

在WebSecurityConfigureAdapter类中的init方法中有如下语句：

final HttpSecurity http = getHttp();
web.addSecurityFilterChainBuilder(http)

也就是说，这个securityFilterChainBuilders中存放的是获取到的httpSecurity实例对象（此处应该注意的是虽然我们的http对象是通过一种"add"的形式添加到securityFilterChainBuilders中的，但是，通过阅读WebSecurityConfigureAdapter的getHttp（）方法中的代码我们可以知道一个WebSecurityConfigureAdapter类中通过getHttp（）方法只会获得一个http实例——）

之后我们通过阅读HttpSecurity类的代码可以知道，这个http实例中包含了我们创建过滤器链所需要的各种过滤器的配置类的实例；

那么，既然我们创建FilterChain所需要的配置实例已经包含进来了，这个ignoredRequests到底是什么呢？？

我们可以查看一下它的源码：
private final List ignoredRequests = new ArrayList();

在这里我们可以看出ignoredRequests对象是一个RequestMatcher对象的列表，再来看看RequestMatcher:
 

public interface RequestMatcher {

   /**
    * Decides whether the rule implemented by the strategy matches the supplied request.
    *
    * @param request the request to check for a match
    * @return true if the request matches, false otherwise
    */
   boolean matches(HttpServletRequest request);

}

这是一个接口，其中注释的意思是——

决定策略实现的规则是否与提供的请求匹配。

@param请求检查匹配的请求

@如果请求匹配，则返回true，否则返回false

之后，这是创建过滤器链的代码：
 

int chainSize = ignoredRequests.size() + securityFilterChainBuilders.size();
List securityFilterChains = new ArrayList(
      chainSize);
for (RequestMatcher ignoredRequest : ignoredRequests) {
   securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));
}
for (SecurityBuilder securityFilterChainBuilder : securityFilterChainBuilders) {
   securityFilterChains.add(securityFilterChainBuilder.build());
}

public final class WebSecurity extends
		AbstractConfiguredSecurityBuilder implements
		SecurityBuilder, ApplicationContextAware {
	private final Log logger = LogFactory.getLog(getClass());

	private final List ignoredRequests = new ArrayList();

	private final List> securityFilterChainBuilders = new ArrayList>();

	private IgnoredRequestConfigurer ignoredRequestRegistry;

	private FilterSecurityInterceptor filterSecurityInterceptor;

	private HttpFirewall httpFirewall;

	private boolean debugEnabled;

	private WebInvocationPrivilegeEvaluator privilegeEvaluator;

	private DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();

	private SecurityExpressionHandler expressionHandler = defaultWebSecurityExpressionHandler;

	private Runnable postBuildAction = new Runnable() {
		public void run() {
		}
	};

	/**
	 * Creates a new instance
	 * @param objectPostProcessor the {@link ObjectPostProcessor} to use
	 * @see WebSecurityConfiguration
	 */
	public WebSecurity(ObjectPostProcessor