java相关:详解spring security filter的工作原理

发布于 2020-12-30|标签java
复制链接
摘记: 这篇文章介绍filter的工作原理。配置方式为xml。Filter如何进入执行逻辑的 初始配置: ```xml springSecurityFilterChain o ..
这篇文章介绍filter的工作原理。配置方式为xml。Filter如何进入执行逻辑的初始配置: ```xml springSecurityFilterChain org.springframework.web.filter.DelegatingFilterProxy springSecurityFilterChain /* ``` DelegatingFilterProxy这个类继承了GenericFilterBean,GenericFilterBean实现了Filter接口。这个配置是一切的开始,配置完这个之后,在启动项目的时候会执行Filterd的初始化方法: ```java @Override public final void init(FilterConfig filterConfig) throws ServletException { Assert.notNull(filterConfig, "FilterConfig must not be null"); if (logger.isDebugEnabled()) { logger.debug("Initializing filter '" + filterConfig.getFilterName() + "'"); } this.filterConfig = filterConfig; // Set bean properties from init parameters. PropertyValues pvs = new FilterConfigPropertyValues(filterConfig, this.requiredProperties); if (!pvs.isEmpty()) { try { BeanWrapper bw = PropertyAccessorFactory.forBeanPropertyAccess(this); ResourceLoader resourceLoader = new ServletContextResourceLoader(filterConfig.getServletContext()); Environment env = this.environment; if (env == null) { env = new StandardServletEnvironment(); } bw.registerCustomEditor(Resource.class, new ResourceEditor(resourceLoader, env)); initBeanWrapper(bw); bw.setPropertyValues(pvs, true); } catch (BeansException ex) { String msg = "Failed to set bean properties on filter '" + filterConfig.getFilterName() + "': " + ex.getMessage(); logger.error(msg, ex); throw new NestedServletException(msg, ex); } } // Let subclasses do whatever initialization they like. initFilterBean(); // 这个方法 if (logger.isDebugEnabled()) { logger.debug("Filter '" + filterConfig.getFilterName() + "' configured successfully"); } } ``` 在初始化方法中,会执行初始化Filter的方法initFilterBean。这个方法的实现在DelegatingFilterProxy中: ```java protected void initFilterBean() throws ServletException { synchronized (this.delegateMonitor) { if (this.delegate == null) { // If no target bean name specified, use filter name. if (this.targetBeanName == null) { this.targetBeanName = getFilterName(); } // Fetch Spring root application context and initialize the delegate early, // if possible. If the root application context will be started after this // filter proxy, we'll have to resort to lazy initialization. WebApplicationContext wac = findWebApplicationContext(); if (wac != null) { this.delegate = initDelegate(wac); //这个方法 } } } } ``` 在这个初始化方法中又调用initDelegate方法进行初始化: ```java protected Filter initDelegate(WebApplicationContext wac) throws ServletException { String targetBeanName = getTargetBeanName(); Assert.state(targetBeanName != null, "No target bean name set"); Filter delegate = wac.getBean(targetBeanName, Filter.class); if (isTargetFilterLifecycle()) { delegate.init(getFilterConfig()); } return delegate; } ``` 在这个方法中,先获取targetBeanName,这个名字是构造方法中赋值的: ```java public DelegatingFilterProxy(String targetBeanName, @Nullable WebApplicationContext wac) { Assert.hasText(targetBeanName, "Target Filter bean name must not be null or empty"); this.setTargetBeanName(targetBeanName); this.webApplicationContext = wac; if (wac != null) { this.setEnvironment(wac.getEnvironment()); } } ``` 这个名字就是web.xml中配置的名字springSecurityFilterChain: ```xml springSecurityFilterChain org.springframework.web.filter.DelegatingFilterProxy ``` springSecurityFilterChain是固定不能改的,如果改了启动时就会报错,这是spring 启动时内置的一个bean,这个bean实际是FilterChainProxy。这样一个Filter就初始化话好了,过滤器chain也初始化好了。当一个请求进来的时候,会进入FilterChainProxy执行doFilter方法: ```java public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { boolean clearContext = request.getAttribute(FILTER_APPLIED) == null; if (clearContext) { try { request.setAttribute(FILTER_APPLIED, Boolean.TRUE); doFilterInternal(request, response, chain); } finally { SecurityContextHolder.clearContext(); request.removeAttribute(FILTER_APPLIED); } } else { doFilterInternal(request, response, chain); } } ``` 先获取所有的Filter,然后执行doFilterInternal方法: ```java private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { FirewalledRequest fwRequest = firewall .getFirewalledRequest((HttpServletRequest) request); HttpServletResponse fwResponse = firewall .getFirewalledResponse((HttpServletResponse) response); List filters = getFilters(fwRequest); if (filters == null || filters.size() == 0) { if (logger.isDebugEnabled()) { logger.debug(UrlUtils.buildRequestUrl(fwRequest) + (filters == null ? " has no matching filters" : " has an empty filter list")); } fwRequest.reset(); chain.doFilter(fwRequest, fwResponse); return; } // 最终执行下面的这些代码 VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters); vfc.doFilter(fwRequest, fwResponse); } ``` VirtualFilterChain是一个匿名内部类: ```java private static class VirtualFilterChain implements FilterChain { private final FilterChain originalChain; private final List additionalFilters; private final FirewalledRequest firewalledRequest; private final int size; private int currentPosition = 0; private VirtualFilterChain(FirewalledRequest firewalledRequest, FilterChain chain, List additionalFilters) { this.originalChain = chain; this.additionalFilters = additionalFilters; this.size = additionalFilters.size(); this.firewalledRequest = firewalledRequest; } @Override public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException { if (currentPosition == size) { if (logger.isDebugEnabled()) { logger.debug(UrlUtils.buildRequestUrl(firewalledRequest) + " reached end of additional filter chain; proceeding with original chain"); } // Deactivate path stripping as we exit the security filter chain this.firewalledRequest.reset(); originalChain.doFilter(request, response); } else { currentPosition++; Filter nextFilter = additionalFilters.get(currentPosition - 1); if (logger.isDebugEnabled()) { logger.debug(UrlUtils.buildRequestUrl(firewalledRequest) + " at position " + currentPosition + " of " + size + " in additional filter chain; firing Filter: '" + nextFilter.getClass().getSimpleName() + "'"); } nextFilter.doFilter(request, response, this); } } } ``` filter集合执行的逻辑在VirtualFilterChain的doFilter方法中。filter是如何执行的 上面说了怎么才能进入filter的执行逻辑,下面说一下filter到底怎么执行,为什么一个 在VirtualFilterChain的doFilter方法可以执行所有的filter。下面写一个例子,模拟filter的执行逻辑。 定义FilterChain接口、Filter接口: ```java public interface Filter { void doFilter(String username, int age, FilterChain filterChain); } ``` ```java public interface FilterChain { void doFilter(String username, int age); } ``` 定义两个Filter实现: ```java public class NameFilter implements Filter { @Override public void doFilter(String username, int age, FilterChain filterChain) { username = username + 1; System.out.println("username: " + username + " age: " + age); System.out.println("正在执行:NameFilter"); filterChain.doFilter(username, age); } } ``` ```java public class AgeFilter implements Filter { @Override public void doFilter(String username, int age, FilterChain filterChain) { age += 10; System.out.println("username: " + username + " age: " + age); System.out.println("正在执行:AgeFilter"); filterChain.doFilter(username, age); } } ``` 定义一个FilterChain实现: ```java public class FilterChainProxy implements FilterChain { private int position = 0; private int size = 0; private List filterList = new ArrayList(); public void addFilter(Filter filter) { filterList.add(filter); size++; } @Override public void doFilter(String username, int age) { if (size == position) { System.out.println("过滤器链执行结束"); } else { Filter filter = filterList.get(position); position++; filter.doFilter(username, age, this); } } } ``` 测试Filter实现: ```java public class FilterTest { public static void main(String[] args) { FilterChainProxy proxy = new FilterChainProxy(); proxy.addFilter(new NameFilter()); proxy.addFilter(new AgeFilter()); proxy.doFilter("张三", 0); } } ======= username: 张三1 age: 0 正在执行:NameFilter username: 张三1 age: 10 正在执行:AgeFilter 过滤器链执行结束 ``` 在这个执行逻辑中,最重要的是【this】,this就是初始化的好的FilterChain实例,在这个测试实例中,this就是FilterChainProxy。执行FilterChainProxy的doFilter方法的时候,传入了初始参数username和age,进入这个方法后,根据position取出相应的Filter,初次进入position是0,执行Filter的doFilter方法,注意,此时Filter的doFilter方法额外传入了一个this参数,这个参数就是初始化的好的FilterChain实例,在Filter中的doFilter的方法中最后又会执行FilterChain的doFilter方法,相当于第二次调用FilterChain实例的doFilter方法,此时posotion是1,然后再执行Filter的doFilter方法,直到所有的Filter执行完,整个执行过程结束。VirtualFilterChain的doFilter方法的执行逻辑和这个测试实例中的执行逻辑基本一致。 这样就完成了整个过滤器链的执行。总结 以前用Filter的时候就非常疑惑过滤器怎么执行的,直到今天才算解决了这个疑惑。 原文地址: https://segmentfault.com/a/1190000019868974
冀ICP备17029012号-4 | 版权所有©鲍亚龙 |免责声明  | GIF图库  | NUXT版