Spring Security Web 5.1.2 源码解析 -- LoginUrlAuthenticationEntryPoint

概述

ExceptionTranslationFilter使用一个AuthenticationEntryPoint在需要的时候来启动表单认证流程，缺省使用的实现是类LoginUrlAuthenticationEntryPoint,它的认证表单的请求提交由UsernamePasswordAuthenticationFilter负责处理。

在安全配置时可以给ExceptionTranslationFilter设定一个其他的AuthenticationEntryPoint，而不一定要是LoginUrlAuthenticationEntryPoint。
比如 :

  http.
     ///...
  	.exceptionHandling()
		.authenticationEntryPoint(new CustomizedLoginUrlAuthenticationEntryPoint("/loginPage"))

LoginUrlAuthenticationEntryPoint带有一个属性loginFormUrl指向表单登录页面的位置，基于此可以构建到表单登录页面的重定向URL。如果该属性是一个绝对路径URL，则可以直接用于重定向。

如果loginFormUrl是一个相对路径URL，可以设置另外一个属性forceHttps为true,这样即使原来请求的URL基于HTTP,现在都会强制跳转到使用HTTPS的登录页面。这种情况下，基于HTTPS的认证流程成功时，原来的资源访问仍然使用HTTP。

强制HTTPS登录认证的forceHttps机制依赖PortMapper获取HTTP:HTTPS两种协议之间的端口映射。

loginFormUrl使用绝对路径URL时，forceHttps机制不工作。

源代码解析

package org.springframework.security.web.authentication;

import java.io.IOException;

import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.DefaultRedirectStrategy;
import org.springframework.security.web.PortMapper;
import org.springframework.security.web.PortMapperImpl;
import org.springframework.security.web.PortResolver;
import org.springframework.security.web.PortResolverImpl;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.access.ExceptionTranslationFilter;
import org.springframework.security.web.util.RedirectUrlBuilder;
import org.springframework.security.web.util.UrlUtils;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;


public class LoginUrlAuthenticationEntryPoint implements AuthenticationEntryPoint,
		InitializingBean {
	// ~ Static fields/initializers
	// ============================================================================

	private static final Log logger = LogFactory
			.getLog(LoginUrlAuthenticationEntryPoint.class);

	// ~ Instance fields
	// ============================================================================

	private PortMapper portMapper = new PortMapperImpl();

	private PortResolver portResolver = new PortResolverImpl();

	private String loginFormUrl;

	// 缺省是否强制使用HTTPS进行登录认证
	private boolean forceHttps = false;

	// 指定是否要使用 forward， 缺省为 false， 
	// true -- 使用 forward
	// false -- 使用 redirect
	private boolean useForward = false;

	// 跳转到登录页面的重定向策略
	private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

	/**
	 *
	 * @param loginFormUrl 登录页面的url。可以是相对路径，相对于 web-app context path ，前头带/，
	 * 也可以是绝对路径url
	 */
	public LoginUrlAuthenticationEntryPoint(String loginFormUrl) {
		Assert.notNull(loginFormUrl, "loginFormUrl cannot be null");
		this.loginFormUrl = loginFormUrl;
	}

	// ~ Methods
	// =============================================================================

	// InitializingBean 接口定义的方法，在该bean创建后初始化阶段会调用该方法，主要是对属性 loginFormUrl进行
	// 格式检查和断言
	public void afterPropertiesSet() throws Exception {
		Assert.isTrue(
				StringUtils.hasText(loginFormUrl)
						&& UrlUtils.isValidRedirectUrl(loginFormUrl),
				"loginFormUrl must be specified and must be a valid redirect URL");
		if (useForward && UrlUtils.isAbsoluteUrl(loginFormUrl)) {
			throw new IllegalArgumentException(
					"useForward must be false if using an absolute loginFormURL");
		}
		Assert.notNull(portMapper, "portMapper must be specified");
		Assert.notNull(portResolver, "portResolver must be specified");
	}

	/**
	 * Allows subclasses to modify the login form URL that should be applicable for a
	 * given request.
	 * 确定登录页面的url，子类可以覆盖实现该方法修改最终要应用的url。
	 * 缺省等同于方法 getLoginFormUrl()
	 * @param request the request
	 * @param response the response
	 * @param exception the exception
	 * @return the URL (cannot be null or empty; defaults to #getLoginFormUrl()}
	 */
	protected String determineUrlToUseForThisRequest(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException exception) {

		return getLoginFormUrl();
	}

	/**
	 * Performs the redirect (or forward) to the login form URL.
	 * 开始登录认证流程：重定向(redirect)或者forward到登录页面URL
	 */
	public void commence(HttpServletRequest request, HttpServletResponse response,
			AuthenticationException authException) throws IOException, ServletException {

		String redirectUrl = null;

		if (useForward) {
			// 使用 forward 的情况
			
			if (forceHttps && "http".equals(request.getScheme())) {
				// First redirect the current request to HTTPS.
				// When that request is received, the forward to the login page will be
				// used.
				// 如果强制使用HTTPS进行登录认证则并忽略 useForward 指令，
				// 构建相应的url,随后仍然进行 redirect
				redirectUrl = buildHttpsRedirectUrlForRequest(request);
			}

			if (redirectUrl == null) {
				// redirectUrl == null表示没有要求强制使用HTTPS
				// 则获取 loginFormUrl 执行 forward
				String loginForm = determineUrlToUseForThisRequest(request, response,
						authException);

				if (logger.isDebugEnabled()) {
					logger.debug("Server side forward to: " + loginForm);
				}

				RequestDispatcher dispatcher = request.getRequestDispatcher(loginForm);

				dispatcher.forward(request, response);

				return;
			}
		}
		else {
			// redirect to login page. Use https if forceHttps true		
			// 构建登录页面重定向URL,包含对forceHttps==true的处理
			redirectUrl = buildRedirectUrlToLoginPage(request, response, authException);

		}

		// 重定向到登录认证页面
		redirectStrategy.sendRedirect(request, response, redirectUrl);
	}

	protected String buildRedirectUrlToLoginPage(HttpServletRequest request,
			HttpServletResponse response, AuthenticationException authException) {

		String loginForm = determineUrlToUseForThisRequest(request, response,
				authException);

		if (UrlUtils.isAbsoluteUrl(loginForm)) {
			// 如果loginForm url是绝对路径，直接返回使用
			return loginForm;
		}

		int serverPort = portResolver.getServerPort(request);
		String scheme = request.getScheme();

		RedirectUrlBuilder urlBuilder = new RedirectUrlBuilder();

		urlBuilder.setScheme(scheme);
		urlBuilder.setServerName(request.getServerName());
		urlBuilder.setPort(serverPort);
		urlBuilder.setContextPath(request.getContextPath());
		urlBuilder.setPathInfo(loginForm);

		// 如果启用了 forceHttps , 则替换 协议部分和端口部分
		if (forceHttps && "http".equals(scheme)) {
			Integer httpsPort = portMapper.lookupHttpsPort(Integer.valueOf(serverPort));

			if (httpsPort != null) {
				// Overwrite scheme and port in the redirect URL
				urlBuilder.setScheme("https");
				urlBuilder.setPort(httpsPort.intValue());
			}
			else {
				logger.warn("Unable to redirect to HTTPS as no port mapping found for HTTP port "
						+ serverPort);
			}
		}

		return urlBuilder.getUrl();
	}

	/**
	 * Builds a URL to redirect the supplied request to HTTPS. Used to redirect the
	 * current request to HTTPS, before doing a forward to the login page.
	 */
	protected String buildHttpsRedirectUrlForRequest(HttpServletRequest request)
			throws IOException, ServletException {

		int serverPort = portResolver.getServerPort(request);
		Integer httpsPort = portMapper.lookupHttpsPort(Integer.valueOf(serverPort));

		if (httpsPort != null) {
			RedirectUrlBuilder urlBuilder = new RedirectUrlBuilder();
			urlBuilder.setScheme("https");
			urlBuilder.setServerName(request.getServerName());
			urlBuilder.setPort(httpsPort.intValue());
			urlBuilder.setContextPath(request.getContextPath());
			urlBuilder.setServletPath(request.getServletPath());
			urlBuilder.setPathInfo(request.getPathInfo());
			urlBuilder.setQuery(request.getQueryString());

			return urlBuilder.getUrl();
		}

		// Fall through to server-side forward with warning message
		logger.warn("Unable to redirect to HTTPS as no port mapping found for HTTP port "
				+ serverPort);

		return null;
	}

	/**
	 * Set to true to force login form access to be via https. If this value is true (the
	 * default is false), and the incoming request for the protected resource which
	 * triggered the interceptor was not already https, then the client will
	 * first be redirected to an https URL, even if serverSideRedirect is set to
	 * true.
	 */
	public void setForceHttps(boolean forceHttps) {
		this.forceHttps = forceHttps;
	}

	protected boolean isForceHttps() {
		return forceHttps;
	}

	public String getLoginFormUrl() {
		return loginFormUrl;
	}

	public void setPortMapper(PortMapper portMapper) {
		Assert.notNull(portMapper, "portMapper cannot be null");
		this.portMapper = portMapper;
	}

	protected PortMapper getPortMapper() {
		return portMapper;
	}

	public void setPortResolver(PortResolver portResolver) {
		Assert.notNull(portResolver, "portResolver cannot be null");
		this.portResolver = portResolver;
	}

	protected PortResolver getPortResolver() {
		return portResolver;
	}

	/**
	 * Tells if we are to do a forward to the {@code loginFormUrl} using the
	 * {@code RequestDispatcher}, instead of a 302 redirect.
	 *
	 * @param useForward true if a forward to the login page should be used. Must be false
	 * (the default) if {@code loginFormUrl} is set to an absolute value.
	 */
	public void setUseForward(boolean useForward) {
		this.useForward = useForward;
	}

	protected boolean isUseForward() {
		return useForward;
	}
}

参考文章

Spring Security Web 5.1.2 源码解析 – 框架缺省使用的页面重定向策略