SpringSecurity基本原理

最新推荐文章于 2025-06-24 19:39:51 发布

原创

最新推荐文章于 2025-06-24 19:39:51 发布 · 634 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#java #spring #Security

本文介绍了SpringSecurity的基本原理，它是一个过滤器链。核心过滤器包括FilterSecurityInterceptor、ExceptionTranslationFilter和UsernamePasswordAuthenticationFilter。SpringSecurity配置过滤器时使用DelegatingFilterProxy，FilterChainProxy负责加载过滤链。重点讨论了UserDetailService和PasswordEncoder接口，前者用于自定义认证逻辑，后者用于密码加密。通过实现这些接口，开发者可以更好地控制SpringSecurity的认证和授权过程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

SpringSecurity基本原理

SpringSecurity本质上是一个过滤器链

代码底层流程：重点看三个过滤器

FilterSecurityInterceptor——是一个方法级的权限过滤器链的最底部

	//过滤方法
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
   
   
        this.invoke(new FilterInvocation(request, response, chain));
    }

	//执行方法
	    public void invoke(FilterInvocation filterInvocation) throws IOException, ServletException {
   
   
        if (this.isApplied(filterInvocation) && this.observeOncePerRequest) {
   
   
            filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse());
        } else {
   
   
            if (filterInvocation.getRequest() != null && this.observeOncePerRequest) {
   
   
                filterInvocation.getRequest().setAttribute("__spring_security_filterSecurityInterceptor_filterApplied", Boolean.TRUE);
            }

            InterceptorStatusToken token = super.beforeInvocation(filterInvocation);

            try {
   
   
                filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse());
            } finally {
   
   
                super.finallyInvocation(token);
            }

            super.afterInvocation(token, (Object)null);
        }
    }

super.beforeInvocation(filterInvocation) 表示查看之前的filter是否通过
filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse()); 表示真正的调用后台的服务

ExceptionTranslationFilter——是一个异常过滤器，用来处理在认证授权过程中抛出的异常

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
   
   
        try {
   
   
            chain.doFilter(request, response);
        } catch (IOException var7) {
   
   
            throw var7;
        } catch (Exception var8) {
   
   
            Throwable[] causeChain = this.throwableAnalyzer.determineCauseChain(var8);
            RuntimeException securityException =