spring security 4 filter 順序及作用

Spring Security 有兩個作用：認證和授權

一、Srping security 4 filter 別名及順序

spring security 4 標准filter別名和順序，因為經常要用就保存到自己博客吧  點擊訪問官網鏈接

Table 6.1. Standard Filter Aliases and Ordering

Alias	Filter Class	Namespace Element or Attribute
CHANNEL_FILTER	ChannelProcessingFilter	http/intercept-url@requires-channel
SECURITY_CONTEXT_FILTER	SecurityContextPersistenceFilter	http
CONCURRENT_SESSION_FILTER	ConcurrentSessionFilter	session-management/concurrency-control
HEADERS_FILTER	HeaderWriterFilter	http/headers
CSRF_FILTER	CsrfFilter	http/csrf
LOGOUT_FILTER	LogoutFilter	http/logout
X509_FILTER	X509AuthenticationFilter	http/x509
PRE_AUTH_FILTER	AbstractPreAuthenticatedProcessingFilterSubclasses	N/A
CAS_FILTER	CasAuthenticationFilter	N/A
FORM_LOGIN_FILTER	UsernamePasswordAuthenticationFilter	http/form-login
BASIC_AUTH_FILTER	BasicAuthenticationFilter	http/http-basic
SERVLET_API_SUPPORT_FILTER	SecurityContextHolderAwareRequestFilter	http/@servlet-api-provision
JAAS_API_SUPPORT_FILTER	JaasApiIntegrationFilter	http/@jaas-api-provision
REMEMBER_ME_FILTER	RememberMeAuthenticationFilter	http/remember-me
ANONYMOUS_FILTER	AnonymousAuthenticationFilter	http/anonymous
SESSION_MANAGEMENT_FILTER	SessionManagementFilter	session-management
EXCEPTION_TRANSLATION_FILTER	ExceptionTranslationFilter	http
FILTER_SECURITY_INTERCEPTOR	FilterSecurityInterceptor	http
SWITCH_USER_FILTER	SwitchUserFilter	N/A

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

二、Spring security filter作用

2.1 默認filter鏈

在程序啟動時會打印出如下日志，該日志打印出了默認的filter鏈和順序，其中SecurityContextPersistenceFilter為第一個filter，FilterSecurityInterceptor為最后一個filter。

2018-02-11 15:24:17,204  INFO DefaultSecurityFilterChain - Creating filter chain: 
org.springframework.security.web.util.matcher.AnyRequestMatcher@1, 
[org.springframework.security.web.context.SecurityContextPersistenceFilter@3cf3957d, 
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7ff34bd, 
org.springframework.security.web.header.HeaderWriterFilter@4dad11a2, 
org.springframework.security.web.authentication.logout.LogoutFilter@5be6ee89, 
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@5426eed3, 
org.springframework.security.web.savedrequest.RequestCacheAwareFilter@5da2a66c, 
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@23169e35, 
org.springframework.security.web.session.SessionManagementFilter@5b1627ea, 
org.springframework.security.web.access.ExceptionTranslationFilter@70b913f5, 
org.springframework.security.web.access.intercept.FilterSecurityInterceptor@2dfe7327]

2.2 默認filter鏈作用

默認有10條過濾鏈，下面逐個看下去。

2.2.1 /index.html at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'

SecurityContextPersistenceFilter 兩個主要職責：

a.請求到來時，通過HttpSessionSecurityContextRepository接口從Session中讀取SecurityContext，如果讀取結果為null，則創建之。

public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) {
        HttpServletRequest request = requestResponseHolder.getRequest();
        HttpServletResponse response = requestResponseHolder.getResponse();
        HttpSession httpSession = request.getSession(false);
        // 從session中獲取SecurityContext
        SecurityContext context = readSecurityContextFromSession(httpSession);

        if (context == null) {
            if (logger.isDebugEnabled()) {
                logger.debug("No SecurityContext was available from the HttpSession: "
                        + httpSession + ". " + "A new one will be created.");
            }
            // 未讀取到SecurityContext則新建一個SecurityContext
            context = generateNewContext();

        }

        SaveToSessionResponseWrapper wrappedResponse = new SaveToSessionResponseWrapper(
                response, request, httpSession != null, context);
        requestResponseHolder.setResponse(wrappedResponse);

        if (isServlet3) {
            requestResponseHolder.setRequest(new Servlet3SaveToSessionRequestWrapper(
                    request, wrappedResponse));
        }

        return context;
    }

獲得SecurityContext之后，會將其存入SecurityContextHolder，其中SecurityContextHolder默認是ThreadLocalSecurityContextHolderStrategy實例

private static void initialize() {
        if ((strategyName == null) || "".equals(strategyName)) {
            // Set default
            strategyName = MODE_THREADLOCAL;
        }

        if (strategyName.equals(MODE_THREADLOCAL)) {
            strategy = new ThreadLocalSecurityContextHolderStrategy();
        }
        // 以下內容省略
    }

ThreadLocalSecurityContextHolderStrategy中的ContextHolder定義如下，注意這是一個ThreadLocal變量，線程局部變量。

private static final ThreadLocal<SecurityContext> contextHolder = new ThreadLocal<SecurityContext>();

b.請求結束時清空SecurityContextHolder，並將SecurityContext保存到Session中。

finally {
            SecurityContext contextAfterChainExecution = SecurityContextHolder
                    .getContext();
            // Crucial removal of SecurityContextHolder contents - do this before anything
            // else.
            SecurityContextHolder.clearContext();
            repo.saveContext(contextAfterChainExecution, holder.getRequest(),
                    holder.getResponse());
            request.removeAttribute(FILTER_APPLIED);

            if (debug) {
                logger.debug("SecurityContextHolder now cleared, as request processing completed");
            }
        }

2.2.2 /index.html at position 2 of 10 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'

提供了對securityContext和WebAsyncManager的集成，其會把SecurityContext設置到異步線程中，使其也能獲取到用戶上下文認證信息。

@Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        WebAsyncManager asyncManager = WebAsyncUtils.getAsyncManager(request);

        SecurityContextCallableProcessingInterceptor securityProcessingInterceptor = (SecurityContextCallableProcessingInterceptor) asyncManager
                .getCallableInterceptor(CALLABLE_INTERCEPTOR_KEY);
        if (securityProcessingInterceptor == null) {
            asyncManager.registerCallableInterceptor(CALLABLE_INTERCEPTOR_KEY,
                    new SecurityContextCallableProcessingInterceptor());
        }

        filterChain.doFilter(request, response);
    }

2.2.3 /index.html at position 3 of 10 in additional filter chain; firing Filter: 'HeaderWriterFilter'

用來給http response添加一些Header，比如X-Frame-Options、X-XSS-Protection*、X-Content-Type-Options。

protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response, FilterChain filterChain)
                    throws ServletException, IOException {

        HeaderWriterResponse headerWriterResponse = new HeaderWriterResponse(request,
                response, this.headerWriters);
        try {
            filterChain.doFilter(request, headerWriterResponse);
        }
        finally {
                        // 向response header中添加header
            headerWriterResponse.writeHeaders();
        }
    }

2.2.4 /index.html at position 4 of 10 in additional filter chain; firing Filter: 'LogoutFilter'

處理退出登錄的Filter，如果請求的url為/logout則會執行退出登錄操作。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        // 判斷是否需要logout，判斷request url是否匹配/logout
        if (requiresLogout(request, response)) {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();

            if (logger.isDebugEnabled()) {
                logger.debug("Logging out user '" + auth
                        + "' and transferring to logout destination");
            }
            // 執行一系列的退出登錄操作
            for (LogoutHandler handler : handlers) {
                handler.logout(request, response, auth);
            }
            // 退出成功，執行logoutSuccessHandler進行重定向等操作
            logoutSuccessHandler.onLogoutSuccess(request, response, auth);

            return;
        }

        chain.doFilter(request, response);
    }

2.2.5 /index.html at position 5 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'

表單認證是最常用的一個認證方式，一個最直觀的業務場景便是允許用戶在表單中輸入用戶名和密碼進行登錄，而這背后的UsernamePasswordAuthenticationFilter，在整個Spring Security的認證體系中則扮演着至關重要的角色。

UsernamePasswordAuthenticationFilter是繼承自AbstractAuthenticationProcessingFilter。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        // 判斷是否需要執行登錄認證，判斷request url 是否能匹配/login
        if (!requiresAuthentication(request, response)) {
            chain.doFilter(request, response);

            return;
        }

        if (logger.isDebugEnabled()) {
            logger.debug("Request is to process authentication");
        }

        Authentication authResult;

        try {
            // UsernamePasswordAuthenticationFilter 實現該方法
            authResult = attemptAuthentication(request, response);
            if (authResult == null) {
                // 子類未完成認證，立即返回
                return;
            }
            sessionStrategy.onAuthentication(authResult, request, response);
        }
        // 在認證過程中拋出異常
        catch (InternalAuthenticationServiceException failed) {
            logger.error(
                    "An internal error occurred while trying to authenticate the user.",
                    failed);
            unsuccessfulAuthentication(request, response, failed);

            return;
        }
        catch (AuthenticationException failed) {
            // Authentication failed
            unsuccessfulAuthentication(request, response, failed);

            return;
        }

        // Authentication success
        if (continueChainBeforeSuccessfulAuthentication) {
            chain.doFilter(request, response);
        }

        successfulAuthentication(request, response, chain, authResult);
    }

在UsernamePasswordAuthenticationFilter中實現了類attemptAuthentication，不過該類只實現了一個非常簡化的版本，如果真的需要通過表單登錄，是需要自己繼承UsernamePasswordAuthenticationFilter並重載attemptAuthentication方法的。

在AbstractAuthenticationProcessingFilter的doFilter方法中一開始是判斷是否有必要進入到認證filter，這個過程其實是判斷request url是否匹配/login，當然也可以通過filterProcessesUrl屬性去配置匹配所使用的pattern。

2.2.6 /index.html at position 6 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'

將request存到session中，用於緩存request請求，可以用於恢復被登錄而打斷的請求

public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        // 從session中獲取與當前request匹配的緩存request，並將緩存request從session刪除
        HttpServletRequest wrappedSavedRequest = requestCache.getMatchingRequest(
                (HttpServletRequest) request, (HttpServletResponse) response);
        // 如果requestCache中緩存了request，則使用緩存的request
        chain.doFilter(wrappedSavedRequest == null ? request : wrappedSavedRequest,
                response);
    }

此處從session中取出request，存儲request是在ExceptionTranslationFilter中。具體可以參考探究 Spring Security 緩存請求

2.2.7 /index.html at position 7 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'

此過濾器對ServletRequest進行了一次包裝，使得request具有更加豐富的API

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        chain.doFilter(this.requestFactory.create((HttpServletRequest) req,
                (HttpServletResponse) res), res);
    }

2.2.8 /index.html at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter'

和session相關的過濾器，內部維護了一個SessionAuthenticationStrategy，兩者組合使用，常用來防止session-fixation protection attack，以及限制同一用戶開啟多個會話的數量

與登錄認證攔截時作用一樣，持久化用戶登錄信息，可以保存到session中，也可以保存到cookie或者redis中。

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        if (request.getAttribute(FILTER_APPLIED) != null) {
            chain.doFilter(request, response);
            return;
        }

        request.setAttribute(FILTER_APPLIED, Boolean.TRUE);

        if (!securityContextRepository.containsContext(request)) {
            Authentication authentication = SecurityContextHolder.getContext()
                    .getAuthentication();

            if (authentication != null && !trustResolver.isAnonymous(authentication)) {
                // The user has been authenticated during the current request, so call the
                // session strategy
                try {
                    sessionAuthenticationStrategy.onAuthentication(authentication,
                            request, response);
                }
                catch (SessionAuthenticationException e) {
                    // The session strategy can reject the authentication
                    logger.debug(
                            "SessionAuthenticationStrategy rejected the authentication object",
                            e);
                    SecurityContextHolder.clearContext();
                    failureHandler.onAuthenticationFailure(request, response, e);

                    return;
                }
                // Eagerly save the security context to make it available for any possible
                // re-entrant
                // requests which may occur before the current request completes.
                // SEC-1396.
                securityContextRepository.saveContext(SecurityContextHolder.getContext(),
                        request, response);
            }
            else {
                // No security context or authentication present. Check for a session
                // timeout
                if (request.getRequestedSessionId() != null
                        && !request.isRequestedSessionIdValid()) {
                    if (logger.isDebugEnabled()) {
                        logger.debug("Requested session ID "
                                + request.getRequestedSessionId() + " is invalid.");
                    }

                    if (invalidSessionStrategy != null) {
                        invalidSessionStrategy
                                .onInvalidSessionDetected(request, response);
                        return;
                    }
                }
            }
        }

        chain.doFilter(request, response);
    }

2.2.9 /index.html at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'

異常攔截，其處在Filter鏈后部分，只能攔截其后面的節點並且只處理AuthenticationException與AccessDeniedException兩個異常。

AuthenticationException指的是未登錄狀態下訪問受保護資源，AccessDeniedException指的是登陸了但是由於權限不足（比如普通用戶訪問管理員界面）。 

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        try {
            // 直接執行后面的filter，並捕獲異常
            chain.doFilter(request, response);

            logger.debug("Chain processed normally");
        }
        catch (IOException ex) {
            throw ex;
        }
        catch (Exception ex) {
            // 從異常堆棧中提取SpringSecurityException
            Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
            RuntimeException ase = (AuthenticationException) throwableAnalyzer
                    .getFirstThrowableOfType(AuthenticationException.class, causeChain);

            if (ase == null) {
                ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(
                        AccessDeniedException.class, causeChain);
            }

            if (ase != null) {
                // 處理異常
                handleSpringSecurityException(request, response, chain, ase);
            }
            else {
                // Rethrow ServletExceptions and RuntimeExceptions as-is
                if (ex instanceof ServletException) {
                    throw (ServletException) ex;
                }
                else if (ex instanceof RuntimeException) {
                    throw (RuntimeException) ex;
                }

                // Wrap other Exceptions. This shouldn't actually happen
                // as we've already covered all the possibilities for doFilter
                throw new RuntimeException(ex);
            }
        }
    }

在這個catch代碼中通過從異常堆棧中捕獲到Throwable[]，然后通過handleSpringSecurityException方法處理異常，在該方法中只會去處理AuthenticationException和AccessDeniedException異常。

    private void handleSpringSecurityException(HttpServletRequest request, HttpServletResponse response, FilterChain chain, RuntimeException exception) throws IOException, ServletException {
    
        if (exception instanceof AuthenticationException) {
            // 認證異常，由sendStartAuthentication方法發起認證過程
            logger.debug("Authentication exception occurred; redirecting to authentication entry point", exception);
            sendStartAuthentication(request, response, chain, (AuthenticationException) exception);
        } else if (exception instanceof AccessDeniedException) {
            // 訪問權限異常
            if (authenticationTrustResolver.isAnonymous(SecurityContextHolder.getContext().getAuthentication())) {
                logger.debug("Access is denied (user is anonymous); redirecting to authentication entry point", exception);
                // 匿名用戶重定向到認證入口點執行認證過程
                sendStartAuthentication(request, response, chain, new InsufficientAuthenticationException("Full authentication is required to access this resource"));
            } else {
                // 拒絕訪問，由accessDeniedHandler處理，response 403
                logger.debug("Access is denied (user is not anonymous); delegating to AccessDeniedHandler", exception);
                accessDeniedHandler.handle(request, response, (AccessDeniedException) exception);
            }
        }
    }

    protected void sendStartAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, AuthenticationException reason) throws ServletException, IOException {
        // SEC-112: Clear the SecurityContextHolder's Authentication, as the existing Authentication is no longer considered valid
        // 將SecurityContext中的Authentication置為null
        SecurityContextHolder.getContext().setAuthentication(null);
        // 在調用認證前先將request保存到session
        requestCache.saveRequest(request, response);
        logger.debug("Calling Authentication entry point.");
        // 重定向到認證入口點執行認證
        authenticationEntryPoint.commence(request, response, reason);
    }

2.2.10 /index.html at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'

 這個filter用於授權驗證。FilterSecurityInterceptor的工作流程引用一下，可以理解如下：FilterSecurityInterceptor從SecurityContextHolder中獲取Authentication對象，然后比對用戶擁有的權限和資源所需的權限。前者可以通過Authentication對象直接獲得，而后者則需要引入我們之前一直未提到過的兩個類：SecurityMetadataSource，AccessDecisionManager。

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(request, response, chain);
        invoke(fi);
    }
    
    
    public void invoke(FilterInvocation fi) throws IOException, ServletException {
        if ((fi.getRequest() != null) && (fi.getRequest().getAttribute(FILTER_APPLIED) != null) && observeOncePerRequest) {
            // filter already applied to this request and user wants us to observe
            // once-per-request handling, so don't re-do security checking
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
        } else {
            // first time this request being called, so perform security checking
            if (fi.getRequest() != null) {
                fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
            }

            InterceptorStatusToken token = super.beforeInvocation(fi);

            try {
                // 如果后面還有filter則繼續執行
                fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
            }
            finally {
                // 保存securityContext
                super.finallyInvocation(token);
            }

            super.afterInvocation(token, null);
        }
    }
    
    protected InterceptorStatusToken beforeInvocation(Object object) {
        Assert.notNull(object, "Object was null");
        final boolean debug = logger.isDebugEnabled();

        if (!getSecureObjectClass().isAssignableFrom(object.getClass())) {
            throw new IllegalArgumentException(
                    "Security invocation attempted for object "
                            + object.getClass().getName()
                            + " but AbstractSecurityInterceptor only configured to support secure objects of type: "
                            + getSecureObjectClass());
        }

        // 獲取配置的權限屬性
        Collection<ConfigAttribute> attributes = this.obtainSecurityMetadataSource().getAttributes(object);

        if (attributes == null || attributes.isEmpty()) {
            if (rejectPublicInvocations) {
                throw new IllegalArgumentException(
                        "Secure object invocation "
                                + object
                                + " was denied as public invocations are not allowed via this interceptor. "
                                + "This indicates a configuration error because the "
                                + "rejectPublicInvocations property is set to 'true'");
            }

            if (debug) {
                logger.debug("Public object - authentication not attempted");
            }

            publishEvent(new PublicInvocationEvent(object));

            return null; // no further work post-invocation
        }

        if (debug) {
            logger.debug("Secure object: " + object + "; Attributes: " + attributes);
        }

        if (SecurityContextHolder.getContext().getAuthentication() == null) {
            credentialsNotFound(messages.getMessage(
                    "AbstractSecurityInterceptor.authenticationNotFound",
                    "An Authentication object was not found in the SecurityContext"),
                    object, attributes);
        }

        // 獲取Authentication，如果沒有進行認證則認證后返回authentication
        Authentication authenticated = authenticateIfRequired();

        // Attempt authorization
        try {
            // 使用voter決策是否擁有資源需要的權限
            this.accessDecisionManager.decide(authenticated, object, attributes);
        } catch (AccessDeniedException accessDeniedException) {
            // 捕獲到異常繼續上拋
            publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated, accessDeniedException));
            throw accessDeniedException;
        }

        if (debug) {
            logger.debug("Authorization successful");
        }

        if (publishAuthorizationSuccess) {
            publishEvent(new AuthorizedEvent(object, attributes, authenticated));
        }

        // Attempt to run as a different user
        Authentication runAs = this.runAsManager.buildRunAs(authenticated, object,
                attributes);

        if (runAs == null) {
            if (debug) {
                logger.debug("RunAsManager did not change Authentication object");
            }

            // no further work post-invocation
            return new InterceptorStatusToken(SecurityContextHolder.getContext(), false,
                    attributes, object);
        }
        else {
            if (debug) {
                logger.debug("Switching to RunAs Authentication: " + runAs);
            }

            SecurityContext origCtx = SecurityContextHolder.getContext();
            SecurityContextHolder.setContext(SecurityContextHolder.createEmptyContext());
            SecurityContextHolder.getContext().setAuthentication(runAs);

            // need to revert to token.Authenticated post-invocation
            return new InterceptorStatusToken(origCtx, true, attributes, object);
        }
    }

參考文章：

https://blog.coding.net/blog/Explore-the-cache-request-of-Security-Spring

http://blog.didispace.com/xjf-spring-security-4/

http://blog.csdn.net/benjamin_whx/article/details/39204679