-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathspringsecurity.html
More file actions
4854 lines (4283 loc) · 294 KB
/
Copy pathspringsecurity.html
File metadata and controls
4854 lines (4283 loc) · 294 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE HTML>
<html lang="zh-CN">
<head><meta name="generator" content="Hexo 3.9.0">
<meta charset="utf-8">
<meta name="keywords" content="SpringSecurity, 记录">
<meta name="baidu-site-verification" content="fmlEuI34ir">
<meta name="google-site-verification" content="yCy2azpds5XSuGZvis6OuA-XIGF5GuGpYRAaGfD6o48">
<meta name="360-site-verification" content="b7c11a830ef90fd1464ad6206bb7b6e7">
<meta name="description" content="Spring SecuritySpring Security 的运行流程大致如下：
当用户发送一个请求到 Web 应用程序时，请求会被 Spring Security 的过滤器链（Filter Chain）拦截。
过滤器链中有多个过滤器，">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
<meta name="renderer" content="webkit|ie-stand|ie-comp">
<meta name="mobile-web-app-capable" content="yes">
<meta name="format-detection" content="telephone=no">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
<title>SpringSecurity | Ji`s Blog</title>
<link rel="icon" type="image/png" href="/favicon.png">
<link rel="stylesheet" type="text/css" href="/libs/awesome/css/font-awesome.min.css">
<link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
<link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
<link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
<link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
<link rel="stylesheet" type="text/css" href="/css/matery.css">
<link rel="stylesheet" type="text/css" href="/css/my.css">
<style type="text/css">
</style>
<script src="/libs/jquery/jquery-2.2.0.min.js"></script>
<script src="https://sdk.jinrishici.com/v2/browser/jinrishici.js" charset="utf-8"></script>
<script>
var _hmt = _hmt || [];
(function() {
var hm = document.createElement("script");
hm.src = "https://hm.baidu.com/hm.js?4d1d73af45a62734730491a6b6c41da4";
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(hm, s);
})();
</script>
<script>(function (i, s, o, g, r, a, m) {
i['DaoVoiceObject'] = r;
i[r] = i[r] ||
function () {
(i[r].q = i[r].q || []).push(arguments);
};
i[r].l = 1 * new Date();
a = s.createElement(o);
m = s.getElementsByTagName(o)[0];
a.async = 1;
a.src = g;
a.charset = 'utf-8';
m.parentNode.insertBefore(a, m);
})(window, document, 'script', ('https:' === document.location.protocol ? 'https:' : 'http:') + "//widget.daovoice.io/widget/xxx.js", 'daovoice');
daovoice('init', {
app_id: "xxx",
});
daovoice('update');
</script>
<script>
(function(){
var bp = document.createElement('script');
var curProtocol = window.location.protocol.split(':')[0];
if (curProtocol === 'https') {
bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
}
else {
bp.src = 'http://push.zhanzhang.baidu.com/push.js';
}
var s = document.getElementsByTagName("script")[0];
s.parentNode.insertBefore(bp, s);
})();
</script>
<script>
(function(){
var src = "https://jspassport.ssl.qhimg.com/11.0.1.js?d182b3f28525f2db83acfaaf6e696dba";
document.write('<script src="' + src + '" id="sozz"><\/script>');
})();
</script>
<meta name="baidu-site-verification" content>
<style type="text/css" lang="css">
#loading-container{
position: fixed;
top: 0;
left: 0;
min-height: 100vh;
width: 100vw;
z-index: 9999;
display: flex;
flex-direction: column;
justify-content: center;
align-items: center;
background: #FFF;
text-align: center;
/* loaderҳ����ʧ���ý����ķ�ʽ*/
-webkit-transition: opacity 1s ease;
-moz-transition: opacity 1s ease;
-o-transition: opacity 1s ease;
transition: opacity 1s ease;
}
.loading-image{
width: 120px;
height: 50px;
transform: translate(-50%);
}
.loading-image div:nth-child(2) {
-webkit-animation: pacman-balls 1s linear 0s infinite;
animation: pacman-balls 1s linear 0s infinite
}
.loading-image div:nth-child(3) {
-webkit-animation: pacman-balls 1s linear .33s infinite;
animation: pacman-balls 1s linear .33s infinite
}
.loading-image div:nth-child(4) {
-webkit-animation: pacman-balls 1s linear .66s infinite;
animation: pacman-balls 1s linear .66s infinite
}
.loading-image div:nth-child(5) {
-webkit-animation: pacman-balls 1s linear .99s infinite;
animation: pacman-balls 1s linear .99s infinite
}
.loading-image div:first-of-type {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_up .5s 0s infinite;
animation: rotate_pacman_half_up .5s 0s infinite;
}
.loading-image div:nth-child(2) {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_down .5s 0s infinite;
animation: rotate_pacman_half_down .5s 0s infinite;
margin-top: -50px;
}
@-webkit-keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@-webkit-keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@-webkit-keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
@keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
.loading-image div:nth-child(3),
.loading-image div:nth-child(4),
.loading-image div:nth-child(5),
.loading-image div:nth-child(6){
background-color: #49b1f5;
width: 15px;
height: 15px;
border-radius: 100%;
margin: 2px;
width: 10px;
height: 10px;
position: absolute;
transform: translateY(-6.25px);
top: 25px;
left: 100px;
}
.loading-text{
margin-bottom: 20vh;
text-align: center;
color: #2c3e50;
font-size: 2rem;
box-sizing: border-box;
padding: 0 10px;
text-shadow: 0 2px 10px rgba(0,0,0,0.2);
}
@media only screen and (max-width: 500px) {
.loading-text{
font-size: 1.5rem;
}
}
.fadeout {
opacity: 0;
filter: alpha(opacity=0);
}
/* logo���ֶ��� */
@-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}100%{opacity:1;-webkit-transform:none;transform:none}}
@keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);}}
</style>
<script>
(function () {
const loaded = function(){
setTimeout(function(){
const loader = document.getElementById("loading-container");
loader.className="fadeout" ;//ʹ�ý����ķ�������loading page
// document.getElementById("body-wrap").style.display="flex";
setTimeout(function(){
loader.style.display="none";
},1000);
},1000);//ǿ����ʾloading page 1s
};
loaded();
})()
</script><link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css">
<link rel="stylesheet" href="/css/prism-line-numbers.css" type="text/css"><style type="text/css" lang="css">
#loading-container{
position: fixed;
top: 0;
left: 0;
min-height: 100vh;
width: 100vw;
z-index: 9999;
display: flex;
flex-direction: column;
justify-content: center;
align-items: center;
background: #FFF;
text-align: center;
/* loaderҳ����ʧ���ý����ķ�ʽ*/
-webkit-transition: opacity 1s ease;
-moz-transition: opacity 1s ease;
-o-transition: opacity 1s ease;
transition: opacity 1s ease;
}
.loading-image{
width: 120px;
height: 50px;
transform: translate(-50%);
}
.loading-image div:nth-child(2) {
-webkit-animation: pacman-balls 1s linear 0s infinite;
animation: pacman-balls 1s linear 0s infinite
}
.loading-image div:nth-child(3) {
-webkit-animation: pacman-balls 1s linear .33s infinite;
animation: pacman-balls 1s linear .33s infinite
}
.loading-image div:nth-child(4) {
-webkit-animation: pacman-balls 1s linear .66s infinite;
animation: pacman-balls 1s linear .66s infinite
}
.loading-image div:nth-child(5) {
-webkit-animation: pacman-balls 1s linear .99s infinite;
animation: pacman-balls 1s linear .99s infinite
}
.loading-image div:first-of-type {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_up .5s 0s infinite;
animation: rotate_pacman_half_up .5s 0s infinite;
}
.loading-image div:nth-child(2) {
width: 0;
height: 0;
border: 25px solid #49b1f5;
border-right-color: transparent;
border-radius: 25px;
-webkit-animation: rotate_pacman_half_down .5s 0s infinite;
animation: rotate_pacman_half_down .5s 0s infinite;
margin-top: -50px;
}
@-webkit-keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@keyframes rotate_pacman_half_up {0% {transform: rotate(270deg)}50% {transform: rotate(1turn)}to {transform: rotate(270deg)}}
@-webkit-keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@keyframes rotate_pacman_half_down {0% {transform: rotate(90deg)}50% {transform: rotate(0deg)}to {transform: rotate(90deg)}}
@-webkit-keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
@keyframes pacman-balls {75% {opacity: .7}to {transform: translate(-100px, -6.25px)}}
.loading-image div:nth-child(3),
.loading-image div:nth-child(4),
.loading-image div:nth-child(5),
.loading-image div:nth-child(6){
background-color: #49b1f5;
width: 15px;
height: 15px;
border-radius: 100%;
margin: 2px;
width: 10px;
height: 10px;
position: absolute;
transform: translateY(-6.25px);
top: 25px;
left: 100px;
}
.loading-text{
margin-bottom: 20vh;
text-align: center;
color: #2c3e50;
font-size: 2rem;
box-sizing: border-box;
padding: 0 10px;
text-shadow: 0 2px 10px rgba(0,0,0,0.2);
}
@media only screen and (max-width: 500px) {
.loading-text{
font-size: 1.5rem;
}
}
.fadeout {
opacity: 0;
filter: alpha(opacity=0);
}
/* logo���ֶ��� */
@-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}100%{opacity:1;-webkit-transform:none;transform:none}}
@keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);}}
</style>
<script>
(function () {
const loaded = function(){
setTimeout(function(){
const loader = document.getElementById("loading-container");
loader.className="fadeout" ;//ʹ�ý����ķ�������loading page
// document.getElementById("body-wrap").style.display="flex";
setTimeout(function(){
loader.style.display="none";
},1000);
},1000);//ǿ����ʾloading page 1s
};
loaded();
})()
</script></head>
<div id="loading-container">
<p class="loading-text"></p>
<div class="loading-image">
<div></div>
<div></div>
<div></div>
<div></div>
<div></div>
</div>
</div><body>
<header class="navbar-fixed">
<nav id="headNav" class="bg-color nav-transparent">
<div id="navContainer" class="nav-wrapper container">
<div class="brand-logo">
<a href="/" class="waves-effect waves-light">
<img src="/medias/logo.png" class="logo-img" alt="LOGO">
<span class="logo-span">Ji`s Blog</span>
</a>
</div>
<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fa fa-navicon"></i></a>
<ul class="right">
<li class="hide-on-med-and-down">
<a href="/" class="waves-effect waves-light">
<span>首页</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/tags" class="waves-effect waves-light">
<span>标签</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/categories" class="waves-effect waves-light">
<span>分类</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/archives" class="waves-effect waves-light">
<span>归档</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/about" class="waves-effect waves-light">
<span>关于</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/friends" class="waves-effect waves-light">
<span>友情链接</span>
</a>
</li>
<li class="hide-on-med-and-down">
<a href="/contact" class="waves-effect waves-light">
<span>留言板</span>
</a>
</li>
<li>
<a href="#searchModal" class="modal-trigger waves-effect waves-light">
<i id="searchIcon" class="fa fa-search" title="搜索"></i>
</a>
</li>
</ul>
<div id="mobile-nav" class="side-nav sidenav">
<div class="mobile-head bg-color">
<img src="/medias/logo.png" class="logo-img circle responsive-img">
<div class="logo-name">Ji`s Blog</div>
<div class="logo-desc">
Java | Spring | Redis
</div>
</div>
<ul class="menu-list mobile-menu-list">
<li>
<a href="/" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
首页
</a>
</li>
<li>
<a href="/tags" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
标签
</a>
</li>
<li>
<a href="/categories" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
分类
</a>
</li>
<li>
<a href="/archives" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
归档
</a>
</li>
<li>
<a href="/about" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
关于
</a>
</li>
<li>
<a href="/friends" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
友情链接
</a>
</li>
<li>
<a href="/contact" class="waves-effect waves-light">
<i class="fa fa-fw fa-link"></i>
留言板
</a>
</li>
<li><div class="divider"></div></li>
<li>
<a href="https://github.com/jiyongg-code" class="waves-effect waves-light" target="_blank">
<i class="fa fa-github-square fa-fw"></i>Fork Me
</a>
</li>
</ul>
</div>
</div>
<style>
.nav-transparent .github-corner {
display: none !important;
}
.github-corner {
position: absolute;
z-index: 10;
top: 0;
right: 0;
border: 0;
transform: scale(1.1);
}
.github-corner svg {
color: #0f9d58;
fill: #fff;
height: 64px;
width: 64px;
}
.github-corner:hover .octo-arm {
animation: a 0.56s ease-in-out;
}
.github-corner .octo-arm {
animation: none;
}
@keyframes a {
0%,
to {
transform: rotate(0);
}
20%,
60% {
transform: rotate(-25deg);
}
40%,
80% {
transform: rotate(10deg);
}
}
</style>
<a href="https://github.com/jiyongg-code" class="github-corner tooltipped hide-on-med-and-down" target="_blank"
data-tooltip="Fork Me" data-position="left" data-delay="50">
<svg viewBox="0 0 250 250" aria-hidden="true">
<path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path>
<path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2"
fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path>
<path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z"
fill="currentColor" class="octo-body"></path>
</svg>
</a>
</nav>
</header>
<script src="/libs/cryptojs/crypto-js.min.js"></script>
<script>
(function() {
let pwd = '';
if (pwd && pwd.length > 0) {
if (pwd !== CryptoJS.SHA256(prompt('请输入访问本文章的密码')).toString(CryptoJS.enc.Hex)) {
alert('密码错误，将返回主页！');
location.href = '/';
}
}
})();
</script>
<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/7.jpg')">
<div class="container">
<div class="row">
<div class="col s12 m12 l12">
<div class="brand">
<div class="description center-align post-title">
SpringSecurity
</div>
</div>
</div>
</div>
</div>
</div>
<main class="post-container content">
<link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
#articleContent h1::before,
#articleContent h2::before,
#articleContent h3::before,
#articleContent h4::before,
#articleContent h5::before,
#articleContent h6::before {
display: block;
content: " ";
height: 100px;
margin-top: -100px;
visibility: hidden;
}
#articleContent :focus {
outline: none;
}
.toc-fixed {
position: fixed;
top: 64px;
}
.toc-widget {
padding-left: 20px;
}
.toc-widget .toc-title {
margin: 35px 0 15px 0;
padding-left: 17px;
font-size: 1.5rem;
font-weight: bold;
line-height: 1.5rem;
}
.toc-widget ol {
padding: 0;
list-style: none;
}
#toc-content ol {
padding-left: 10px;
}
#toc-content ol li {
padding-left: 10px;
}
#toc-content .toc-link:hover {
color: #42b983;
font-weight: 700;
text-decoration: underline;
}
#toc-content .toc-link::before {
background-color: transparent;
max-height: 25px;
}
#toc-content .is-active-link {
color: #42b983;
}
#toc-content .is-active-link::before {
background-color: #42b983;
}
#floating-toc-btn {
position: fixed;
right: 20px;
bottom: 76px;
padding-top: 15px;
margin-bottom: 0;
z-index: 998;
}
#floating-toc-btn .btn-floating {
width: 48px;
height: 48px;
}
#floating-toc-btn .btn-floating i {
line-height: 48px;
font-size: 1.4rem;
}
</style>
<div class="row">
<div id="main-content" class="col s12 m12 l9">
<!-- 文章内容详情 -->
<div id="artDetail">
<div class="card">
<div class="card-content article-info">
<div class="row tag-cate">
<div class="col s7">
<div class="article-tag">
<a href="/tags/SpringSecuritt/" target="_blank">
<span class="chip bg-color">SpringSecuritt</span>
</a>
</div>
</div>
<div class="col s5 right-align">
<div class="post-cate">
<i class="fa fa-bookmark fa-fw icon-category"></i>
<a href="/categories/Auth/" class="post-category" target="_blank">
Auth
</a>
</div>
</div>
</div>
<div class="post-info">
<div class="post-date info-break-policy">
<i class="fa fa-calendar-minus-o fa-fw"></i>发布日期:
2023-03-22
</div>
<div class="post-author info-break-policy">
<i class="fa fa-user-o fa-fw"></i>作者:
jiyonggang
</div>
<div class="info-break-policy">
<i class="fa fa-file-word-o fa-fw"></i>文章字数:
26k
</div>
<div class="info-break-policy">
<i class="fa fa-clock-o fa-fw"></i>阅读时长:
111 分
</div>
<div id="busuanzi_container_page_pv" class="info-break-policy">
<i class="fa fa-eye fa-fw"></i>阅读次数:
<span id="busuanzi_value_page_pv"></span>
</div>
</div>
</div>
<hr class="clearfix">
<div class="card-content article-card-content">
<div id="articleContent">
<h1 id="Spring-Security"><a href="#Spring-Security" class="headerlink" title="Spring Security"></a>Spring Security</h1><p>Spring Security 的运行流程大致如下：</p>
<ul>
<li>当用户发送一个请求到 Web 应用程序时，请求会被 Spring Security 的过滤器链（Filter Chain）拦截。</li>
<li>过滤器链中有多个过滤器，每个过滤器负责处理不同的安全逻辑，如用户名密码认证、记住我功能、异常处理等。</li>
<li>如果请求需要身份验证，过滤器链会调用 AuthenticationManager 接口，该接口是认证管理器的核心接口，它委托给不同的 AuthenticationProvider 实现类来完成具体的认证逻辑。</li>
<li>AuthenticationProvider 会调用 UserDetailsService 接口，该接口负责从数据库或其他数据源获取用户的详细信息（UserDetails），如用户名、密码、角色等。</li>
<li>AuthenticationProvider 会比较用户输入的密码和 UserDetailsService 返回的密码是否匹配，如果匹配，认证成功，返回一个 Authentication 对象，该对象包含了用户的身份信息和权限信息。</li>
<li>过滤器链会将 Authentication 对象存储到 SecurityContextHolder 中，该类是一个全局的安全上下文容器，可以在任何地方访问当前用户的安全信息。</li>
<li>如果请求需要授权，过滤器链会调用 AccessDecisionManager 接口，该接口是授权管理器的核心接口，它根据不同的授权策略（如基于角色、基于资源等）来决定用户是否有权限访问请求的资源。</li>
<li>AccessDecisionManager 会调用 SecurityMetadataSource 接口，该接口负责获取请求资源所需的权限信息。</li>
<li>AccessDecisionManager 会比较 SecurityContextHolder 中的用户权限信息和 SecurityMetadataSource 返回的资源权限信息是否匹配，如果匹配，授权成功，放行请求，否则抛出异常或重定向到错误页面。</li>
</ul>
<h1 id="AbstractAuthenticationToken"><a href="#AbstractAuthenticationToken" class="headerlink" title="AbstractAuthenticationToken"></a>AbstractAuthenticationToken</h1><p>在Spring Security认证过程中，AbstractAuthenticationToken是一个非常重要的类，它主要用于存储和管理主体的各种信息，以及主体经过认证后的相关信息。</p>
<p>它是一个基础类，可以用来扩展和定制自己的Authentication对象。在AbstractAuthenticationToken中，一般会存储一些如主体信息（principal）和凭证（credentials）等基础数据。</p>
<p>我们可以从AbstractAuthenticationToken类中继承并创建自己的Authentication对象，比如在上面的代码片段中，MyUserNamePassToken就是继承了AbstractAuthenticationToken的一个具体应用。在这个例子中，我们在自定义的Authentication对象中，存储了用户名（account）和密码（pwd），并且在登录成功后，这些信息会被传递给MyAuthenticationSuccessHandler进行处理。</p>
<p>需要注意的是，在Spring Security中，Authentication对象的认证状态是由isAuthenticated()方法来设定的，如果该方法返回true，表示认证通过，反之则表示认证未通过。在上述代码中，我们在创建MyUserNamePassToken对象时，通过调用setAuthenticated(false)方法，设定了认证状态为未通过，这表示用户在登录过程中还需要进行进一步的认证。</p>
<p>总的来说，AbstractAuthenticationToken为我们提供了一个扩展和自定义Authentication对象的基类，使我们能够更灵活地处理登录过程中的各种逻辑和信息。</p>
<p>Spring Security 采用的是责任链的设计模式，它有一条很长的过滤器链。</p>
<p>Spring Security对Web资源的保护是靠Filter实现的</p>
<p>当初始化Spring Security时，会创建一个名为SpringSecurityFilterChain的Servlet过滤器，类型为 org.springframework.security.web.FilterChainProxy，它实现了javax.servlet.Filter，因此外部的请求会经过此类，<img src="/springsecurity/image-20230325122446975.png" alt="image-20230325122446975"></p>
<p>FilterChainProxy是一个代理，真正起作用的是FilterChainProxy中SecurityFilterChain所包含的各个Filter，同时这些Filter作为Bean被Spring管理，它们是Spring Security核心，各有各的职责，但他们并不直接处理用户的<strong>认证</strong>，也不直接处理用户的<strong>授权</strong>，而是把它们交给了认证管理器（AuthenticationManager）和决策管理器（AccessDecisionManager）进行处理。</p>
<p>spring Security功能的实现主要是由一系列过滤器链相互配合完成。</p>
<p>密码登录流程</p>
<ul>
<li><p>UsernamePasswordAuthenticationFilter：它是一个类，继承了AbstractAuthenticationProcessingFilter，用于处理表单登录请求。它会从请求中获取用户名和密码，然后使用UsernamePasswordAuthenticationToken构造一个认证请求对象，然后交给AuthenticationManager进行认证。</p>
</li>
<li><p>AuthenticationManager：它是一个接口，用于管理认证逻辑，它的authenticate方法接受一个Authentication对象作为参数，然后返回一个认证成功的Authentication对象或者抛出一个认证异常。它的默认实现类是ProviderManager。</p>
</li>
<li><p>ProviderManager：它是一个类，实现了AuthenticationManager接口，它管理一系列的AuthenticationProvider，每个AuthenticationProvider负责处理一种类型的认证请求，例如用户名密码、短信验证码、社交账号等。ProviderManager会遍历所有的AuthenticationProvider，找到能够支持当前认证请求的那个，然后调用它的authenticate方法进行认证。</p>
</li>
<li><p>DaoAuthenticationProvider：它是一个类，实现了AuthenticationProvider接口，它负责处理用户名密码的认证请求。它会调用UserDetailsService接口的loadUserByUsername方法根据用户名加载用户信息，包括密码和权限。然后它会调用PasswordEncoder接口的matches方法对比用户输入的密码和数据库中的密码是否匹配。如果匹配成功，就返回一个认证成功的UsernamePasswordAuthenticationToken对象。</p>
</li>
<li><p>UserDetailsService：它是一个接口，用于根据用户名加载用户信息，包括密码和权限。它的loadUserByUsername方法接受一个用户名作为参数，然后返回一个UserDetails对象或者抛出一个用户不存在的异常。它有多个实现类，例如JdbcUserDetailsManager、InMemoryUserDetailsManager等。</p>
</li>
<li><p>PasswordEncoder：它是一个接口，用于对密码进行加密和匹配。它的encode方法接受一个明文密码作为参数，然后返回一个加密后的密码。它的matches方法接受一个明文密码和一个加密后的密码作为参数，然后返回一个布尔值表示是否匹配。它有多个实现类，例如BCryptPasswordEncoder、NoOpPasswordEncoder等。</p>
</li>
</ul>
<h1 id="SpringSecurity执行流程图"><a href="#SpringSecurity执行流程图" class="headerlink" title="SpringSecurity执行流程图"></a>SpringSecurity执行流程图</h1><p><img src="/springsecurity/d359fe34bc7860c11a1b6e50bfd0e086.png" alt="img"></p>
<ol>
<li><p>WebAsyncManagerIntegrationFilter：将 Security 上下文与 Spring Web 中用于处理异步请求映射的 WebAsyncManager 进行集成。</p>
</li>
<li><p>SecurityContextPersistenceFilter：在每次请求处理之前将该请求相关的安全上下文信息加载到 SecurityContextHolder 中，然后在该次请求处理完成之后，将 SecurityContextHolder 中关于这次请求的信息存储到一个“仓储”中，然后将 SecurityContextHolder 中的信息清除，例如在Session中维护一个用户的安全信息就是这个过滤器处理的。默认是将SecurityContext存储在threadlocal中，可能是spring考虑到目前大多数为BS应用，一个应用同时可能有多个使用者，每个使用者又对应不同的安全上下，Security Context Holder为了保存这些安全上下文。</p>
</li>
<li><p>HeaderWriterFilter：用于将头信息加入响应中。</p>
</li>
<li><p>CsrfFilter：用于处理跨站请求伪造。</p>
</li>
<li><p>LogoutFilter：用于处理退出登录。</p>
</li>
<li><p>UsernamePasswordAuthenticationFilter：用于处理基于表单的登录请求，从表单中获取用户名和密码。默认情况下处理来自 /login 的请求。从表单中获取用户名和密码时，默认使用的表单 name 值为 username 和 password，这两个值可以通过设置这个过滤器的usernameParameter 和 passwordParameter 两个参数的值进行修改。</p>
</li>
<li><p>DefaultLoginPageGeneratingFilter：如果没有配置登录页面，那系统初始化时就会配置这个过滤器，并且用于在需要进行登录时生成一个登录表单页面。</p>
</li>
<li><p>BasicAuthenticationFilter：检测和处理 http basic 认证。</p>
</li>
<li><p>RequestCacheAwareFilter：用来处理请求的缓存。</p>
</li>
<li><p>SecurityContextHolderAwareRequestFilter：主要是包装请求对象request。</p>
</li>
<li><p>AnonymousAuthenticationFilter：检测 SecurityContextHolder 中是否存在 Authentication 对象，如果不存在为其提供一个匿名 Authentication。</p>
</li>
<li><p>SessionManagementFilter：管理 session 的过滤器</p>
</li>
<li><p>ExceptionTranslationFilter：处理 AccessDeniedException 和 AuthenticationException 异常。</p>
</li>
<li><p>FilterSecurityInterceptor：可以看做过滤器链的出口。</p>
</li>
<li><p>RememberMeAuthenticationFilter：当用户没有登录而直接访问资源时, 从 cookie 里找出用户的信息, 如果 Spring Security 能够识别出用户提供的remember me cookie, 用户将不必填写用户名和密码, 而是直接登录进入系统，该过滤器默认不开启。</p>
</li>
</ol>
<h1 id="流程说明"><a href="#流程说明" class="headerlink" title="流程说明"></a>流程说明</h1><p>客户端发起一个请求，进入 Security 过滤器链。</p>
<p>当到 LogoutFilter 的时候判断是否是登出路径，如果是登出路径则到 logoutHandler ，如果登出成功则到 logoutSuccessHandler 登出成功处理，如果登出失败则由 ExceptionTranslationFilter ；如果不是登出路径则直接进入下一个过滤器。</p>
<p>当到 UsernamePasswordAuthenticationFilter 的时候判断是否为登录路径，如果是，则进入该过滤器进行登录操作，如果登录失败则到 AuthenticationFailureHandler 登录失败处理器处理，如果登录成功则到 AuthenticationSuccessHandler 登录成功处理器处理，如果不是登录请求则不进入该过滤器。</p>
<p>当到 FilterSecurityInterceptor 的时候会拿到 uri ，根据 uri 去找对应的鉴权管理器，鉴权管理器做鉴权工作，鉴权成功则到 Controller 层否则到 AccessDeniedHandler 鉴权失败处理器处理。</p>
<h1 id="配置类"><a href="#配置类" class="headerlink" title="配置类"></a>配置类</h1><p>WebSecurityConfigurerAdapte 这个类将在5.7版本被<code>@Deprecated</code>所标记了，未来这个类将被移除。</p>
<pre class="line-numbers language-java"><code class="language-java"><span class="token annotation punctuation">@Configuration</span>
<span class="token annotation punctuation">@EnableWebSecurity</span>
<span class="token keyword">public</span> <span class="token keyword">class</span> <span class="token class-name">SecurityConfig</span> <span class="token keyword">extends</span> <span class="token class-name">WebSecurityConfigurerAdapter</span> <span class="token punctuation">{</span>
<span class="token annotation punctuation">@Override</span>
<span class="token keyword">protected</span> <span class="token keyword">void</span> <span class="token function">configure</span><span class="token punctuation">(</span>AuthenticationManagerBuilder auth<span class="token punctuation">)</span> <span class="token keyword">throws</span> Exception <span class="token punctuation">{</span>
auth<span class="token punctuation">.</span><span class="token function">userDetailsService</span><span class="token punctuation">(</span>userDetailService<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">passwordEncoder</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">BCryptPasswordEncoder</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token comment" spellcheck="true">//认证提供者</span>
<span class="token punctuation">}</span>
<span class="token annotation punctuation">@Override</span>
<span class="token keyword">public</span> <span class="token keyword">void</span> <span class="token function">configure</span><span class="token punctuation">(</span>WebSecurity web<span class="token punctuation">)</span> <span class="token keyword">throws</span> Exception <span class="token punctuation">{</span>
web<span class="token punctuation">.</span><span class="token function">ignoring</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">antMatchers</span><span class="token punctuation">(</span><span class="token string">"/resources/**/*.html"</span><span class="token punctuation">,</span> <span class="token string">"/resources/**/*.js"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token annotation punctuation">@Override</span>
<span class="token keyword">protected</span> <span class="token keyword">void</span> <span class="token function">configure</span><span class="token punctuation">(</span>HttpSecurity http<span class="token punctuation">)</span> <span class="token keyword">throws</span> Exception <span class="token punctuation">{</span>
http
<span class="token punctuation">.</span><span class="token function">formLogin</span><span class="token punctuation">(</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">loginPage</span><span class="token punctuation">(</span><span class="token string">"/login_page"</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">passwordParameter</span><span class="token punctuation">(</span><span class="token string">"username"</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">passwordParameter</span><span class="token punctuation">(</span><span class="token string">"password"</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">loginProcessingUrl</span><span class="token punctuation">(</span><span class="token string">"/sign_in"</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">permitAll</span><span class="token punctuation">(</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">and</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">authorizeRequests</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">antMatchers</span><span class="token punctuation">(</span><span class="token string">"/test"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">hasRole</span><span class="token punctuation">(</span><span class="token string">"test"</span><span class="token punctuation">)</span> <span class="token comment" spellcheck="true">//权限设置</span>
<span class="token punctuation">.</span><span class="token function">anyRequest</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">authenticated</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">accessDecisionManager</span><span class="token punctuation">(</span><span class="token function">accessDecisionManager</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">and</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">logout</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">logoutUrl</span><span class="token punctuation">(</span><span class="token string">"/logout"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">logoutSuccessHandler</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">MyLogoutSuccessHandler</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>
<span class="token punctuation">.</span><span class="token function">and</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">csrf</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">disable</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
http<span class="token punctuation">.</span><span class="token function">addFilterAt</span><span class="token punctuation">(</span><span class="token function">getAuthenticationFilter</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">,</span>UsernamePasswordAuthenticationFilter<span class="token punctuation">.</span><span class="token keyword">class</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
http<span class="token punctuation">.</span><span class="token function">exceptionHandling</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">accessDeniedHandler</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">MyAccessDeniedHandler</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
http<span class="token punctuation">.</span><span class="token function">addFilterAfter</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">MyFittler</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">,</span> LogoutFilter<span class="token punctuation">.</span><span class="token keyword">class</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span>
<span class="token punctuation">}</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>
<p>配置介绍</p>
<p>@EnableWebSecurity</p>
<p> 加载了WebSecurityConfiguration配置类, 配置安全认证策略。2: 加载了AuthenticationConfiguration, 配置了认证信息。</p>
<h2 id="configure-AuthenticationManagerBuilder-auth"><a href="#configure-AuthenticationManagerBuilder-auth" class="headerlink" title="configure(AuthenticationManagerBuilder auth)"></a>configure(AuthenticationManagerBuilder auth)</h2><p>AuthenticationManager 的建造器，配置 AuthenticationManagerBuilder 会让Security 自动构建一个 AuthenticationManager（该类的功能参考流程图）；</p>
<p>该接口的作用是对用户的未授信凭据进行认证，认证通过则返回授信状态的凭据，否则将抛出认证异常。</p>
<p>如果想要使用该功能需要配置一个 UserDetailService 和 PasswordEncoder。UserDetailsService 用于在认证器中根据用户传过来的用户名查找一个用户， PasswordEncoder 用于密码的加密与比对，我们存储用户密码的时候用PasswordEncoder.encode() 加密存储，在认证器里会调用 PasswordEncoder.matches() 方法进行密码比对。</p>
<p>如果重写了该方法，Security 会启用 DaoAuthenticationProvider 这个认证器，该认证就是先调用 UserDetailsService.loadUserByUsername 然后使用 PasswordEncoder.matches() 进行密码比对，如果认证成功成功则返回一个 Authentication 对象。</p>
<p>DaoAuthenticationProvider 实现了 AuthenticationProvider（鉴定提供者）</p>
<h2 id="configure-WebSecurity-web"><a href="#configure-WebSecurity-web" class="headerlink" title="configure(WebSecurity web)"></a>configure(WebSecurity web)</h2><p>这个配置方法用于配置静态资源的处理方式，可使用 Ant 匹配规则。</p>
<h2 id="configure-HttpSecurity-http"><a href="#configure-HttpSecurity-http" class="headerlink" title="configure(HttpSecurity http)"></a>configure(HttpSecurity http)</h2><pre><code>http
.formLogin()
.loginPage("/login_page")
.passwordParameter("username")
.passwordParameter("password")
.loginProcessingUrl("/sign_in")
.permitAll()</code></pre><p>这是配置登录相关的操作从方法名可知，</p>
<p>配置了登录页请求路径.loginPage(“/login_page”)，</p>
<p>密码属性名，.passwordParameter(“username”) </p>
<p>用户名属性名， .passwordParameter(“username”) </p>
<p>登录请求路径，.loginProcessingUrl(“/sign_in”) //就是验证成功后转跳的页面</p>
<p>permitAll()代表任意用户可访问。</p>
<pre><code>http
.authorizeRequests()
.antMatchers("/test").hasRole("test")
.anyRequest().authenticated()
.accessDecisionManager(accessDecisionManager());</code></pre><p>以上配置是权限相关的配置，</p>
<p>配置了一个 <code>/test</code> url 该有什么权限才能访问， </p>
<p>anyRequest() 表示所有请求，</p>
<p>authenticated() 表示已登录用户才能访问， </p>
<p>accessDecisionManager() 表示绑定在 url 上的鉴权管理器</p>
<pre><code>http
.logout()
.logoutUrl("/logout")
.logoutSuccessHandler(new MyLogoutSuccessHandler())</code></pre><p>登出相关配置，这里配置了登出 url 和登出成功处理器</p>
<pre><code>http
.exceptionHandling()
.accessDeniedHandler(new MyAccessDeniedHandler());</code></pre><p>代码是配置鉴权失败的处理器</p>
<pre><code>http.addFilterAfter(new MyFittler(), LogoutFilter.class);
http.addFilterAt(getAuthenticationFilter(),UsernamePasswordAuthenticationFilter.class);</code></pre><p>上面代码展示如何在过滤器链中插入自己的过滤器，addFilterBefore 加在对应的过滤器之前，addFilterAfter 加在对应的过滤器之后，addFilterAt 加在过滤器同一位置，事实上框架原有的 Filter 在启动 HttpSecurity 配置的过程中，都由框架完成了其一定程度上固定的配置，是不允许更改替换的。根据测试结果来看，调用 addFilterAt 方法插入的 Filter ，会在这个位置上的原有 Filter 之前执行。</p>
<p>注：关于 HttpSecurity 使用的是链式编程，其中 http.xxxx.and.yyyyy 这种写法和 http.xxxx;http.yyyy 写法意义一样。</p>
<ul>
<li>自定义 AuthenticationManager 认证管理器 和 AccessDecisionManager 访问决策管理器</li>
</ul>
<p>重写 authenticationManagerBean() 方法，并构造一个 authenticationManager：</p>
<pre><code>@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
ProviderManager authenticationManager = new ProviderManager(Arrays.asLis(getMyAuthenticationProvider(),daoAuthenticationProvider()));
return authenticationManager;
}</code></pre><p>authenticationManager 配置了两个认证器</p>
<pre><code>public AccessDecisionManager accessDecisionManager(){
List<AccessDecisionVoter<? extends Object>> decisionVoters
= Arrays.asList(
new MyExpressionVoter(),
new WebExpressionVoter(),
new RoleVoter(),
new AuthenticatedVoter());
return new UnanimousBased(decisionVoters);
}</code></pre><p>投票管理器会收集投票器投票结果做统计，最终结果大于等于0代表通过；每个投票器会返回三个结果：-1（反对），0（通过），1（赞成）。</p>
<h1 id="Security-权限系统"><a href="#Security-权限系统" class="headerlink" title="Security 权限系统"></a>Security 权限系统</h1><h2 id="UserDetails"><a href="#UserDetails" class="headerlink" title="UserDetails"></a>UserDetails</h2><p>该接口是提供用户<strong>信息</strong>的核心接口。该接口实现仅仅存储用户的信息。后续会将该接口提供的用户信息封装到认证对象<code>Authentication</code>中去。</p>
<p><code>UserDetails</code> 默认提供了：</p>
<ul>
<li>用户的权限集， 默认需要添加<code>ROLE_</code> 前缀</li>
<li>用户的加密后的密码， 不加密会使用<code>{noop}</code>前缀</li>
<li>应用内唯一的用户名</li>
<li>账户是否过期</li>
<li>账户是否锁定</li>
<li>凭证是否过期</li>
<li>用户是否可用</li>
</ul>
<p>如果以上的信息满足不了使用，可以自行实现扩展以存储更多的用户信息。比如用户的邮箱、手机号等等。通常使用其实现类</p>
<pre><code>org.springframework.security.core.userdetails.User</code></pre><p>该类内置一个建造器<code>UserBuilder</code> 会很方便地构建<code>UserDetails</code> 对象。</p>
<h2 id="GrantedAuthority"><a href="#GrantedAuthority" class="headerlink" title="GrantedAuthority"></a>GrantedAuthority</h2><pre><code>public interface GrantedAuthority extends Serializable {
String getAuthority();
}</code></pre><p><img src="/springsecurity/image-20230323174655629.png" alt="image-20230323174655629"></p>
<p>自带了三个实现类</p>
<p>Security 中的用户权限接口，自定义权限需要实现该接口:</p>
<pre><code>public class MyGrantedAuthority implements GrantedAuthority {
private String authority;
}</code></pre><p>authority 表示权限字段，需要注意的是在 config 中配置的权限会被加上 ROLE_ 前缀，比如我们的配置 authorizeRequests().antMatchers(“/test”).hasRole(“test”)，配置了一个 test 权限但我们存储的权限字段（authority）应该是 ROLE_test 。</p>
<p>GrantedAuthority代表的就是一种权限对象，而一个 UserDetails 对象具备一个或多个 GrantedAuthority 对象。通过这种关联关系，实际上我们就可以对用户的权限做一些限制</p>
<p>Authentication 的 getAuthorities() 可以返回当前 Authentication 对象拥有的权限，即当前用户拥有的权限。其返回值是一个 GrantedAuthority 类型的数组，每一个 GrantedAuthority 对象代表赋予给当前用户的一种权限。GrantedAuthority 是一个接口，其通常是通过 UserDetailsService 进行加载，然后赋予给 UserDetails 的。</p>
<p>GrantedAuthority 中只定义了一个 getAuthority() 方法，该方法返回一个字符串，表示对应权限的字符串表示，如果对应权限不能用字符串表示，则应当返回 null。</p>
<p>Spring Security 针对 GrantedAuthority 有一个简单实现 SimpleGrantedAuthority。该类只是简单的接收一个表示权限的字符串。Spring Security 内部的所有 AuthenticationProvider 都是使用 SimpleGrantedAuthority 来封装 Authentication 对象。</p>
<h2 id="UserDetailsService"><a href="#UserDetailsService" class="headerlink" title="UserDetailsService"></a>UserDetailsService</h2><p><code>UserDetailsService</code>接口。该接口只提供了一个方法：</p>
<pre><code>public interface UserDetailsService {
UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
}
</code></pre><p>根据用户名来定位用户。在实际执行中，搜索可能是区分大小写的，也可能是不区分大小写的，这取决于执行实例是如何配置的。在这种情况下，返回的UserDetails对象可能有一个与实际请求的不同大小写的用户名。</p>
<p>loadUserByUsername的作用，就是根据用户名查询用户对象。</p>
<h2 id="SecurityContextHolder"><a href="#SecurityContextHolder" class="headerlink" title="SecurityContextHolder"></a>SecurityContextHolder</h2><p>用户在完成登录后 Security 会将用户信息存储到这个类中，之后其他流程需要得到用户信息时都是从这个类中获得，用户信息被封装成 SecurityContext ，而实际存储的类是 SecurityContextHolderStrategy ，默认的SecurityContextHolderStrategy 实现类是 ThreadLocalSecurityContextHolderStrategy 它使用了ThreadLocal来存储了用户信息。</p>
<h2 id="使用注解在方法上进行权限认"><a href="#使用注解在方法上进行权限认" class="headerlink" title="使用注解在方法上进行权限认"></a>使用注解在方法上进行权限认</h2><p>Spring Security<code>默认是禁用注解的，要想开启注解，要在继承</code>WebSecurityConfigurerAdapter<code>的类加</code>@EnableMethodSecurity<code>注解，并在该类中将</code>AuthenticationManager<code>定义为</code>Bean。</p>
<pre><code>@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(
prePostEnabled = true,