有时需要在默认的filter之前定义自己的filter来改变原来的实现 但假如知道原来的filter的bean的默认名字之后 往往可以直接配置原来的filter
<beans:bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
<custom-filter before="LOGOUT_FILTER" />
<beans:constructor-arg index="0" value="/"/>
<beans:constructor-arg index="1">
<beans:list>
<beans:bean class="org.springframework.security.ui.logout.SecurityContextLogoutHandler"/>
<beans:ref bean="_rememberMeServices"/>
<beans:bean class="com.lich0079.CustomLogoutHandler"/>
</beans:list>
</beans:constructor-arg>
</beans:bean>
现在只要
<beans:bean id="_logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
<beans:constructor-arg index="0" value="/" />
<beans:constructor-arg index="1">
<beans:list>
<beans:bean class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
<beans:ref bean="_rememberMeServices" />
<beans:bean class="lich0079.CustomLogoutFilter" />
</beans:list>
</beans:constructor-arg>
<beans:property name="filterProcessesUrl" value="/logout"/>
</beans:bean>
去掉了 <custom-filter before="LOGOUT_FILTER" />
ID变为 _logoutFilter 这是默认名字
改变rememberMe的一些默认配置 这些都是命名空间配置不了的
<beans:bean id="_rememberMeServices" class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
<beans:property name="userDetailsService" ref="userDetailsServiceWrapper" />
<beans:property name="parameter" value="rememberMe" /><!-- form input name -->
<beans:property name="key" value="keyss" />
<beans:property name="tokenValiditySeconds" value="2147483647" /><!-- the left valid time, about 68 year, max int-->
<beans:property name="cookieName" value="cookieCode" />
</beans:bean>
但首先你要知道这些bean的默认名字,试了半天 在applicationContext的beanFactory里找出来了
[_sessionFixationProtectionFilter, _rememberMeServices, _accessManager, org.springframework.aop.config.internalAutoProxyCreator, _basicAuthenticationFilter, _formLoginEntryPoint, _filterSecurityInterceptor, _filterChainProxy, _anonymousAuthenticationProvider, _filterChainProxyPostProcessor, _rememberMeAuthenticationProvider, _basicAuthenticationEntryPoint, _methodDefinitionSourceAdvisor, org.springframework.security.config.AuthenticationProviderBeanDefinitionParser$AuthenticationProviderCacheResolver#0, _exceptionTranslationFilter, _httpSessionContextIntegrationFilter, _methodSecurityInterceptorPostProcessor, _entryPointInjectionBeanPostProcessor, _logoutFilter, _portMapper, _securityContextHolderAwareRequestFilter, _rememberMeFilter, org.springframework.security.providers.dao.DaoAuthenticationProvider#0, _rememberMeServicesInjectionBeanPostProcessor, _anonymousProcessingFilter, _filterChainList, org.springframework.security.userdetails.memory.InMemoryDaoImpl#0, _delegatingMethodDefinitionSource, _authenticationManager, _userServiceInjectionPostProcessor, _formLoginFilter, _methodSecurityInterceptor]
有时候你配置了自己的filter不知道到底work了没有,可以去FilterChainProxy这个类里面设个断点,在里面可以看到整个filter链的对象,看你自己加的在不在里面,配置的属性是不是你想要的