【个人版】SpringBoot下Spring-Security核心概念解读【一】

SpringBoot + Spring-Security + FilterChainProxy

Spring-Security全局导读：
1、Security核心类设计
2、HttpSecurity结构和执行流程解读
3、Spring-Security个人落地篇

背景： 凡项目内存在与外部系统交互，基本安全校验少不了。因项目规模与框架发展原因，历史项目中很多时候直接在Filter中完成安全校验（HandlerInterceptor同理），基本需求完全够用。现在因微服务、中心化等原因，自己写权限管理逻辑代码量较多，后期修改工作量可能较大，所以spring全家桶中的安全框架spring-security随SpringBoot发展而热门起来。最近走读源码，发现spring-security其实还是以Filter为基础，只是把周边功能及场景通过逻辑封装，进而成为开箱即用的安全框架。

Spring-Securiy的核心类是FilterChainProxy，FilterChainProxy的顶层接口是Filter

所以只要理解了FilterChainProxy类的架构设计、构建流程、执行细节，那么这个框架基本就了解了。关于Filter的深入理解，可以看之前解读：

Filter系列解读：
1、SpringBoot下Filter自动适配
2、SpringBoot下Filter注册流程
3、Filter链式执行设计解读

下面直接上FilterChainProxy二改版源码：

public class org.springframework.security.web.FilterChainProxy extends GenericFilterBean implements Filter, BeanNameAware, EnvironmentAware, EnvironmentCapable, ServletContextAware, InitializingBean, DisposableBean{
    // 鉴权过滤器链，根据请求匹配，一般一个(匹配/*)就足够，除非网关类项目且鉴权逻辑差异较大
    private List<SecurityFilterChain> filterChains;
    // 请求包装类，授权框架处理定制版
    private HttpFirewall firewall;
    
	// SecurityFilterChain就是spring-security封装的权限处理类，其内部核心就是鉴权Filter
	// SecurityFilterChain的定义、生成流程及逻辑后续篇说明
    public FilterChainProxy(List<SecurityFilterChain> filterChains) {
        this.firewall = new StrictHttpFirewall();
        this.filterChains = filterChains;
    }
	// FilterChainProxy本身就是Filter,且url pattern为/*，所有请求都会在此进入执行
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
            try {
                this.doFilterInternal(request, response, chain);
            } catch (Exception var11) {
				// 异常处理，此处忽略
            } finally {
                SecurityContextHolder.clearContext();
                request.removeAttribute(FILTER_APPLIED);
            }
    }

    private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    	// 请求响应预包装，可不关注
        FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest)request);
        HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse)response);
        // 这里根据请求URI匹配对应SecurityFilterChain，进而获取其包装的【鉴权相关】Filter集合
        List<Filter> filters = this.getFilters((HttpServletRequest)firewallRequest);
        if (filters != null && filters.size() != 0) {
        	// 将参数chain和filters用内部类封装成新的FilterChain，使执行流程完全等同于普通过滤器
            VirtualFilterChain virtualFilterChain = new VirtualFilterChain(firewallRequest, chain, filters);
            // 内部定义FilterChain执行入口
            virtualFilterChain.doFilter(firewallRequest, firewallResponse);
        } else {
            firewallRequest.reset();
            // 无权限处理相关类，执行外部过滤器链的下一个，直接忽略FilterChainProxy过滤器
            chain.doFilter(firewallRequest, firewallResponse);
        }
    }
	// 通过请求获取鉴权过滤器列表，逻辑较为简单
    private List<Filter> getFilters(HttpServletRequest request) {
        int count = 0;
        Iterator var3 = this.filterChains.iterator();

        SecurityFilterChain chain;
        do {
            if (!var3.hasNext()) {
                return null;
            }
            chain = (SecurityFilterChain)var3.next();
        } while(!chain.matches(request));
		// 根据匹配到的SecurityFilterChain，返回其包含的所有Filter
        return chain.getFilters();
    }

	//VirtualFilterChain可类比ApplicationFilterChain，此设计极高解耦代码执行流程
    private static final class VirtualFilterChain implements FilterChain {
        // 保存原始chain对象，执行完所有授权Filter后，继续执行原始链的下一个过滤器
        private final FilterChain originalChain;
        // 授权过滤器集合
        private final List<Filter> additionalFilters;
        private final FirewalledRequest firewalledRequest;
        // 鉴权过滤器总数
        private final int size;
        // 当前过滤器执行位置索引
        private int currentPosition;

        private VirtualFilterChain(FirewalledRequest firewalledRequest, FilterChain chain, List<Filter> additionalFilters) {
            this.currentPosition = 0;
            this.originalChain = chain;
            this.additionalFilters = additionalFilters;
            this.size = additionalFilters.size();
            this.firewalledRequest = firewalledRequest;
        }
		// 此块逻辑完美体现数组 + Filter类设计的美感
        public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
            if (this.currentPosition == this.size) {
            	// 授权过滤器执行完成
                this.firewalledRequest.reset();
                this.originalChain.doFilter(request, response);
            } else {
            	// 循环做权限上下文中的所有检查及鉴权操作，注意索引自增
                Filter nextFilter = (Filter)this.additionalFilters.get(this.currentPosition++);
                nextFilter.doFilter(request, response, this);
            }
        }
    }
}

FilterChainProxy的核心代码及相关介绍已在上面具体标注了，框架帮我们把业务无关的代码全部封装起来，我们只需要关注核心的鉴权管理，剩下的全交给框架了。

除了FilterChainProxy源码解读，还有几个问题需要弄明白：
1、FilterChainProxy作为过滤器，是怎么注册到Spring容器的？和普通过滤器注册是否不同？
2、FilterChainProxy作为过滤器，有没有优先级要求？
3、我们自定义的鉴权类过滤器，是否会影响ApplicationFilterChain原始链的执行？
4、security框架，为我们封装了哪些内部过滤器？
5、我们定义的普通过滤器，会自动添加到授权过滤器列表吗？

FilterChainProxy注册：

@Configuration(
    proxyBeanMethods = false
)
public class org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
	@Bean(
        name = {"springSecurityFilterChain"}
    )
    public Filter springSecurityFilterChain() throws Exception {
        boolean hasConfigurers = this.webSecurityConfigurers != null && !this.webSecurityConfigurers.isEmpty();
        boolean hasFilterChain = !this.securityFilterChains.isEmpty();
        Iterator var7 = this.securityFilterChains.iterator();
        while(true) {
            while(var7.hasNext()) {
                SecurityFilterChain securityFilterChain = (SecurityFilterChain)var7.next();
                this.webSecurity.addSecurityFilterChainBuilder(() -> {
                    return securityFilterChain;
                });
                Iterator var5 = securityFilterChain.getFilters().iterator();

                while(var5.hasNext()) {
                    Filter filter = (Filter)var5.next();
                    if (filter instanceof FilterSecurityInterceptor) {
                        this.webSecurity.securityInterceptor((FilterSecurityInterceptor)filter);
                        break;
                    }
                }
            }

            var7 = this.webSecurityCustomizers.iterator();
            while(var7.hasNext()) {
                WebSecurityCustomizer customizer = (WebSecurityCustomizer)var7.next();
                customizer.customize(this.webSecurity);
            }

            return (Filter)this.webSecurity.build();
        }
    }
}

    @Autowired(
        required = false
    )
    void setFilterChains(List<SecurityFilterChain> securityFilterChains) {
        this.securityFilterChains = securityFilterChains;
    }

protected Filter performBuild() throws Exception {
    int chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();
    List<SecurityFilterChain> securityFilterChains = new ArrayList(chainSize);
    List<RequestMatcherEntry<List<WebInvocationPrivilegeEvaluator>>> requestMatcherPrivilegeEvaluatorsEntries = new ArrayList();

    var4 = this.securityFilterChainBuilders.iterator();
    while(var4.hasNext()) {
        SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder = (SecurityBuilder)var4.next();
        SecurityFilterChain securityFilterChain = (SecurityFilterChain)securityFilterChainBuilder.build();
        securityFilterChains.add(securityFilterChain);
        requestMatcherPrivilegeEvaluatorsEntries.add(this.getRequestMatcherPrivilegeEvaluatorsEntry(securityFilterChain));
    }

    FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
    Filter result = filterChainProxy;
    this.postBuildAction.run();
    return (Filter)result;
}

重点：
1、securityFilterChains由外部实例化后，注入到该配置类中【列表注入】
2、SecurityFilterChain由HttpSecurity类构建而来，WebSecurity构建结果为FilterChainProxy
3、FilterSecurityInterceptor负责安全检查，未授权请求在此拒绝
4、FilterSecurityInterceptor在SecurityFilterChain的Filter列表中最后一个

我们知道过滤器真正执行是否两块逻辑组成：Filter实例 + 匹配|执行元数据，所以在过去spring时代我们通常需要FilterRegistrationBean完成注册。元数据关系到过滤器执行的时机及顺序，这块在哪里配置的呢？

@ConfigurationProperties(
    prefix = "spring.security"
)
public class SecurityProperties {
    public static final int BASIC_AUTH_ORDER = 2147483642;
    public static final int IGNORED_ORDER = Integer.MIN_VALUE;
    public static final int DEFAULT_FILTER_ORDER = -100;
    private final Filter filter = new Filter();
    private final User user = new User();
    
    public static class Filter {
        private int order = -100;
        private Set<DispatcherType> dispatcherTypes;

        public Filter() {
            this.dispatcherTypes = new HashSet(Arrays.asList(DispatcherType.ASYNC, DispatcherType.ERROR, DispatcherType.REQUEST));
        }
    }
}

@EnableConfigurationProperties({SecurityProperties.class})
public class org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoConfiguration {

    @Bean
    @ConditionalOnBean(
        name = {"springSecurityFilterChain"}
    )
    public DelegatingFilterProxyRegistrationBean securityFilterChainRegistration(SecurityProperties securityProperties) {
        DelegatingFilterProxyRegistrationBean registration = new DelegatingFilterProxyRegistrationBean("springSecurityFilterChain", new ServletRegistrationBean[0]);
        registration.setOrder(securityProperties.getFilter().getOrder());
        registration.setDispatcherTypes(this.getDispatcherTypes(securityProperties));
        return registration;
    }
}

说明：
1、配置文件中，以spring.security前缀可配置security过滤器顺序
2、过滤器默认优先级为-100，我们自定义过滤器不要设置负数，负数留给其他框架提前预处理
3、Filter封装类不是FilterRegistrationBean，DelegatingFilterProxyRegistrationBean延迟了FilterChainProxy的实例化，为自定义配置执行留下较大的配置事件
4、通过RegistrationBean，我们在处理请求时，就可以在原始ApplicationFilterChain链的靠前位置执行鉴权逻辑了
5、一般我们在Filter获取Request对象的实际类型时，基本都是RequestFacade类型，但当使用security框架后，我们接收到的可能是其他请求Wrapper类型，这时候如果自定义Filter存在Request类型的反射处理，就会报错了。

以下为security框架自带的部分Filter清单：

	DisableEncodeUrlFilter
	WebAsyncManagerlntegrationFilter
	SecurityContextPersistenceFilter // 上下文管理
	HeaderWriterFilter
	CsrfFilter // 防止Csrf攻击，网关/多端类根据需要关闭
	LogoutFilter //退出管理
	UsernamePasswordAuthenticationFilter //核心，用户名及密码验证
	DefaultLoginPageGeneratingFilter
	DefaultLogoutPageGeneratingFilter
	BasicAuthenticationFilter // Basic授权管理
	RequestCacheAwareFilter
	SecurityContextHolderAwareRequestFilter
	AnonymousAuthenticationFilter
	SessionManagementFilter // Session会话管理
	ExceptionTranslationFilter
	FilterSecurityInterceptor // 授权状态检查，最后兜底关口

解答最后两个问题：
3、我们自定义的鉴权类过滤器，是否会影响ApplicationFilterChain原始链的执行？
---- 自定义Security框架Filter不会影响原始链执行，但是也会在ApplicationFilterChain保存一份，只不过doFilter方法检测无需处理。我们自定义权限过滤器肯定是处理某一登录场景，URL是固定值。

5、我们定义的普通过滤器，会自动添加到授权过滤器列表吗？
---- 不会，授权过滤器链内容由HttpSecurity构建，除非我们手工将Filter添加到配置上下文中，否则只会在原始ApplicationFilterChain出现。