学习springSecurit第二节-httpSecurity

前一节，我们已经了解了springSecurity的主体结构 ，这一节我们将分析HttpSecurity 是如何创建SecurityFilterChain的。

HttpSecurity：

HttpSecurity是用来创建SecurityFilterChain，这里要注意与WebSecurity区分，WebSecurity是用来创建Filter的。

SecurityFilterChain：

public interface SecurityFilterChain {

	boolean matches(HttpServletRequest request);

	List getFilters();
}

SecurityFilterChain 有两部分组成，1：是请求是否匹配，2：请求匹配后使用的过滤器链。

HttpSecurity 是一个SecurityBuilder ，其用来创建SecurityFilterChain ，要想使HttpSecurity构建不同的SecurityFilterChain，可以为HttpSecurity添加不同的SecurityConfigurer来实现。每一种SecurityConfigurer将会在HttpSecurity创建SecurityFilterChain时，加入不同的filter。

public abstract class WebSecurityConfigurerAdapter implements
		WebSecurityConfigurer {




	public void init(final WebSecurity web) throws Exception {
		final HttpSecurity http = getHttp();
		web.addSecurityFilterChainBuilder(http)
		   .postBuildAction(new Runnable() {
    			public void run() {
				FilterSecurityInterceptor securityInterceptor = http
						.getSharedObject(FilterSecurityInterceptor.class);
				web.securityInterceptor(securityInterceptor);
			 }
			}
		   );
	}

	protected final HttpSecurity getHttp() throws Exception {
		if (http != null) {
			return http;
		}

		DefaultAuthenticationEventPublisher eventPublisher = objectPostProcessor
				.postProcess(new DefaultAuthenticationEventPublisher());
		localConfigureAuthenticationBldr.authenticationEventPublisher(eventPublisher);

		AuthenticationManager authenticationManager = authenticationManager();
		authenticationBuilder.parentAuthenticationManager(authenticationManager);
		authenticationBuilder.authenticationEventPublisher(eventPublisher);
		Map, Object> sharedObjects = createSharedObjects();

		http = new HttpSecurity(objectPostProcessor, authenticationBuilder,
				sharedObjects);
		if (!disableDefaults) {
			// @formatter:off
			http
				.csrf().and()
				.addFilter(new WebAsyncManagerIntegrationFilter())
				.exceptionHandling().and()
				.headers().and()
				.sessionManagement().and()
				.securityContext().and()
				.requestCache().and()
				.anonymous().and()
				.servletApi().and()
				.apply(new DefaultLoginPageConfigurer<>()).and()
				.logout();
			// @formatter:on
			ClassLoader classLoader = this.context.getClassLoader();
			List defaultHttpConfigurers =
					SpringFactoriesLoader.loadFactories(AbstractHttpConfigurer.class, classLoader);

			for (AbstractHttpConfigurer configurer : defaultHttpConfigurers) {
				http.apply(configurer);
			}
		}
      
		configure(http);
		return http;
	}
	//用于子类覆盖，添加不同的SecurityConfigurer
	protected void configure(HttpSecurity http) throws Exception {
		http
			.authorizeRequests()
				.anyRequest().authenticated()
				.and()
			.formLogin().and()
			.httpBasic();
	}





}