伊布拉西莫
伊布拉西莫

spring-security-源码解析+自定义拓展

1.参考文档

https://docs.spring.io/spring-security/reference/5.7/servlet/architecture.html

1.1.各种filterchain

1.1.1.SecurityFilterChain

spring-security-源码解析+自定义拓展_第1张图片

1.1.2.springSecurityFilterChain

spring-security-源码解析+自定义拓展_第2张图片

1.1.3.Security Filters

spring-security-源码解析+自定义拓展_第3张图片

2.几个重要的注解

2.1.@EnableXXX

  1. @EnableWebMvcSecurity–@deprecated
  2. @EnableWebSecurity
    • import: WebSecurityConfiguration
    • import: HttpSecurityConfiguration
    • import: SpringWebMvcImportSelector ===> WebMvcSecurityConfiguration(略)
    • import: OAuth2ImportSelector(略)
    • @EnableGlobalAuthentication(4)
  3. @EnableGlobalMethodSecurity
    • @EnableGlobalAuthentication(4)
    • import: GlobalMethodSecuritySelector ===> GlobalMethodSecurityConfiguration
  4. @EnableGlobalAuthentication
    • import: AuthenticationConfiguration

2.2.AuthenticationConfiguration

@Configuration(proxyBeanMethods = false)
@Import(ObjectPostProcessorConfiguration.class)
public class AuthenticationConfiguration {
	private AuthenticationManager authenticationManager;
	@Autowired(required = false)
	private List<GlobalAuthenticationConfigurerAdapter> globalAuthConfigurers = Collections.emptyList();
	
	@Autowired
	private ObjectPostProcessor<Object> objectPostProcessor;
	
	//1.
	@Bean
	public AuthenticationManagerBuilder authenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
			ApplicationContext context) {
		LazyPasswordEncoder defaultPasswordEncoder = new LazyPasswordEncoder(context);
		AuthenticationEventPublisher authenticationEventPublisher = getAuthenticationEventPublisher(context);
		//1.1
		DefaultPasswordEncoderAuthenticationManagerBuilder result = new DefaultPasswordEncoderAuthenticationManagerBuilder(
				objectPostProcessor, defaultPasswordEncoder);
		if (authenticationEventPublisher != null) {
			result.authenticationEventPublisher(authenticationEventPublisher);
		}
		return result;
	}
	
	public AuthenticationManager getAuthenticationManager() throws Exception {
		//2
		AuthenticationManagerBuilder authBuilder = this.applicationContext.getBean(AuthenticationManagerBuilder.class); //from 1
		
		//2.1 apply globalAuthConfigurers
		for (GlobalAuthenticationConfigurerAdapter config : this.globalAuthConfigurers) {
			authBuilder.apply(config);
		}
		this.authenticationManager = authBuilder.build();
		
		this.authenticationManagerInitialized = true;
		return this.authenticationManager;
	}
	
	/**
	@Bean EnableGlobalAuthenticationAutowiredConfigurer extends GlobalAuthenticationConfigurerAdapter
	@Bean InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationConfigurerAdapter
	@Bean InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthenticationConfigurerAdapter
	**/
}

2.2.1 ObjectPostProcessorConfiguration

public class ObjectPostProcessorConfiguration {

	@Bean
	public ObjectPostProcessor objectPostProcessor(AutowireCapableBeanFactory beanFactory) {
		return new AutowireBeanFactoryObjectPostProcessor(beanFactory);
	}
}
 
  
3.webSecurity 流程分析
 
  
3.1.@EnableWebSecurity
 
  
3.1.1.HttpSecurityConfiguration
 
  
@Configuration(proxyBeanMethods = false)
class HttpSecurityConfiguration {
	@Autowired
	private ObjectPostProcessor<Object> objectPostProcessor;
	
	@Autowired
	private AuthenticationManager authenticationManager;
	
	@Autowired
	private AuthenticationConfiguration authenticationConfiguration;
	
	@Bean(HTTPSECURITY_BEAN_NAME)
	@Scope("prototype") //允许注入多个
	HttpSecurity httpSecurity() throws Exception {
		WebSecurityConfigurerAdapter.LazyPasswordEncoder passwordEncoder = new WebSecurityConfigurerAdapter.LazyPasswordEncoder(
				this.context);
		AuthenticationManagerBuilder authenticationBuilder = new WebSecurityConfigurerAdapter.DefaultPasswordEncoderAuthenticationManagerBuilder(
				this.objectPostProcessor, passwordEncoder);
		authenticationBuilder.parentAuthenticationManager(authenticationManager());
		authenticationBuilder.authenticationEventPublisher(getAuthenticationEventPublisher());
		HttpSecurity http = new HttpSecurity(this.objectPostProcessor, authenticationBuilder, createSharedObjects());
		// @formatter:off
		http
			.csrf(withDefaults())
			.addFilter(new WebAsyncManagerIntegrationFilter())
			.exceptionHandling(withDefaults())
			.headers(withDefaults())
			.sessionManagement(withDefaults())
			.securityContext(withDefaults())
			.requestCache(withDefaults())
			.anonymous(withDefaults())
			.servletApi(withDefaults())
			.apply(new DefaultLoginPageConfigurer<>());
		http.logout(withDefaults());
		// @formatter:on
		applyDefaultConfigurers(http); //1
		return http;
	}
	
	private void applyDefaultConfigurers(HttpSecurity http) throws Exception {
		ClassLoader classLoader = this.context.getClassLoader();
		List<AbstractHttpConfigurer> defaultHttpConfigurers = SpringFactoriesLoader
				.loadFactories(AbstractHttpConfigurer.class, classLoader);
		for (AbstractHttpConfigurer configurer : defaultHttpConfigurers) {
			http.apply(configurer);
		}
	}
}

 
  
3.1.2.WebSecurityConfiguration
 
  
public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
	private WebSecurity webSecurity;
	
	private List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers;
	
	//securityFilterChains， 可有多个httpSecurity.buid()多个;
	@Autowired(required = false)
	private List<SecurityFilterChain> securityFilterChains = Collections.emptyList();
	
	@Autowired(required = false) 	
	private List<WebSecurityCustomizer> webSecurityCustomizers = Collections.emptyList();
	
	@Autowired(required = false)
	private ObjectPostProcessor<Object> objectObjectPostProcessor;
	
	@Autowired(required = false)
	public void setFilterChainProxySecurityConfigurer(ObjectPostProcessor<Object> objectPostProcessor,
			ConfigurableListableBeanFactory beanFactory) throws Exception {
		//0.初始化 webSecurity
		this.webSecurity = objectPostProcessor.postProcess(new WebSecurity(objectPostProcessor));
		
		//AutowiredWebSecurityConfigurersIgnoreParents内部逻辑：this.beanFactory.getBeansOfType(WebSecurityConfigurer.class);
		List<SecurityConfigurer<Filter, WebSecurity>> webSecurityConfigurers = new AutowiredWebSecurityConfigurersIgnoreParents(
				beanFactory).getWebSecurityConfigurers();
		//webSecurityConfigurers 排序略.....
		
		//1.应用 webSecurityConfigurer;
		for (SecurityConfigurer<Filter, WebSecurity> webSecurityConfigurer : webSecurityConfigurers) {
			this.webSecurity.apply(webSecurityConfigurer);
		}
		this.webSecurityConfigurers = webSecurityConfigurers;
	}
	
	//2. 注入 springSecurityFilterChain
	@Bean(name = "springSecurityFilterChain"）
	public Filter springSecurityFilterChain() throws Exception {
		//2.1
		WebSecurityConfigurerAdapter adapter = this.objectObjectPostProcessor
					.postProcess(new WebSecurityConfigurerAdapter() {
					});
		this.webSecurity.apply(adapter);
			
		for (SecurityFilterChain securityFilterChain : this.securityFilterChains) {
			//2.2 "springSecurityFilterChain" 添加多个securityFilterChain
			this.webSecurity.addSecurityFilterChainBuilder(() -> securityFilterChain);
			
			//2.3 添加FilterSecurityInterceptor
			for (Filter filter : securityFilterChain.getFilters()) {
				if (filter instanceof FilterSecurityInterceptor) {
					this.webSecurity.securityInterceptor((FilterSecurityInterceptor) filter);
					break;
				}
			}
		}
		
		//2.4 应用webSecurityCustomizers
		for (WebSecurityCustomizer customizer : this.webSecurityCustomizers) {
			customizer.customize(this.webSecurity);
		}
		return this.webSecurity.build();
	}
	
	//3. 注入privilegeEvaluator: 由webSecurity初始化生成
	@Bean
	public WebInvocationPrivilegeEvaluator privilegeEvaluator() {
		return this.webSecurity.getPrivilegeEvaluator();
	}
	
	//4. 注入webSecurityExpressionHandler: 由webSecurity初始化生成
	@Bean
	public SecurityExpressionHandler<FilterInvocation> webSecurityExpressionHandler() {
		return this.webSecurity.getExpressionHandler();
	}

}

 
  
3.2.总体处理流程(粗)
 
  
request -> springSecurityFilterChain -> securityFilterChain[s]
 
  
3.3.httpSecurity.build() 流程
 
  
build
 
  
@Bean // 可选,可配置多个
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = http
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .csrf().disable()
	       		.addFilterBefore(xxxAuthenticationFilter(), AbstractPreAuthenticatedProcessingFilter.class)
                .authorizeRequests()
                .expressionHandler(xxxWebExpressionHandler());
        registry
                .antMatchers("/healthcheck/**").permitAll()
                .antMatchers("/**")
                .access("isLoggedIn()");
        return http.build();
}

 
  
3.3.1.httpSecurity类图
 
  
spring-security-源码解析+自定义拓展_第4张图片
 
  
3.3.2.httpSecurity.build() 源码
 
  
//总体流程
httpSecurity.buid()
	AbstractSecurityBuilder.build()
		AbstractConfiguredSecurityBuilder.doBuild()
			init(); // getConfigurers() --> Collection>
			configure(); // for-each SecurityConfigurer.configure() --> 初始化Filter
			beforeConfigure(); //由HttpSecurity重写： 初始化 authenticationManager
			performBuild()
				httpSecurity.performBuild()

public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain, HttpSecurity>
		implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity> {

	private final RequestMatcherConfigurer requestMatcherConfigurer;

	//a.注入HttpSecurityConfiguration.httpSecurity()设置： 
	private List<OrderedFilter> filters = new ArrayList<>();
	private AuthenticationManager authenticationManager; //set

	protected DefaultSecurityFilterChain performBuild() {
		//a.注入HttpSecurityConfiguration.httpSecurity()设置： 

		//b.用户 注册filterChain时 设置 ; 鉴权时会用到
		ExpressionUrlAuthorizationConfigurer<?> expressionConfigurer = getConfigurer(ExpressionUrlAuthorizationConfigurer.class);
		AuthorizeHttpRequestsConfigurer<?> httpConfigurer = getConfigurer(AuthorizeHttpRequestsConfigurer.class); 
		boolean oneConfigurerPresent = expressionConfigurer == null ^ httpConfigurer == null;
		
		//sort 略....
		List<Filter> sortedFilters = new ArrayList<>(this.filters.size());
		
		return new DefaultSecurityFilterChain(this.requestMatcher, sortedFilters);
	}


}	

 
  
 
  
3.3.webSecurity.build() 流程
 
  
注入demo
 
  
   @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring()
                .antMatchers("/css/**")
                .antMatchers("/html/**")
                .antMatchers("/img/**")
                .antMatchers("/js/**")
                .antMatchers("/libs/**")
                .antMatchers("/version.txt");
    }

 
  
3.3.1.WebSecurity类图(略)
 
  
见HttpSecurity类图
 
  
3.3.2.webSecurity.build() 源码
 
  
//调用总体路径
WebSecurity.build()
		AbstractSecurityBuilder.build()
			AbstractConfiguredSecurityBuilder.doBuild()
				init(); // getConfigurers() --> Collection>
				configure(); // for-each SecurityConfigurer.configure() --> 初始化Filter	
				performBuild();
					WebSecurity.performBuild() //1

public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter, WebSecurity>
		implements SecurityBuilder<Filter>, ApplicationContextAware, ServletContextAware {
	//由用户注入： web.ignoring().antMatchers("/***")
	private final List<RequestMatcher> ignoredRequests = new ArrayList<>();
	private IgnoredRequestConfigurer ignoredRequestRegistry; //new IgnoredRequestConfigurer(ctx)
	

	private final List<SecurityBuilder<? extends SecurityFilterChain>> securityFilterChainBuilders = new ArrayList<>();//由WebSecurityConfiguration初始化
	private FilterSecurityInterceptor filterSecurityInterceptor;//由WebSecurityConfiguration初始化
	
	@Autowired
	private HttpFirewall httpFirewall;
	
	@Autowired
	private RequestRejectedHandler requestRejectedHandler;
	private WebInvocationPrivilegeEvaluator privilegeEvaluator; //初始化完成后，被WebSecurityConfiguration @Bean 注入;
	
	private DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
	private SecurityExpressionHandler<FilterInvocation> expressionHandler = this.defaultWebSecurityExpressionHandler;//初始化完成后，被WebSecurityConfiguration @Bean 注入;
	private Runnable postBuildAction = () -> {};
	
	@Override
	protected Filter performBuild() throws Exception {
	
		int chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();
		List<SecurityFilterChain> securityFilterChains = new ArrayList<>(chainSize); //
		List<RequestMatcherEntry<List<WebInvocationPrivilegeEvaluator>>> requestMatcherPrivilegeEvaluatorsEntries = new ArrayList<>();
		for (RequestMatcher ignoredRequest : this.ignoredRequests) {
			SecurityFilterChain securityFilterChain = new DefaultSecurityFilterChain(ignoredRequest);
			securityFilterChains.add(securityFilterChain);//将ignoredRequest 添加在第1位
			requestMatcherPrivilegeEvaluatorsEntries
					.add(getRequestMatcherPrivilegeEvaluatorsEntry(securityFilterChain)); //2
		}
		//for循环build securityFilterChains
		for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : this.securityFilterChainBuilders) {
			SecurityFilterChain securityFilterChain = securityFilterChainBuilder.build();
			securityFilterChains.add(securityFilterChain);
			requestMatcherPrivilegeEvaluatorsEntries
					.add(getRequestMatcherPrivilegeEvaluatorsEntry(securityFilterChain)); 
		}
		
		//3.
		if (this.privilegeEvaluator == null) {
			this.privilegeEvaluator = new RequestMatcherDelegatingWebInvocationPrivilegeEvaluator(
					requestMatcherPrivilegeEvaluatorsEntries);
		}
		FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
		filterChainProxy.setFirewall(this.httpFirewall);
		filterChainProxy.setRequestRejectedHandler(this.requestRejectedHandler);
		filterChainProxy.afterPropertiesSet();

		Filter result = filterChainProxy;
	
		this.postBuildAction.run();
		return result;
	}
	
	//2
	private RequestMatcherEntry<List<WebInvocationPrivilegeEvaluator>> getRequestMatcherPrivilegeEvaluatorsEntry(
			SecurityFilterChain securityFilterChain) {
		List<WebInvocationPrivilegeEvaluator> privilegeEvaluators = new ArrayList<>();
		for (Filter filter : securityFilterChain.getFilters()) {
			if (filter instanceof FilterSecurityInterceptor) {
				DefaultWebInvocationPrivilegeEvaluator defaultWebInvocationPrivilegeEvaluator = new DefaultWebInvocationPrivilegeEvaluator(
						(FilterSecurityInterceptor) filter);
				privilegeEvaluators.add(defaultWebInvocationPrivilegeEvaluator);
				continue;
			}
			if (filter instanceof AuthorizationFilter) {
				AuthorizationManager<HttpServletRequest> authorizationManager = ((AuthorizationFilter) filter)
						.getAuthorizationManager();
				AuthorizationManagerWebInvocationPrivilegeEvaluator evaluator = new AuthorizationManagerWebInvocationPrivilegeEvaluator(
						authorizationManager);
				privilegeEvaluators.add(evaluator);
			}
		}
		return new RequestMatcherEntry<>(securityFilterChain::matches, privilegeEvaluators);//2 match --> privilegeEvaluators
	}
}


 
  
3.3.2.1 关键接口: WebInvocationPrivilegeEvaluator
 
  
public interface WebInvocationPrivilegeEvaluator {
    boolean isAllowed(String uri, Authentication authentication);

    boolean isAllowed(String contextPath, String uri, String method, Authentication authentication);
}

 
  
类图
 spring-security-源码解析+自定义拓展_第5张图片
 
  
3.3.2.2 关键类：RequestMatcherDelegatingWebInvocationPrivilegeEvaluator
 
  
public final class RequestMatcherDelegatingWebInvocationPrivilegeEvaluator
		implements WebInvocationPrivilegeEvaluator, ServletContextAware {

	//构造函数 set
	private final List<RequestMatcherEntry<List<WebInvocationPrivilegeEvaluator>>> delegates;

	
	@Override
	public boolean isAllowed(String uri, Authentication authentication) {
		List<WebInvocationPrivilegeEvaluator> privilegeEvaluators = getDelegate(null, uri, null);
		//for-each privilegeEvaluators .isAllowed(uri, authentication) 略...
		return true;
	}


	@Override
	public boolean isAllowed(String contextPath, String uri, String method, Authentication authentication) {
		List<WebInvocationPrivilegeEvaluator> privilegeEvaluators = getDelegate(contextPath, uri, method);
		//for-each privilegeEvaluators .isAllowed(contextPath, uri, method, authentication); 略...
		return true;
	}

	private List<WebInvocationPrivilegeEvaluator> getDelegate(String contextPath, String uri, String method) {
		//filter 匹配的 WebInvocationPrivilegeEvaluator
		FilterInvocation filterInvocation = new FilterInvocation(contextPath, uri, method, this.servletContext);
		for (RequestMatcherEntry<List<WebInvocationPrivilegeEvaluator>> delegate : this.delegates) {
			if (delegate.getRequestMatcher().matches(filterInvocation.getHttpRequest())) {
				return delegate.getEntry();
			}
		}
		return Collections.emptyList();
	}
}

 
  
3.4总体处理流程(细)
 
  
3.4.1.FilterChainProxy.doFilter()
 
  
public class FilterChainProxy extends GenericFilterBean {
	private List<SecurityFilterChain> filterChains;
    private HttpFirewall firewall;
    private RequestRejectedHandler requestRejectedHandler;
	
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
       try {
            request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
            this.doFilterInternal(request, response, chain); //1
       } catch (Exception var11) {
       		//略....
       		this.requestRejectedHandler.handle((HttpServletRequest)request, (HttpServletResponse)response, (RequestRejectedException)requestRejectedException);
        } finally {
            SecurityContextHolder.clearContext();
            request.removeAttribute(FILTER_APPLIED);
        }
    }
	
	private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest)request); //1
        HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse)response);//2
        List<Filter> filters = this.getFilters((HttpServletRequest)firewallRequest);
    
		//遍历filterchain dofilter....
      	VirtualFilterChain virtualFilterChain = new 	VirtualFilterChain(firewallRequest, chain, filters);
        virtualFilterChain.doFilter(firewallRequest, firewallResponse);
    }
}

 
  
3.4.1.1关键接口: HttpFirewall
 
  
 
   
https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html
 spring-security-源码解析+自定义拓展_第6张图片
 使用样例
 
  
 
  
@Bean
public StrictHttpFirewall httpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowedHttpMethods(Arrays.asList("GET", "POST"));
    return firewall;
}

 
  
3.4.2.Filter.doFilter()
 
  
3.4.2.1 UsernamePasswordAuthenticationFilter
 
  
spring-security-源码解析+自定义拓展_第7张图片
 
  
UsernamePasswordAuthenticationFilter.doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
	AbstractAuthenticationProcessingFilter.doFilter(request,response,chain)
		doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			UsernamePasswordAuthenticationFilter.attemptAuthentication()


///
public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean
		implements ApplicationEventPublisherAware, MessageSourceAware {

	private AuthenticationManager authenticationManager;	

	//1.
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);//2.
	}

	//2.
	private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		if (!requiresAuthentication(request, response)) { //3.
			chain.doFilter(request, response);
			return;
		}
		Authentication authenticationResult = attemptAuthentication(request, response);//4 由子类实现
		if (authenticationResult == null) {
			return;
		}
		this.sessionStrategy.onAuthentication(authenticationResult, request, response);
		
		if (this.continueChainBeforeSuccessfulAuthentication) { //default false;
			chain.doFilter(request, response);
		}
		successfulAuthentication(request, response, chain, authenticationResult); //5
	}

	
	//3.
	protected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {
		if (this.requiresAuthenticationRequestMatcher.matches(request)) {
			return true;
		}
		return false;
	}


	//4
	protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
			Authentication authResult) throws IOException, ServletException {
		SecurityContext context = SecurityContextHolder.createEmptyContext();
		context.setAuthentication(authResult);
		SecurityContextHolder.setContext(context);
		this.securityContextRepository.saveContext(context, request, response);
		
		this.successHandler.onAuthenticationSuccess(request, response, authResult);
	}
}

/
//4.
public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
    public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
    private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER = new AntPathRequestMatcher("/login", "POST");
    private String usernameParameter = "username";
    private String passwordParameter = "password";
    private boolean postOnly = true;

    public UsernamePasswordAuthenticationFilter() {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER);
    }

    public UsernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
        super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
    }

    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        if (this.postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        } else {
            String username = this.obtainUsername(request);
            String password = this.obtainPassword(request);
            
            //request类型为：UsernamePasswordAuthenticationToken,且为unauthenticated
            UsernamePasswordAuthenticationToken authRequest = UsernamePasswordAuthenticationToken.unauthenticated(username, password);
            this.setDetails(request, authRequest);
            //交由AuthenticationManager来进行认证： 
            return this.getAuthenticationManager().authenticate(authRequest);
        }
    }

}

 
  
4.AuthenticationManager authentication(认证)
 
  
4.1 AuthenticationManager初始化
 
  
AuthenticationManager是在AuthenticationConfiguration中由@beanAuthenticationManagerBuilder.build()初始化。
 AuthenticationManagerBuilder的具体类型为：DefaultPasswordEncoderAuthenticationManagerBuilder
 同时AuthenticationManagerBuilder.apply了
 
  
     
   
  • EnableGlobalAuthenticationAutowiredConfigurer
    •  
   
  • InitializeUserDetailsBeanManagerConfigurer : 注入UserDetailsService
    •  
   
  • InitializeAuthenticationProviderBeanManagerConfigurer
    •  
  
 
  
4.1.1 关键配置
 
  
4.1.1.1 InitializeUserDetailsBeanManagerConfigurer
 
  
class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {

	@Override
	public void init(AuthenticationManagerBuilder auth) throws Exception {
		auth.apply(new InitializeUserDetailsManagerConfigurer());
	}

	class InitializeUserDetailsManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {

		@Override
		public void configure(AuthenticationManagerBuilder auth) throws Exception {
			if (auth.isConfigured()) {
				return;
			}
			UserDetailsService userDetailsService = getBeanOrNull(UserDetailsService.class);
			if (userDetailsService == null) {
				return;
			}
			PasswordEncoder passwordEncoder = getBeanOrNull(PasswordEncoder.class);
			UserDetailsPasswordService passwordManager = getBeanOrNull(UserDetailsPasswordService.class);
			DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
			provider.setUserDetailsService(userDetailsService); //注入UserDetailsService
			if (passwordEncoder != null) {
				provider.setPasswordEncoder(passwordEncoder);
			}
			if (passwordManager != null) {
				provider.setUserDetailsPasswordService(passwordManager);
			}
			provider.afterPropertiesSet();
			auth.authenticationProvider(provider); //添加DaoAuthenticationProvider
		}
	}
}

 
  
4.1.1.2 InitializeUserDetailsBeanManagerConfigurer
 
  
@Order(InitializeAuthenticationProviderBeanManagerConfigurer.DEFAULT_ORDER)
class InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {

	@Override
	public void init(AuthenticationManagerBuilder auth) throws Exception {
		auth.apply(new InitializeAuthenticationProviderManagerConfigurer());
	}

	class InitializeAuthenticationProviderManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {

		@Override
		public void configure(AuthenticationManagerBuilder auth) {
			if (auth.isConfigured()) {
				return;
			}
			AuthenticationProvider authenticationProvider = getBeanOrNull(AuthenticationProvider.class); //注入其他AuthenticationProvider
			if (authenticationProvider == null) {
				return;
			}
			auth.authenticationProvider(authenticationProvider);
		}
	}

}

 
  
4.1.2.DefaultPasswordEncoderAuthenticationManagerBuilder.build()
 
  
4.1.2.1. 类图
 
  
spring-security-源码解析+自定义拓展_第8张图片
 
  
4.1.2.2.DefaultPasswordEncoderAuthenticationManagerBuilder.build()
 
  
//1.执行流程
DefaultPasswordEncoderAuthenticationManagerBuilder.build()
	AbstractSecurityBuilder.build()
		AbstractConfiguredSecurityBuilder.doBuild()
			//beforeInit(); init(); beforeConfigure(); configure(); 略
			performBuild();
				AuthenticationManagerBuilder.performBuild()
//
public class AuthenticationManagerBuilder
		extends AbstractConfiguredSecurityBuilder<AuthenticationManager, AuthenticationManagerBuilder>
		implements ProviderManagerBuilder<AuthenticationManagerBuilder> {
			private AuthenticationManager parentAuthenticationManager;
			private List<AuthenticationProvider> authenticationProviders = new ArrayList<>();
			private UserDetailsService defaultUserDetailsService;

	@Override
	protected ProviderManager performBuild() throws Exception {
		
		// AuthenticationManager具体类型为 ProviderManager
		ProviderManager providerManager = new ProviderManager(this.authenticationProviders,
				this.parentAuthenticationManager);
		providerManager = postProcess(providerManager);
		return providerManager;
	}
}

 
  
4.1.2.3 ProviderManager类图
 
  
spring-security-源码解析+自定义拓展_第9张图片
 
  
4.3 ProviderManager.authenticate()
 
  
public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {

	private List<AuthenticationProvider> providers = Collections.emptyList();
	private AuthenticationManager parent;


	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		Class<? extends Authentication> toTest = authentication.getClass();
		Authentication result = null;
		Authentication parentResult = null;

		for (AuthenticationProvider provider : getProviders()) { //获取AuthenticationProvider
			if (!provider.supports(toTest)) {
				continue;
			}
	
			result = provider.authenticate(authentication);
			if (result != null) {
				copyDetails(authentication, result);
				break;
			}
		}
		if (result == null && this.parent != null) {
			// Allow the parent to try.
			parentResult = this.parent.authenticate(authentication);
			result = parentResult;
			
		}
		if (result != null) {
			if (this.eraseCredentialsAfterAuthentication && (result instanceof CredentialsContainer)) {
				// Authentication is complete. Remove credentials and other secret data
				// from authentication
				((CredentialsContainer) result).eraseCredentials();
			}

			return result;
		}
		throw lastException;
	}
}

 
  
4.3.1 AuthenticationProvider
 
  
4.3.1.1 接口定义
 
  
public interface AuthenticationProvider {
	Authentication authenticate(Authentication authentication) throws AuthenticationException;
	boolean supports(Class<?> authentication);
}

 
  
4.3.1.2 类图
 
  
spring-security-源码解析+自定义拓展_第10张图片
 
  
4.3.1.3 DaoAuthenticationProvider 示例
 
  
在前文有提到，在build AuthenticationMananger时，会注入一个DaoAuthenticationProvider
 
  
public abstract class AbstractUserDetailsAuthenticationProvider
		implements AuthenticationProvider, InitializingBean, MessageSourceAware {

	 
	private UserCache userCache = new NullUserCache(); //可通过set设置
	private UserDetailsChecker preAuthenticationChecks = new DefaultPreAuthenticationChecks(); //可通过set设置
	private UserDetailsChecker postAuthenticationChecks = new DefaultPostAuthenticationChecks();//可通过set设置


	//仅支持UsernamePasswordAuthenticationToken类型的请求
	public boolean supports(Class<?> authentication) {
		return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));
	}

	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		String username = determineUsername(authentication);
		UserDetails user = this.userCache.getUserFromCache(username); //优先从缓存获取
		if (user == null) {
			user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication); //由子类实现 1
			Assert.notNull(user, "retrieveUser returned null - a violation of the interface contract");
		}
		
		this.preAuthenticationChecks.check(user);
		additionalAuthenticationChecks(user, (UsernamePasswordAuthenticationToken) authentication); //子类实现 2
		this.postAuthenticationChecks.check(user);

		this.userCache.putUserInCache(user); //set 缓存
		
		Object principalToReturn = user //认证信息	
		return createSuccessAuthentication(principalToReturn, authentication, user); //子类实现3， 父类提供默认实现4
	}

	//4
	protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
			UserDetails user) {
		//getAuthorities: 可以理解为角色信息  或者权限码
		UsernamePasswordAuthenticationToken result = UsernamePasswordAuthenticationToken.authenticated(principal,
				authentication.getCredentials(), this.authoritiesMapper.mapAuthorities(user.getAuthorities()));
		result.setDetails(authentication.getDetails());
		this.logger.debug("Authenticated user");
		return result;
	}
}

public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

	private UserDetailsService userDetailsService;

	//1. 查询username信息
	protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
		if (loadedUser == null) {
			throw new InternalAuthenticationServiceException("UserDetailsService returned null, which is an interface contract violation");
		}
		return loadedUser;
	}

	//2. 验证密码
	protected void additionalAuthenticationChecks(UserDetails userDetails,
			UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
		if (authentication.getCredentials() == null) {
			throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
		}
		String presentedPassword = authentication.getCredentials().toString(); //登录时，输入的密码
		if (!this.passwordEncoder.matches(presentedPassword, userDetails.getPassword())) {//加密输入的密码 并于查询出来的密码做匹配验证
			throw new BadCredentialsException(this.messages.getMessage("AbstractUserDetailsAuthenticationProvider.badCredentials", "Bad credentials"));
		}
	}

	//4.
	protected Authentication createSuccessAuthentication(Object principal, Authentication authentication,
			UserDetails user) {
		//默认为false：：：： 自动更新密码？？？
		boolean upgradeEncoding = this.	 != null&& this.passwordEncoder.upgradeEncoding(user.getPassword());
		if (upgradeEncoding) {
			String presentedPassword = authentication.getCredentials().toString();
			String newPassword = this.passwordEncoder.encode(presentedPassword);
			user = this.userDetailsPasswordService.updatePassword(user, newPassword);
		}
		return super.createSuccessAuthentication(principal, authentication, user);
	}

}

 
  
4.3.2 Authentication
 
  
4.3.2.1. 接口定义
 
  
public interface Authentication extends Principal, Serializable {
	//授权码 && 角色码 .... **后续鉴权流程会使用到**
	Collection<? extends GrantedAuthority> getAuthorities();

	Object getCredentials();
	Object getDetails();
	Object getPrincipal();
	boolean isAuthenticated();
	void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

 
  
4.3.2.2. UsernamePasswordAuthenticationToken 类图
 
  
spring-security-源码解析+自定义拓展_第11张图片
 
  
 
  
 
  
5. authorization(鉴权)
 
  
 
   
https://docs.spring.io/spring-security/reference/5.7/servlet/authorization/index.html
 
  
 
  
5.1 架构
 
  
5.1.1. AuthorizationManager
 
  
5.1.1.1接口定义
 
  
public interface AuthorizationManager<T> {
	//若没有权限，直接返回"Access Denied"
	default void verify(Supplier<Authentication> authentication, T object) {
		AuthorizationDecision decision = check(authentication, object);
		if (decision != null && !decision.isGranted()) {
			throw new AccessDeniedException("Access Denied");
		}
	}
	@Nullable
	AuthorizationDecision check(Supplier<Authentication> authentication, T object);
}

 
  
5.1.1.2.类图
 
  
spring-security-源码解析+自定义拓展_第12张图片
 
  
5.1.2 AccessDecisionManager
 
  
5.1.2.1 AccessDecisionVoter
 
  
public interface AccessDecisionVoter<S> {
	int ACCESS_GRANTED = 1;
	int ACCESS_ABSTAIN = 0;
	int ACCESS_DENIED = -1;

	boolean supports(ConfigAttribute attribute);
	boolean supports(Class<?> clazz);

	//投票; 交由AccessDecisionManager统计结果，最终决定是否通过鉴权
	int vote(Authentication authentication, S object, Collection<ConfigAttribute> attributes);
}

 
  
5.1.2.1.AccessDecisionManager接口定义
 
  
public interface AccessDecisionManager {
	//决定是否通过鉴权，如果未通过则抛出异常
	void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)
			throws AccessDeniedException, InsufficientAuthenticationException;
	boolean supports(ConfigAttribute attribute);
	boolean supports(Class<?> clazz);
}

 
  
5.1.2.2 类图
 
  
spring-security-源码解析+自定义拓展_第13张图片
 
  
5.2. 鉴权
 
  
5.2.1. 通过AuthorizationFilter鉴权
 
  
5.2.1.1 流程图
 
  
spring-security-源码解析+自定义拓展_第14张图片
 
  
5.2.1.2 http启用authorize
 
  
 
   
更多方式参照：https://docs.spring.io/spring-security/reference/5.7/servlet/authorization/authorize-http-requests.html
 
  
 
  
@Bean
SecurityFilterChain web(HttpSecurity http) throws AuthenticationException {
    http ...
    .authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated();) //1
    return http.build();
}


	public HttpSecurity authorizeHttpRequests(
			Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry> authorizeHttpRequestsCustomizer)
			throws Exception {
		authorizeHttpRequestsCustomizer
				.customize(getOrApply(new AuthorizeHttpRequestsConfigurer<>(context)).getRegistry());
		return HttpSecurity.this;
	}

 
  
5.2.1.3 AuthorizeHttpRequestsConfigurer.configure()
 
  
public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractHttpConfigurer<AuthorizeHttpRequestsConfigurer<H>, H> {

	private final AuthorizationManagerRequestMatcherRegistry registry;

	public AuthorizeHttpRequestsConfigurer(ApplicationContext context) {
		this.registry = new AuthorizationManagerRequestMatcherRegistry(context);
	}

	@Override
	public void configure(H http) {
		AuthorizationManager<HttpServletRequest> authorizationManager = this.registry.createAuthorizationManager();
		AuthorizationFilter authorizationFilter = new AuthorizationFilter(authorizationManager); 
		authorizationFilter.setShouldFilterAllDispatcherTypes(this.registry.shouldFilterAllDispatcherTypes);
		http.addFilter(postProcess(authorizationFilter)); //2.注册 extends AbstractRequestMatcherRegistry {
AuthorizationFilter
	}

	public final class AuthorizationManagerRequestMatcherRegistry extends AbstractRequestMatcherRegistry<AuthorizedUrl> {
			
		private final RequestMatcherDelegatingAuthorizationManager.Builder managerBuilder = RequestMatcherDelegatingAuthorizationManager.builder();
				
	
		private AuthorizationManager<HttpServletRequest> createAuthorizationManager() {
			return postProcess(this.managerBuilder.build());
		}
	}

}

 
  
5.2.2. 通过FilterSecurityInterceptor鉴权
 
  
 
   
https://docs.spring.io/spring-security/reference/5.7/servlet/authorization/authorize-requests.html
 
  
 
  
5.2.2.1 流程图
 
  
spring-security-源码解析+自定义拓展_第15张图片
 
  
5.2.2.2常见注解
 
  
 
   
https://docs.spring.io/spring-security/reference/5.7/servlet/authorization/expression-based.html#el-common-built-in
 
  
 
  
     
   
  • hasRole(String role)
    •  
   
  • hasAnyRole(String…​ roles)
    •  
   
  • hasAuthority(String authority)
    •  
   
  • hasAnyAuthority(String…​ authorities)
    •  
   
  • isAuthenticated()
    •  
   
  • permitAll
    •  
   
  • denyAll
    •  
   
  • hasPermission(Object target, Object permission)
    •  
   
  • hasPermission(Object targetId, String targetType, Object permission)
    •  
  
 
  
5.2.2.3 配置
 
  
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
	http
		// ...
		.authorizeRequests(authorize -> authorize                                  
			.mvcMatchers("/resources/**", "/signup", "/about").permitAll()         
			.mvcMatchers("/admin/**").hasRole("ADMIN")                             
			.mvcMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")    //1.http.register类型为：ExpressionInterceptUrlRegistry
			.anyRequest().denyAll()                                                
		);
	return http.build();
}

 
  
ExpressionInterceptUrlRegistry.mvcMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')") 
 
  
5.2.2.4 配置拆解1-ExpressionInterceptUrlRegistry.mvcMatchers()
 
  
//see  HttpSecurity.authorizeRequests()
public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractInterceptUrlConfigurer<ExpressionUrlAuthorizationConfigurer<H>, H> {
	//1.
	public final class ExpressionInterceptUrlRegistry extends
			ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<ExpressionInterceptUrlRegistry, AuthorizedUrl> {

		public MvcMatchersAuthorizedUrl mvcMatchers(String... patterns) {
			return mvcMatchers(null, patterns);
		}

		public MvcMatchersAuthorizedUrl mvcMatchers(HttpMethod method, String... mvcPatterns) {
			return new MvcMatchersAuthorizedUrl(createMvcMatchers(method, mvcPatterns));//2
		}
	}

	//2
	public final class MvcMatchersAuthorizedUrl extends AuthorizedUrl {
		private MvcMatchersAuthorizedUrl(List<MvcRequestMatcher> requestMatchers) {
			super(requestMatchers);//3
		}
	}

	//3	
	public class AuthorizedUrl {
		private List<? extends RequestMatcher> requestMatchers;


		AuthorizedUrl(List<? extends RequestMatcher> requestMatchers) {
			this.requestMatchers = requestMatchers;
		}
	}

}

 
  
返回对象为： MvcMatchersAuthorizedUrl
 
  
5.2.2.5 配置拆解2-MvcMatchersAuthorizedUrl.access()
 
  
//see  HttpSecurity.authorizeRequests()
public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractInterceptUrlConfigurer<ExpressionUrlAuthorizationConfigurer<H>, H> {

	static final String permitAll = "permitAll";
	private static final String denyAll = "denyAll";
	private static final String anonymous = "anonymous";
	private static final String authenticated = "authenticated";
	private static final String fullyAuthenticated = "fullyAuthenticated";
	private static final String rememberMe = "rememberMe";
	private final String rolePrefix;
	private final ExpressionInterceptUrlRegistry REGISTRY;
	private SecurityExpressionHandler<FilterInvocation> expressionHandler;

	public ExpressionUrlAuthorizationConfigurer(ApplicationContext context) {
		//set rolePrefix略,默认为为"ROLE_";
		this.REGISTRY = new ExpressionInterceptUrlRegistry(context);
	}


	//2
	private void interceptUrl(Iterable<? extends RequestMatcher> requestMatchers,
			Collection<ConfigAttribute> configAttributes) {
		for (RequestMatcher requestMatcher : requestMatchers) {
			this.REGISTRY.addMapping(new AbstractConfigAttributeRequestMatcherRegistry.UrlMapping(requestMatcher, configAttributes));
		}
	}



	public class AuthorizedUrl {

		private List<? extends RequestMatcher> requestMatchers;

		private boolean not;

		public ExpressionInterceptUrlRegistry hasRole(String role) {
			return access(ExpressionUrlAuthorizationConfigurer
					.hasRole(ExpressionUrlAuthorizationConfigurer.this.rolePrefix, role));
		}

	
		public ExpressionInterceptUrlRegistry hasAnyRole(String... roles) {
			return access(ExpressionUrlAuthorizationConfigurer
					.hasAnyRole(ExpressionUrlAuthorizationConfigurer.this.rolePrefix, roles));
		}

		public ExpressionInterceptUrlRegistry hasAuthority(String authority) {
			return access(ExpressionUrlAuthorizationConfigurer.hasAuthority(authority));
		}

		public ExpressionInterceptUrlRegistry permitAll() {
			return access(permitAll);
		}

		
		public ExpressionInterceptUrlRegistry authenticated() {
			return access(authenticated);//1
		}


		public ExpressionInterceptUrlRegistry access(String attribute) {
			if (this.not) {
				attribute = "!" + attribute;
			}
			//string -> SecurityConfig(ConfigAttribute)
			interceptUrl(this.requestMatchers, SecurityConfig.createList(attribute)); 
			return ExpressionUrlAuthorizationConfigurer.this.REGISTRY;
		}

	}

}

 
  
5.2.2.6 ExpressionUrlAuthorizationConfigurer类图
 
  
spring-security-源码解析+自定义拓展_第16张图片
 
  
5.2.2.7 ExpressionUrlAuthorizationConfigurer.configure()
 
  
public abstract class AbstractInterceptUrlConfigurer<C extends AbstractInterceptUrlConfigurer<C, H>, H extends HttpSecurityBuilder<H>>
		extends AbstractHttpConfigurer<C, H> {

	private AccessDecisionManager accessDecisionManager;


	@Override
	public void configure(H http) throws Exception {
		FilterInvocationSecurityMetadataSource metadataSource = createMetadataSource(http); //1. 子类实现
	
		FilterSecurityInterceptor securityInterceptor = createFilterSecurityInterceptor(http, metadataSource,http.getSharedObject(AuthenticationManager.class)); //2
		securityInterceptor = postProcess(securityInterceptor);
		http.addFilter(securityInterceptor);
		http.setSharedObject(FilterSecurityInterceptor.class, securityInterceptor);
	}


	//2
	private FilterSecurityInterceptor createFilterSecurityInterceptor(H http,
			FilterInvocationSecurityMetadataSource metadataSource, AuthenticationManager authenticationManager)
			throws Exception {
		FilterSecurityInterceptor securityInterceptor = new FilterSecurityInterceptor();
		securityInterceptor.setSecurityMetadataSource(metadataSource);

		//默认为：this.createDefaultAccessDecisionManager()//3
		securityInterceptor.setAccessDecisionManager(getAccessDecisionManager(http));
		securityInterceptor.setAuthenticationManager(authenticationManager);
		securityInterceptor.afterPropertiesSet();
		return securityInterceptor;
	}


	//3
	private AccessDecisionManager createDefaultAccessDecisionManager(H http) {
		AffirmativeBased result = new AffirmativeBased(getDecisionVoters(http));//4. 由子类实现
		return postProcess(result);
	}
}

/子类
public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
		extends AbstractInterceptUrlConfigurer<ExpressionUrlAuthorizationConfigurer<H>, H> {

	private final ExpressionInterceptUrlRegistry REGISTRY;
	private SecurityExpressionHandler<FilterInvocation> expressionHandler;

	public ExpressionUrlAuthorizationConfigurer(ApplicationContext context) {
		this.REGISTRY = new ExpressionInterceptUrlRegistry(context);
	}

	private void interceptUrl(Iterable<? extends RequestMatcher> requestMatchers,
			Collection<ConfigAttribute> configAttributes) {
		for (RequestMatcher requestMatcher : requestMatchers) {
			this.REGISTRY.addMapping(new AbstractConfigAttributeRequestMatcherRegistry.UrlMapping(requestMatcher, configAttributes));
		}
	}

	
	//4
	@Override
	List<AccessDecisionVoter<?>> getDecisionVoters(H http) {
		List<AccessDecisionVoter<?>> decisionVoters = new ArrayList<>();
		WebExpressionVoter expressionVoter = new WebExpressionVoter();
		expressionVoter.setExpressionHandler(getExpressionHandler(http));//5.类型为DefaultWebSecurityExpressionHandler
		decisionVoters.add(expressionVoter);//类型为WebExpressionVoter
		return decisionVoters;
	}
	
	//1.
	@Override
	ExpressionBasedFilterInvocationSecurityMetadataSource createMetadataSource(H http) {
		LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = this.REGISTRY.createRequestMap();
		return new ExpressionBasedFilterInvocationSecurityMetadataSource(requestMap, getExpressionHandler(http));
	}

	//5
	private SecurityExpressionHandler<FilterInvocation> getExpressionHandler(H http) {
		
		DefaultWebSecurityExpressionHandler defaultHandler = new DefaultWebSecurityExpressionHandler();
		AuthenticationTrustResolver trustResolver = http.getSharedObject(AuthenticationTrustResolver.class);
		defaultHandler.setTrustResolver(trustResolver);
		ApplicationContext context = http.getSharedObject(ApplicationContext.class);
		String[] roleHiearchyBeanNames = context.getBeanNamesForType(RoleHierarchy.class);
		
		//设置RoleHierarchy 以及rolePrefix...
		defaultHandler.setRoleHierarchy(context.getBean(roleHiearchyBeanNames[0], RoleHierarchy.class));		
defaultHandler.setDefaultRolePrefix(grantedAuthorityDefaults.getRolePrefix());
			
		//在GlobalMethodSecurityConfiguration中定义，略......
		String[] permissionEvaluatorBeanNames = context.getBeanNamesForType(PermissionEvaluator.class);
		PermissionEvaluator permissionEvaluator = context.getBean(permissionEvaluatorBeanNames[0],PermissionEvaluator.class);
		defaultHandler.setPermissionEvaluator(permissionEvaluator);

		this.expressionHandler = postProcess(defaultHandler);
		return this.expressionHandler;
	}

}		

 
  
5.2.2.8 重要接口: SecurityExpressionHandler
 
  
spring-security-源码解析+自定义拓展_第17张图片
 
  
5.2.2.9 重要接口: PermissionEvaluator
 
  
public interface PermissionEvaluator extends AopInfrastructureBean {

	boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission);

	boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission);

}

 
  
5.2.2.10 AffirmativeBased.decide()
 
  
public class AffirmativeBased extends AbstractAccessDecisionManager {

	public AffirmativeBased(List<AccessDecisionVoter<?>> decisionVoters) {
		super(decisionVoters);
	}

	@Override
	@SuppressWarnings({ "rawtypes", "unchecked" })
	public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)
			throws AccessDeniedException {
		int deny = 0;
		for (AccessDecisionVoter voter : getDecisionVoters()) { //for-each 进行投票
			int result = voter.vote(authentication, object, configAttributes);
			switch (result) {
			case AccessDecisionVoter.ACCESS_GRANTED:
				return;
			case AccessDecisionVoter.ACCESS_DENIED:
				deny++;
				break;
			default:
				break;
			}
		}
		if (deny > 0) {
			throw new AccessDeniedException(this.messages.getMessage("AbstractAccessDecisionManager.accessDenied", "Access is denied"));
					
		}
		//到这里，所有人全部期权;
		checkAllowIfAllAbstainDecisions();
	}

}

 
  
5.2.2.11 WebExpressionVoter.vote()
 
  
public class WebExpressionVoter implements AccessDecisionVoter<FilterInvocation> {
		private SecurityExpressionHandler<FilterInvocation> expressionHandler = new DefaultWebSecurityExpressionHandler();

	public int vote(Authentication authentication, FilterInvocation filterInvocation,
			Collection<ConfigAttribute> attributes) {
		//attribute instanceof WebExpressionConfigAttribute
		WebExpressionConfigAttribute webExpressionConfigAttribute = findConfigAttribute(attributes);
		if (webExpressionConfigAttribute == null) {
			return ACCESS_ABSTAIN;
		}
		//2.webExpressionConfigAttribute.postProcess() 
		//返回：new VariableEvaluationContext(WebSecurityExpressionRoot.class, invocation.getHttpRequest())
		EvaluationContext ctx = webExpressionConfigAttribute.postProcess(
				this.expressionHandler.createEvaluationContext(authentication, filterInvocation), filterInvocation); //类型为：DefaultWebSecurityExpressionHandler1，返回值为WebSecurityExpressionRoot
	
		//3
		boolean granted = ExpressionUtils.evaluateAsBoolean(webExpressionConfigAttribute.getAuthorizeExpression(), ctx);
		if (granted) {
			return ACCESS_GRANTED;
		}
		return ACCESS_DENIED;
	}

	private WebExpressionConfigAttribute findConfigAttribute(Collection<ConfigAttribute> attributes) {
		for (ConfigAttribute attribute : attributes) {
			if (attribute instanceof WebExpressionConfigAttribute) {
				return (WebExpressionConfigAttribute) attribute;
			}
		}
		return null;
	}
}

 
  
5.2.2.12.DefaultWebSecurityExpressionHandler.createSecurityExpressionRoot()
 
  
public class DefaultWebSecurityExpressionHandler extends AbstractSecurityExpressionHandler<FilterInvocation>
		implements SecurityExpressionHandler<FilterInvocation> {
			
	private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
	private String defaultRolePrefix = "ROLE_";

	//在ExpressionUrlAuthorizationConfigurer#getExpressionHandler()中定义
	protected SecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication,FilterInvocation fi) {
		WebSecurityExpressionRoot root = new WebSecurityExpressionRoot(authentication, fi);
		root.setPermissionEvaluator(getPermissionEvaluator());
		root.setTrustResolver(this.trustResolver);
		root.setRoleHierarchy(getRoleHierarchy());
		root.setDefaultRolePrefix(this.defaultRolePrefix);
		return root; //返回
	}
}

 
  
5.2.2.13 ExpressionUtils.evaluateAsBoolean(context,invocation)
 
  
public final class ExpressionUtils {

	private ExpressionUtils() {
	}

	public static boolean evaluateAsBoolean(Expression expr, EvaluationContext ctx) {
		//ctx:new  VariableEvaluationContext(new WebSecurityExpressionRoot())`
		//expr: SpelExpression 调用SPEL表达式
		return expr.getValue(ctx, Boolean.class);
	}

}

 
  
5.2.2.14 重要接口-WebSecurityExpressionRoot
 
  
spring-security-源码解析+自定义拓展_第18张图片
 
  
5.2.2.15 重要接口-VariableEvaluationContext(略)
 
  
5.2.3. 通过Expression鉴权
 
  
 
   
https://docs.spring.io/spring-security/reference/5.7/servlet/authorization/expression-based.html
 
  
 
  
5.2.3.2 Referring to Beans in Web Security Expressions
 
  
//1.定义工具类
public class WebSecurityAuthz {
		public boolean check(Authentication authentication, HttpServletRequest request) {
				...
		}
}

//2. httpsecurity注册
http
    .authorizeHttpRequests(authorize -> authorize
        .antMatchers("/user/**").access("@WebSecurityAuthz.check(authentication,request)")
        ...
    )


 
  
5.2.3.3 Path Variables in Web Security Expressions
 
  
public class webSecurityAuthz2 {
		public boolean checkUserId(Authentication authentication, int id) {
				...
		}
}

http
	.authorizeHttpRequests(authorize -> authorize
		.antMatchers("/user/{userId}/**").access("@webSecurityAuthz2.checkUserId(authentication,#userId)")
		...
	);


 
  
5.2.3.4 Method Security Expressions
 
  
启用global-method-security
 
  
<global-method-security pre-post-annotations="enabled"/>

 
  
@PreAuthorize("hasRole('USER')")
public void create(Contact contact)

@PreAuthorize("hasPermission(#contact, 'admin')")
public void deletePermission(Contact contact, Sid recipient, Permission permission);

@PreAuthorize("#c.name == authentication.name")
public void doSomething(@P("c") Contact contact);


@PreAuthorize("#n == authentication.name")
Contact findContactByName(@Param("n") String name);

@PreAuthorize("#contact.name == authentication.name")
public void doSomething(Contact contact);



 
  
5.2.3.5 @PreFilter and @PostFilter
 
  
在使用@PostFilter注释时，Spring Security会遍历返回的集合或映射，并删除所有提供的表达式为false的元素。对于数组，将返回一个新的数组实例，其中包含筛选后的元素。
 
  
@PreAuthorize("hasRole('USER')")
@PostFilter("hasPermission(filterObject, 'read') or hasPermission(filterObject, 'admin')")
public List<Contact> getAll();


 
  
 
  
 
  
6.methodSecurity 流程分析
 
  
 
   
添加链接描述
 
  
 
  
6.1.@EnableGlobalMethodSecurity
 
  
6.1.1 接口定义
 
  
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.TYPE)
@Documented
@Import({ GlobalMethodSecuritySelector.class }) //通常使用：@GlobalMethodSecurityConfiguration
@EnableGlobalAuthentication
@Configuration
public @interface EnableGlobalMethodSecurity {
	boolean prePostEnabled() default false;
	boolean securedEnabled() default false;
	boolean jsr250Enabled() default false;
}

 
  
6.1.2.GlobalMethodSecurityConfiguration
 
  
public class GlobalMethodSecurityConfiguration implements ImportAware, SmartInitializingSingleton, BeanFactoryAware {

	private DefaultMethodSecurityExpressionHandler defaultMethodExpressionHandler = new DefaultMethodSecurityExpressionHandler(); 
	private AuthenticationManager authenticationManager;
	private AuthenticationManagerBuilder auth;

	private MethodSecurityExpressionHandler expressionHandler;
	private MethodSecurityInterceptor methodSecurityInterceptor;
	
	@Bean
	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
	public MethodSecurityMetadataSource methodSecurityMetadataSource() {
		List<MethodSecurityMetadataSource> sources = new ArrayList<>();
		ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory(getExpressionHandler());
				
		MethodSecurityMetadataSource customMethodSecurityMetadataSource = customMethodSecurityMetadataSource();
		sources.add(customMethodSecurityMetadataSource);
		
		sources.add(new PrePostAnnotationSecurityMetadataSource(attributeFactory));
		sources.add(new SecuredAnnotationSecurityMetadataSource());
		sources.add(jsr250MethodSecurityMetadataSource);
		return new DelegatingMethodSecurityMetadataSource(sources);
	}
	
	@Bean
	public MethodInterceptor methodSecurityInterceptor(MethodSecurityMetadataSource methodSecurityMetadataSource) {
		this.methodSecurityInterceptor = isAspectJ() ? new AspectJMethodSecurityInterceptor(): new MethodSecurityInterceptor();
		this.methodSecurityInterceptor.setAccessDecisionManager(accessDecisionManager()); //1.
		this.methodSecurityInterceptor.setAfterInvocationManager(afterInvocationManager());//2.
		this.methodSecurityInterceptor.setSecurityMetadataSource(methodSecurityMetadataSource);
		
		// runAsManager default null;
		return this.methodSecurityInterceptor;
	}
	

	@Override
	public void afterSingletonsInstantiated() {
		initializeMethodSecurityInterceptor(); //内部调用：methodSecurityInterceptor.setAuthenticationManager(authenticationManager())

		PermissionEvaluator permissionEvaluator = getSingleBeanOrNull(PermissionEvaluator.class);
		this.defaultMethodExpressionHandler.setPermissionEvaluator(permissionEvaluator);

		RoleHierarchy roleHierarchy = getSingleBeanOrNull(RoleHierarchy.class);
		this.defaultMethodExpressionHandler.setRoleHierarchy(roleHierarchy);
		AuthenticationTrustResolver trustResolver = getSingleBeanOrNull(AuthenticationTrustResolver.class);
		if (trustResolver != null) {
			this.defaultMethodExpressionHandler.setTrustResolver(trustResolver);
		}
		
		//设置rolePrefix 略...

		this.defaultMethodExpressionHandler = this.objectPostProcessor.postProcess(this.defaultMethodExpressionHandler);
	}


	protected AccessDecisionManager accessDecisionManager() {
		List<AccessDecisionVoter<?>> decisionVoters = new ArrayList<>();
		if (prePostEnabled()) {
			ExpressionBasedPreInvocationAdvice expressionAdvice = new ExpressionBasedPreInvocationAdvice();
			expressionAdvice.setExpressionHandler(getExpressionHandler());
			decisionVoters.add(new PreInvocationAuthorizationAdviceVoter(expressionAdvice)); // add PreInvocationAuthorizationAdviceVoter
		}
		
		RoleVoter roleVoter = new RoleVoter();
		GrantedAuthorityDefaults grantedAuthorityDefaults = getSingleBeanOrNull(GrantedAuthorityDefaults.class);
		if (grantedAuthorityDefaults != null) {
			roleVoter.setRolePrefix(grantedAuthorityDefaults.getRolePrefix());
		}
		decisionVoters.add(roleVoter);
		decisionVoters.add(new AuthenticatedVoter()); // add AuthenticatedVoter
		return new AffirmativeBased(decisionVoters);
	}
	
	//由子类覆盖，达到自定义MethodSecurityExpressionHandler的目的;
	protected MethodSecurityExpressionHandler createExpressionHandler() {
		return this.defaultMethodExpressionHandler;
	}

	protected final MethodSecurityExpressionHandler getExpressionHandler() {
		if (this.expressionHandler == null) {
			this.expressionHandler = createExpressionHandler();
		}
		return this.expressionHandler;
	}
}

 
  
6.2. 认证+鉴权流程
 
  
通过AOP,拦截带有特定注解的方法
 
  
     
   
  • @PreAuthorize
    •  
   
  • @PostAuthorize
    •  
   
  • @PreFilter
    •  
   
  • @PostFilter
     通过MethodSecurityInterceptor 拦截.
    •  
  
 
  
6.2.1.重要接口- MethodSecurityMetadataSource
 
  
6.2.1.1 类图
 
  
spring-security-源码解析+自定义拓展_第19张图片
 
  
6.2.1.2 PrePostAnnotationSecurityMetadataSource
 
  
public class PrePostAnnotationSecurityMetadataSource extends AbstractMethodSecurityMetadataSource {

	@Override
	public Collection<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
		if (method.getDeclaringClass() == Object.class) {
			return Collections.emptyList();
		}
		PreFilter preFilter = findAnnotation(method, targetClass, PreFilter.class);
		PreAuthorize preAuthorize = findAnnotation(method, targetClass, PreAuthorize.class);
		PostFilter postFilter = findAnnotation(method, targetClass, PostFilter.class);
		PostAuthorize postAuthorize = findAnnotation(method, targetClass, PostAuthorize.class);
		
		
		ArrayList<ConfigAttribute> attrs = new ArrayList<>(2);
		PreInvocationAttribute pre = this.attributeFactory.createPreInvocationAttribute(preFilterAttribute,
				filterObject, preAuthorizeAttribute);
		attrs.add(pre);
		PostInvocationAttribute post = this.attributeFactory.createPostInvocationAttribute(postFilterAttribute,
				postAuthorizeAttribute);
		attrs.add(post);
		return attrs;
	}

}

 
  
6.2.2.重要接口：MethodInterceptor
 
  
6.2.2.1 类图
 
  
spring-security-源码解析+自定义拓展_第20张图片
 
  
6.2.2.2.MethodSecurityInterceptor
 
  
public class MethodSecurityInterceptor extends AbstractSecurityInterceptor implements MethodInterceptor {

	private MethodSecurityMetadataSource securityMetadataSource;

	@Override
	public Object invoke(MethodInvocation mi) throws Throwable {
		InterceptorStatusToken token = super.beforeInvocation(mi); //1.AbstractSecurityInterceptor.beforeInvocation()
		Object result;
		try {
			result = mi.proceed();
		}
		finally {
			super.finallyInvocation(token); //2.
		}
		return super.afterInvocation(token, result);//3.
	}

}

public abstract class AbstractSecurityInterceptor
		implements InitializingBean, ApplicationEventPublisherAware, MessageSourceAware {

	private AccessDecisionManager accessDecisionManager;
	private AfterInvocationManager afterInvocationManager;
	private AuthenticationManager authenticationManager = new NoOpAuthenticationManager();
	private RunAsManager runAsManager = new NullRunAsManager();		


	protected InterceptorStatusToken beforeInvocation(Object object) {
		
		Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource().getAttributes(object);
		
		Authentication authenticated = authenticateIfRequired();
		
		attemptAuthorization(object, attributes, authenticated);	//1.1	
		return new InterceptorStatusToken(SecurityContextHolder.getContext(), false, attributes, object);

	}

	//1.1
	private void attemptAuthorization(Object object, Collection<ConfigAttribute> attributes,
			Authentication authenticated) {
		//1.1.1
		this.accessDecisionManager.decide(authenticated, object, attributes);
	}
}

 
  
accessDecisionManager.decide 逻辑前文已经有说明，这里不再赘述.
 
  
 
  
 
  
9.自定义拓展
 
  
9.1 自定义验证规则
 
  
9.1.1 实现的功能
 
  
    @PreAuthorize("isHuaWeiLogin() || isAppleLoginAndHasPermissions('mobile:add'))")
    public void xxx(){}


 
  
9.1.2 configuration
 
  
@Configuration
public class WbsGlobalSecurityConfig extends GlobalMethodSecurityConfiguration {


    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        PrivilegeMethodSecurityExpressionHandler expressionHandler = new PrivilegeMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(null);
        return expressionHandler;
    }

    public class PrivilegeMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler implements MethodSecurityExpressionHandler {
        @Override
        protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, MethodInvocation invocation) {
            PrivilegeMethodSecurityExpressionRoot root = new PrivilegeMethodSecurityExpressionRoot(authentication);
            root.setPermissionEvaluator(this.getPermissionEvaluator());
            root.setRoleHierarchy(this.getRoleHierarchy());
            return root;
        }
    }

    public class PrivilegeMethodSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations {

        @Getter @Setter
        private Object filterObject;

        @Getter @Setter
        private Object returnObject;
        private Object target;

        PrivilegeMethodSecurityExpressionRoot(Authentication authentication) {
            super(authentication);
        }

        void setThis(Object target) {
            this.target = target;
        }

        public Object getThis() {
            return this.target;
        }

        private Map<String, Object> orgHelperMocked = Collections.emptyMap();
        public boolean isAppleLogin() {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            if (authentication != null && authentication instanceof AppleUserAuthenticationToken userToken) {
                return userToken.getPrincipal() != null && userToken.isAuthenticated();
            } else {
                return false;
            }
        }

        public boolean isHuaWeiLogin() {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            if (authentication != null && authentication instanceof HuaWeiUserAuthenticationToken userToken) {
                return userToken.getPrincipal() != null && userToken.isAuthenticated();
            } else {
                return false;
            }
        }

        public boolean isAppleLoginAndHasPermissions(String ...permission) {
            if(!isAppleLogin()){
                return false;
            }
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            //todo xxxx
            return false;
        }
    }
}

 
  

                            
                        
                    
                    
                    

                    
                    
                    

                
                

                    
                

            
        
    
    

        
你可能感兴趣的:(springsecurity,spring)

        

            

                
    
                    
  • SpringBlade dict-biz/list 接口 SQL 注入漏洞
                        文章永久免费只为良心
oracle数据库
                        
    SpringBladedict-biz/list接口SQL注入漏洞POC:构造请求包查看返回包你的网址/api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,md5(1),0x7e),1)=1漏洞概述在SpringBlade框架中，如果dict-biz/list接口的后台处理逻辑没有正确地对用户输入进行过滤或参数化查询（PreparedSta
    
                    
    • 
                    
  • spring如何整合druid连接池？
                        惜.己
springspringjunit数据库javaidea后端xml
                        
    目录spring整合druid连接池1.新建maven项目2.新建mavenModule3.导入相关依赖4.配置log4j2.xml5.配置druid.xml1)xml中如何引入properties2)下面是配置文件6.准备jdbc.propertiesJDBC配置项解释7.配置druid8.测试spring整合druid连接池1.新建maven项目打开IDE（比如IntelliJIDEA,Ecl
    
                    
    • 
                    
  • SpringCloudAlibaba—Sentinel(限流)
                        菜鸟爪哇

                        
    前言：自己在学习过程的记录，借鉴别人文章，记录自己实现的步骤。借鉴文章：https://blog.csdn.net/u014494148/article/details/105484410Sentinel介绍Sentinel诞生于阿里巴巴，其主要目标是流量控制和服务熔断。Sentinel是通过限制并发线程的数量（即信号隔离）来减少不稳定资源的影响，而不是使用线程池，省去了线程切换的性能开销。当资源
    
                    
    • 
                    
  • springboot+vue项目实战一-创建SpringBoot简单项目
                        苹果酱0567
面试题汇总与解析springboot后端java中间件开发语言
                        
    这段时间抽空给女朋友搭建一个个人博客，想着记录一下建站的过程，就当做笔记吧。虽然复制zjblog只要一个小时就可以搞定一个网站，或者用cms系统，三四个小时就可以做出一个前后台都有的网站，而且想做成啥样也都行。但是就是要从新做，自己做的意义不一样，更何况，俺就是专门干这个的，嘿嘿嘿要做一个网站，而且从零开始，首先呢就是技术选型了，经过一番思量决定选择-SpringBoot做后端，前端使用Vue做一
    
                    
    • 
                    
  • Spring MVC 全面指南：从入门到精通的详细解析
                        一杯梅子酱
技术栈学习springmvcjava
                        
    引言：SpringMVC，作为Spring框架的一个重要模块，为构建Web应用提供了强大的功能和灵活性。无论是初学者还是有一定经验的开发者，掌握SpringMVC都将显著提升你的Web开发技能。本文旨在为初学者提供一个全面且易于理解的学习路径，通过详细的知识点分析和实际案例，帮助你快速上手SpringMVC，让学习过程既深刻又高效。一、SpringMVC简介1.1什么是SpringMVC？Spri
    
                    
    • 
                    
  • Spring Boot中实现跨域请求
                        BABA8891
springboot后端java
                        
    在SpringBoot中实现跨域请求（CORS，Cross-OriginResourceSharing）可以通过多种方式，以下是几种常见的方法：1.使用@CrossOrigin注解在SpringBoot中，你可以在控制器或者具体的请求处理方法上使用@CrossOrigin注解来允许跨域请求。在控制器上应用：importorg.springframework.web.bind.annotation.
    
                    
    • 
                    
  • 博客网站制作教程
                        2401_85194651
javamaven
                        
    首先就是技术框架：后端：Java+SpringBoot数据库：MySQL前端：Vue.js数据库连接：JPA(JavaPersistenceAPI)1.项目结构blog-app/├──backend/│├──src/main/java/com/example/blogapp/││├──BlogApplication.java││├──config/│││└──DatabaseConfig.java
    
                    
    • 
                    
  • RabbitMQ生产者重复机制与确认机制
                        java炒饭小能手
java-rabbitmqrabbitmqjava
                        
    重复机制生产者发送消息时，出现了网络故障，导致与MQ的连接中断。为了解决这个问题，SpringAMQP提供的消息发送时的重试机制。即：当RabbitTemplate与MQ连接超时后，多次重试。需要修该发送端模块的application.yaml文件，添加下面的内容：spring:rabbitmq:connection-timeout:1s#设置MQ的连接超时时间template:retry:ena
    
                    
    • 
                    
  • 【Java】已解决：org.springframework.jdbc.datasource.lookup.DataSourceLookupFailureException
                        屿小夏
java开发语言
                        
    文章目录一、分析问题背景问题背景描述出现问题的场景二、可能出错的原因三、错误代码示例四、正确代码示例五、注意事项已解决：org.springframework.jdbc.datasource.lookup.DataSourceLookupFailureException在使用Spring框架进行开发时，数据源的配置和使用是非常关键的一环。然而，有时候我们可能会遇到org.springframewo
    
                    
    • 
                    
  • SpringBoot和SpringMVC是什么关系?SpringBoot替代SpringMVC了吗?
                        瑞金彭于晏
springboot后端javaMVCspring数据库
                        
    SpringBoot和SpringMVC都是SpringFramework生态系统中的一部分，但它们各自扮演着不同的角色和提供不同的功能集。理解它们之间的关系，首先需要了解SpringFramework本身。SpringFrameworkSpringFramework是一个全面的、开源的应用程序开发框架，它提供了广泛的功能来支持企业应用开发的几乎所有方面。SpringFramework的核心特性之
    
                    
    • 
                    
  • spring mvc @RequestBody String类型参数
                        zoyation
spring-mvcspringmvc
                        
    通过如下配置：text/html;charset=UTF-8application/json;charset=UTF-8在springmvc的Controller层使用@RequestBody接收Content-Type为application/json的数据时，默认支持Map方式和对象方式参数@RequestMapping(value="/{code}/saveUser",method=Requ
    
                    
    • 
                    
  • Java -jar 如何在后台运行项目
                        vincent_hahaha

                        
    撸了今年阿里、头条和美团的面试，我有一个重要发现.......>>>说到运行jar包通常我们都会以下面的方式运行:java-jarspringboot-0.0.1-SNAPSHOT.jar这样运行的话会有一个问题，就是我们一关闭当前窗口就会停止运行项目，要想解决这个问题，就需要在后台运行。nohupjava-jarbabyshark-0.0.1-SNAPSHOT.jar >log.file 2>&
    
                    
    • 
                    
  • spring security中几大组件的作用和执行顺序
                        阿信在这里
javaspring
                        
    springsecurity中几大组件的作用和执行顺序在SpringSecurity中，AuthenticationProvider、GroupPermissionEvaluator、PermissionEvaluator、AbstractAuthenticationProcessingFilter、DefaultMethodSecurityExpressionHandler和ManageSecu
    
                    
    • 
                    
  • 探索Zebra4J：构建高效企业级Web应用的微服务框架
                        叶准鑫Natalie

                        
    探索Zebra4J：构建高效企业级Web应用的微服务框架ZebraZebra4J/Zebra4Js基于SpringBoot的JavaWeb/Nodejs框架项目地址:https://gitcode.com/gh_mirrors/zebra/Zebra项目介绍在当今快速发展的技术环境中，构建高效、可扩展的企业级Web应用是每个开发团队的追求。Zebra4J作为一款基于SpringBoot的全新微服务
    
                    
    • 
                    
  • 基于JavaWeb开发的Java+SpringMvc+vue+element实现上海汽车博物馆平台
                        网顺技术团队
成品程序项目javavue.js汽车课程设计springboot
                        
    基于JavaWeb开发的Java+SpringMvc+vue+element实现上海汽车博物馆平台作者主页网顺技术团队欢迎点赞收藏⭐留言文末获取源码联系方式查看下方微信号获取联系方式承接各种定制系统精彩系列推荐精彩专栏推荐订阅不然下次找不到哟Java毕设项目精品实战案例《1000套》感兴趣的可以先收藏起来，还有大家在毕设选题，项目以及论文编写等相关问题都可以给我留言咨询，希望帮助更多的人文章目录基
    
                    
    • 
                    
  • 分布式锁和spring事务管理
                        暴躁的鱼
锁及事务分布式springjava
                        
    最近开发一个小程序遇到一个需求需要实现分布式事务管理业务需求用户在使用小程序的过程中可以查看景点，对景点地区或者城市标记是否想去，那么需要统计一个地点被标记的人数，以及记录某个用户对某个地点是否标记为想去，用两个表存储数据，一个地点表记录改地点被标记的次数，一个用户意向表记录某个用户对某个地点是否标记为想去。由于可能有多个用户同时标记一个地点，每个用户在前端点击想去按钮之后，后台接收到请求，从数据
    
                    
    • 
                    
  • Java面试笔记记录6
                        今天背八股了吗
java面试笔记
                        
    1.Spring是什么？特性？有哪些模块？Spring是一个轻量级、非入侵式的控制反转Ioc和面向切面AOP的框架。特性：1.Ioc和DISpring的核心就是一个大的工厂容器，可以维护所有对象的创建和依赖关系，Spring工厂用于生成Bean，并且管理Bean的生命周期，实现高内聚低耦合的设计理念。2.AOP编程Spring提供面向切面编程，可以方便实现对程序进行权限拦截、运行监控等切面功能。3
    
                    
    • 
                    
  • Sentinel
                        眼泪落在琴弦
springcloudjavajava
                        
    Sentinel（服务熔断降级限流）1.引入spring-cloud-starter-alibaba-sentinel2.下载sentinel服务器3.配置application地址信息4.在控制台调整参数【默认所以流控设置保存在内存中，重启失效】5.想实时监控需每个微服务导入actuator，并配置application暴露所有端口6.自定义sentinel流控返回数据7.配置sentinel类
    
                    
    • 
                    
  • Spring @Async 深度解读：默认线程池执行器的配置与优化
                        小码快撩
springjava前端
                        
    在Spring中，@Async注解用于异步执行方法。默认情况下，@Async注解的任务是由一个线程池执行的。然而，这个默认的线程池是如何初始化的呢？本文将深入探讨这一过程，帮助你理解Spring异步任务背后的线程池执行器的初始化原理。1.@Async的基本使用首先，让我们快速回顾一下@Async的基本用法。@Async通常用于标注在需要异步执行的方法上，比如：@Servicepublicclass
    
                    
    • 
                    
  • Sentinel实时监控不展示问题
                        朱杰jjj
sentinelsentinel
                        
    问题官方插件Endpoint支持，可以实时统计出SpringBoot的健康状况和请求的调用信息在使用Endpoint特性之前需要在Maven中添加spring-boot-starter-actuator依赖，并在配置中允许Endpoints的访问。SpringBoot1.x中添加配置management.security.enabled=false。暴露的endpoint路径为/sentinelS
    
                    
    • 
                    
  • 36. MyBatis如何支持多数据库操作？如何配置不同的数据源？
                        这孩子叫逆
Mybatis笔记mybatis数据库
                        
    在许多企业级应用中，可能需要访问多个数据库。MyBatis可以通过配置多个数据源和动态切换数据源来支持多数据库操作。下面介绍如何在MyBatis中配置和使用多个数据源。1.多数据源的基本配置1.1配置多个数据源要支持多个数据源，首先需要在Spring或SpringBoot中配置不同的数据源。假设我们要连接两个数据库db1和db2，可以通过以下步骤进行配置。SpringBoot示例：applicat
    
                    
    • 
                    
  • SpringBoot整合ES搜索引擎 实现网站热搜词及热度计算
                        码踏云端
springbootElasticsearchspringbootelasticsearch后端热搜词热度计算java
                        
    博主简介：历代文学网（PC端可以访问：https://literature.sinhy.com/#/literature?__c=1000，移动端可微信小程序搜索“历代文学”）总架构师，15年工作经验，精通Java编程，高并发设计，Springboot和微服务，熟悉Linux，ESXI虚拟化以及云原生Docker和K8s，热衷于探索科技的边界，并将理论知识转化为实际应用。保持对新技术的好奇心，乐于
    
                    
    • 
                    
  • Spring Security静态资源过滤（11）
                        小黑屋说YYDS
spring
                        
    在一个实际项目中，并非所有的请求都需要经过SpringSecurity过滤器，有一些特殊的请求，例如静态资源等，一般来说并不需要经过SpringSecurity过滤器链，用户如果访问这些静态资源，直接返回对应的资源即可。回顾关于WebSecurity的讲解，提到它里边维护了一个ignoredRequests变量,该变量，记录的就是所有需要被忽略的请求，这些被忽略的请求将不再经过SpringSecu
    
                    
    • 
                    
  • Spring Security定义多个过滤器链（10）
                        小黑屋说YYDS
spring
                        
    在SpringSecurity中可以同时存在多个过滤器链，一个WebSecurityConfigurerAdapter的实例就可以配置一条过滤器链。我们来看如下一个案例：@ConfigurationpublicclassSecurityConfig{@BeanUserDetailsServiceus(){InMemoryUserDetailsManagerusers=newInMemoryUser
    
                    
    • 
                    
  • java 技术 架构 相关文档
                        圣心
java架构开发语言
                        
    在Java中，有许多不同的技术和架构，这里我将列举一些常见的Java技术和架构，并提供一些相关的文档资源。SpringFrameworkSpring是一个开源的Java/JavaEE全功能框架，以Apache许可证形式发布，提供了一种实现企业级应用的方法。官方文档：SpringFrameworkSpringBootSpringBoot是Spring的一个子项目，旨在简化创建生产级的Spring应用
    
                    
    • 
                    
  • SpringSecurity初学总结
                        weixin_66442229
spring
                        
    springSecurity安全框架基于Java的安全框架主要有:SpringSecurity和Shiro介绍基础概念安全框架是对用户访问权限的控制,保证应用的安全性。其主要的工作是用户认证和用户授权|鉴权主要应用于Spring的企业应用系统,提供声明式的安全访问控制解决方案。它提供了一组可以在Spring应用上下文中配置的Bean能很好的结合Spring的DI依赖注入和AOP面向切面编程功能应用
    
                    
    • 
                    
  • java获取applicationcontext,SpringBoot获取ApplicationContext的3种方式
                        花儿街参考

                        
    ApplicationContext是什么？简单来说就是Spring中的容器，可以用来获取容器中的各种bean组件，注册监听事件，加载资源文件等功能。ApplicationContext获取的几种方式1直接使用Autowired注入@ComponentpublicclassBook1{@AutowiredprivateApplicationContextapplicationContext;pub
    
                    
    • 
                    
  • SpringBoot 设置传入参数非必要
                        loveLifeLoveCoding
springbootspringbootjavaspring
                        
    查看RequestParam源码packageorg.springframework.web.bind.annotation;importjava.lang.annotation.Documented;importjava.lang.annotation.ElementType;importjava.lang.annotation.Retention;importjava.lang.annotat
    
                    
    • 
                    
  • SpringBoot 获取 ApplicationContext
                        loveLifeLoveCoding
springbootspringbootjavaspring
                        
    1.概念ApplicationContext是什么？简单来说就是Spring中的容器，可以用来获取容器中的各种bean组件，注册监听事件，加载资源文件等功能2.获取ApplicationContext的方式2.1.创建工具类通过此工具类，可以方便的获取bean组件,获取配置信息等importorg.springframework.beans.BeansException;importorg.spr
    
                    
    • 
                    
  • java打印标签（机型TOSHIBA条码打印机B-EX4T）
                         嘘 
JAVAjava
                        
    java打印标签实现方式标签效果代码获取更多相关资料实现rfid写入功能实现方式打印机设置网络ipjava获取socket连接，调用TPCL指令标签效果代码packageorg.jeecg.modules.invinfo.util;importorg.jeecg.modules.invinfo.vo.BatKcInventoryDetailVo;importorg.springframework.
    
                    
    • 
                                
  • java Illegal overloaded getter method with ambiguous type for propert的解决
                                    zwllxs
javajdk
                                    
    好久不来iteye,今天又来看看，哈哈,今天碰到在编码时，反射中会抛出 
 Illegal overloaded getter method with ambiguous type for propert这么个东东，从字面意思看，是反射在获取getter时迷惑了，然后回想起java在boolean值在生成getter时，分别有is和getter，也许我们的反射对象中就有is开头的方法迷惑了jdk，
    
                                
    • 
                                
  • IT人应当知道的10个行业小内幕
                                    beijingjava
工作互联网
                                    
    10. 虽然IT业的薪酬比其他很多行业要好，但有公司因此视你为其“佣人”。 
　　尽管IT人士的薪水没有互联网泡沫之前要好，但和其他行业人士比较，IT人的薪资还算好点。在接下的几十年中，科技在商业和社会发展中所占分量会一直增加，所以我们完全有理由相信，IT专业人才的需求量也不会减少。 
　　然而，正因为IT人士的薪水普遍较高，所以有些公司认为给了你这么多钱，就把你看成是公司的“佣人”，拥有你的支配
    
                                
    • 
                                
  • java 实现自定义链表
                                    CrazyMizzz
java数据结构
                                    
    1.链表结构 
 
  链表是链式的结构 
 
 
2.链表的组成 
 
   链表是由头节点，中间节点和尾节点组成 
 
   节点是由两个部分组成： 
 
      1.数据域 
      2.引用域 
 
 
3.链表的实现 
 
&nbs
    
                                
    • 
                                
  • web项目发布到服务器后图片过一会儿消失
                                    麦田的设计者
struts2上传图片永久保存
                                    
      作为一名学习了android和j2ee的程序员，我们必须要意识到，客服端和服务器端的交互是很有必要的，比如你用eclipse写了一个web工程，并且发布到了服务器（tomcat）上，这时你在webapps目录下看到了你发布的web工程，你可以打开电脑的浏览器输入http://localhost:8080/工程/路径访问里面的资源。但是，有时你会突然的发现之前用struts2上传的图片
    
                                
    • 
                                
  • CodeIgniter框架Cart类 name 不能设置中文的解决方法
                                    IT独行者
CodeIgniterCart框架　
                                    
    今天试用了一下CodeIgniter的Cart类时遇到了个小问题，发现当name的值为中文时，就写入不了session。在这里特别提醒一下。 在CI手册里也有说明，如下： 
$data = array(
               'id'      => 'sku_123ABC',
               'qty'     => 1,
               '
    
                                
    • 
                                
  • linux回收站
                                    _wy_
linux回收站
                                    
    今天一不小心在ubuntu下把一个文件移动到了回收站，我并不想删，手误了。我急忙到Nautilus下的回收站中准备恢复它，但是里面居然什么都没有。      后来我发现这是由于我删文件的地方不在HOME所在的分区，而是在另一个独立的Linux分区下，这是我专门用于开发的分区。而我删除的东东在分区根目录下的.Trash-1000/file目录下，相关的删除信息（删除时间和文件所在
    
                                
    • 
                                
  • jquery回到页面顶端
                                    知了ing
htmljquerycss
                                    
    html代码： 
 
<h1 id="anchor">页面标题</h1>
<div id="container">页面内容</div>
<p><a href="#anchor" class="topLink">回到顶端</a><
    
                                
    • 
                                
  • B树、B-树、B+树、B*树
                                    矮蛋蛋
B树
                                    
    原文地址： 
http://www.cnblogs.com/oldhorse/archive/2009/11/16/1604009.html 
B树 
 
       即二叉搜索树： 
 
       1.所有非叶子结点至多拥有两个儿子（Left和Right）； 
 
&nb
    
                                
    • 
                                
  • 数据库连接池
                                    alafqq
数据库连接池
                                    
    http://www.cnblogs.com/xdp-gacl/p/4002804.html 
 
@Anthor:孤傲苍狼 
 
数据库连接池 
 
用MySQLv5版本的数据库驱动没有问题，使用MySQLv6和Oracle的数据库驱动时候报如下错误： 
java.lang.ClassCastException: $Proxy0 cannot be cast to java.sql.Connec
    
                                
    • 
                                
  • java泛型
                                    百合不是茶
java泛型
                                    
    泛型 
在Java SE 1.5之前，没有泛型的情况的下，通过对类型Object的引用来实现参数的“任意化”，任意化的缺点就是要实行强制转换，这种强制转换可能会带来不安全的隐患 
  
泛型的特点：消除强制转换 确保类型安全 向后兼容 
  
简单泛型的定义： 
     泛型：就是在类中将其模糊化，在创建对象的时候再具体定义 
class fan
    
                                
    • 
                                
  • javascript闭包[两个小测试例子]
                                    bijian1013
JavaScriptJavaScript
                                    
    一.程序一 
<script>
var name = "The Window";
var Object_a = {
　　name : "My Object",
　　getNameFunc : function(){
               var that = this;
　　　　return function(){
　　　　
    
                                
    • 
                                
  • 探索JUnit4扩展：假设机制（Assumption）
                                    bijian1013
javaAssumptionJUnit单元测试
                                    
    一.假设机制（Assumption）概述        理想情况下，写测试用例的开发人员可以明确的知道所有导致他们所写的测试用例不通过的地方，但是有的时候，这些导致测试用例不通过的地方并不是很容易的被发现，可能隐藏得很深，从而导致开发人员在写测试用例时很难预测到这些因素，而且往往这些因素并不是开发人员当初设计测试用例时真正目的，
    
                                
    • 
                                
  • 【Gson四】范型POJO的反序列化
                                    bit1129
POJO
                                    
    在下面这个例子中，POJO(Data类)是一个范型类，在Tests中，指定范型类为PieceData，POJO初始化完成后，通过 
String str = new Gson().toJson(data); 
得到范型化的POJO序列化得到的JSON串，然后将这个JSON串反序列化为POJO 
  
import com.google.gson.Gson;

import java.
    
                                
    • 
                                
  • 【Spark八十五】Spark Streaming分析结果落地到MySQL
                                    bit1129
Stream
                                    
    几点总结： 
1. DStream.foreachRDD是一个Output Operation，类似于RDD的action，会触发Job的提交。DStream.foreachRDD是数据落地很常用的方法 
2. 获取MySQL Connection的操作应该放在foreachRDD的参数（是一个RDD[T]=>Unit的函数类型)，这样，当foreachRDD方法在每个Worker上执行时，
    
                                
    • 
                                
  • NGINX + LUA实现复杂的控制
                                    ronin47
nginx lua
                                    
    安装lua_nginx_module 模块 
lua_nginx_module 可以一步步的安装，也可以直接用淘宝的OpenResty 
Centos和debian的安装就简单了。。 
这里说下freebsd的安装： 
fetch http://www.lua.org/ftp/lua-5.1.4.tar.gz
tar zxvf lua-5.1.4.tar.gz
cd lua-5.1.4
ma
    
                                
    • 
                                
  • java-递归判断数组是否升序
                                    bylijinnan
java
                                    
    

public class IsAccendListRecursive {

	/*递归判断数组是否升序
	 * if a Integer array is ascending,return true
	 * use recursion
	 */
	
	public static void main(String[] args){
		IsAccendListRecursiv
    
                                
    • 
                                
  • Netty源码学习-DefaultChannelPipeline2
                                    bylijinnan
javanetty
                                    
    Netty3的API 
 
http://docs.jboss.org/netty/3.2/api/org/jboss/netty/channel/ChannelPipeline.html 
里面提到ChannelPipeline的一个“pitfall”： 
如果ChannelPipeline只有一个handler（假设为handlerA）且希望用另一handler（假设为handlerB） 
来
    
                                
    • 
                                
  • Java工具之JPS
                                    chinrui
java
                                    
    JPS使用 
  
  
熟悉Linux的朋友们都知道，Linux下有一个常用的命令叫做ps（Process Status)，是用来查看Linux环境下进程信息的。同样的，在Java Virtual Machine里面也提供了类似的工具供广大Java开发人员使用，它就是jps（Java Process Status)，它可以用来
    
                                
    • 
                                
  • window.print分页打印
                                    ctrain
window
                                    
    
function init() {
    var tt = document.getElementById("tt");
    var childNodes = tt.childNodes[0].childNodes;
    var level = 0;
    for (var i = 0; i < childNodes.length; i++) {

    
                                
    • 
                                
  • 安装hadoop时 执行jps命令Error occurred during initialization of VM
                                    daizj
jdkhadoopjps
                                    
    在安装hadoop时，执行JPS出现下面错误 
  
[slave16][email protected]:/tmp/hsperfdata_hdfs# jps 
Error occurred during initialization of VM 
java.lang.Error: Properties init: Could not determine current working
    
                                
    • 
                                
  • PHP开发大型项目的一点经验
                                    dcj3sjt126com
PHP重构
                                    
    一、变量 最好是把所有的变量存储在一个数组中，这样在程序的开发中可以带来很多的方便，特别是当程序很大的时候。变量的命名就当适合自己的习惯，不管是用拼音还是英语，至少应当有一定的意义，以便适合记忆。变量的命名尽量规范化，不要与PHP中的关键字相冲突。 二、函数 PHP自带了很多函数，这给我们程序的编写带来了很多的方便。当然，在大型程序中我们往往自己要定义许多个函数，几十
    
                                
    • 
                                
  • android笔记之--向网络发送GET/POST请求参数
                                    dcj3sjt126com
android
                                    
    使用GET方法发送请求 
private static boolean sendGETRequest (String path,

                     Map<String, String> params) throws Exception{

              //发送地http://192.168.100.91:8080/videoServi
    
                                
    • 
                                
  • linux复习笔记 之bash shell (3) 通配符
                                    eksliang
linux 通配符linux通配符
                                    
    转载请出自出处：
http://eksliang.iteye.com/blog/2104387  
在bash的操作环境中有一个非常有用的功能，那就是通配符。 
下面列出一些常用的通配符，如下表所示    符号 意义   * 万用字符，代表0个到无穷个任意字符   ? 万用字符，代表一定有一个任意字符   [] 代表一定有一个在中括号内的字符。例如：[abcd]代表一定有一个字符，可能是a、b、c
    
                                
    • 
                                
  • Android关于短信加密
                                    gqdy365
android
                                    
    关于Android短信加密功能，我初步了解的如下（只在Android应用层试验）： 
    1、因为Android有短信收发接口，可以调用接口完成短信收发； 
        发送过程：APP（基于短信应用修改）接受用户输入号码、内容——>APP对短信内容加密——>调用短信发送方法Sm
    
                                
    • 
                                
  • asp.net在网站根目录下创建文件夹
                                    hvt
.netC#hovertreeasp.netWeb Forms
                                    
    假设要在asp.net网站的根目录下建立文件夹hovertree,C#代码如下： 
string m_keleyiFolderName = Server.MapPath("/hovertree");

if (Directory.Exists(m_keleyiFolderName))
{
//文件夹已经存在
return;
}
else
{
try
{
D
    
                                
    • 
                                
  • 一个合格的程序员应该读过哪些书
                                    justjavac
程序员书籍
                                    
    编者按：2008年8月4日，StackOverflow 网友 Bert F 发帖提问：哪本最具影响力的书，是每个程序员都应该读的？ 
 
 “如果能时光倒流，回到过去，作为一个开发人员，你可以告诉自己在职业生涯初期应该读一本， 你会选择哪本书呢？我希望这个书单列表内容丰富，可以涵盖很多东西。” 
 
很多程序员响应，他们在推荐时也写下自己的评语。 以前就有国内网友介绍这个程序员书单，不过都是推荐数
    
                                
    • 
                                
  • 单实例实践
                                    跑龙套_az
单例
                                    
      
 1、内部类 
public class Singleton {
      private static class SingletonHolder {
             public static Singleton singleton = new Singleton();
      } 
       public Singleton getRes
    
                                
    • 
                                
  • PO VO BEAN 理解
                                    q137681467
VODTOpo
                                    
    PO： 
     全称是 persistant object持久对象 最形象的理解就是一个PO就是数据库中的一条记录。 好处是可以把一条记录作为一个对象处理，可以方便的转为其它对象。 
  
  
BO： 
    全称是 business object:业务对象 主要作用是把业务逻辑封装为一个对象。这个对
    
                                
    • 
                                
  • 战胜惰性，暗自努力
                                    金笛子
努力
                                    
    偶然看到一句很贴近生活的话：“别人都在你看不到的地方暗自努力，在你看得到的地方，他们也和你一样显得吊儿郎当，和你一样会抱怨，而只有你自己相信这些都是真的，最后也只有你一人继续不思进取。”很多句子总在不经意中就会戳中一部分人的软肋，我想我们每个人的周围总是有那么些表现得“吊儿郎当”的存在，是否你就真的相信他们如此不思进取，而开始放松了对自己的要求随波逐流呢？ 
我有个朋友是搞技术的，平时嘻嘻哈哈，以
    
                                
    • 
                                
  • NDK/JNI二维数组多维数组传递
                                    wenzongliang
二维数组jniNDK
                                    
    多维数组和对象数组一样处理，例如二维数组里的每个元素还是一个数组 用jArray表示，直到数组变为一维的，且里面元素为基本类型，去获得一维数组指针。给大家提供个例子。已经测试通过。 
Java_cn_wzl_FiveChessView_checkWin( JNIEnv* env,jobject thiz,jobjectArray qizidata)

{
jint i,j;

int s
    
                                
    •