spring-security（一）java config加载机制-WebSecurityConfiguration

阅读更多

前言：
  spring security给我们提供了功能非常强大的安全保护机制，在使用时的配置也极其简单，在和spring boot工程集成的时候，简单到只需要我们用一个注解@EnableWebSecurity就可以把需要的过滤器都配置好，可是这一切是怎么发生的呢？在本系列文章的第一篇就让我们结合源码来一探究竟。
环境：
  spring boot 版本:1.5.4.RELEASE
 

1.@EnableWebSecurity注解

@Retention(value = java.lang.annotation.RetentionPolicy.RUNTIME)
@Target(value = { java.lang.annotation.ElementType.TYPE })
@Documented
@Import({ WebSecurityConfiguration.class,
		SpringWebMvcImportSelector.class })
@EnableGlobalAuthentication
@Configuration
public @interface EnableWebSecurity {

	/**
	 * Controls debugging support for Spring Security. Default is false.
	 * @return if true, enables debug support with Spring Security
	 */
	boolean debug() default false;
}

在这个注解中主要是引入了WebSecurityConfiguration.class这个配置类，另一个就是加入了@EnableGlobalAuthentication 这个注解，本篇文章主要介绍WebSecurityConfiguration.class这个类，下一篇文章将重点介绍EnableGlobalAuthentication这个注解

2.WebSecurityConfiguration类

@Configuration
public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
	private WebSecurity webSecurity;

	private Boolean debugEnabled;

	private List> webSecurityConfigurers;

	....


	/**
	 * Creates the Spring Security Filter Chain
	 * @return
	 * @throws Exception
	 */
	@Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
	public Filter springSecurityFilterChain() throws Exception {
		boolean hasConfigurers = webSecurityConfigurers != null
				&& !webSecurityConfigurers.isEmpty();
		if (!hasConfigurers) {
			WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor
					.postProcess(new WebSecurityConfigurerAdapter() {
					});
			webSecurity.apply(adapter);
		}
		return webSecurity.build();
	}

	....

	/**
	 * Sets the {@code }
	 * instances used to create the web configuration.
	 *
	 * @param objectPostProcessor the {@link ObjectPostProcessor} used to create a
	 * {@link WebSecurity} instance
	 * @param webSecurityConfigurers the
	 * {@code } instances used to
	 * create the web configuration
	 * @throws Exception
	 */
	@Autowired(required = false)
	public void setFilterChainProxySecurityConfigurer(
			ObjectPostProcessor