22

当我们<http>在 xml 文件中使用该元素时，注册了一组默认过滤器。这提到了过滤器的顺序（无论我们选择应用哪个），在此之上，它提到：

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
  <constructor-arg>
    <list>
      <sec:filter-chain pattern="/restful/**" filters="
           securityContextPersistenceFilterWithASCFalse,
           basicAuthenticationFilter,
           exceptionTranslationFilter,
           filterSecurityInterceptor" />
      <sec:filter-chain pattern="/**" filters="
           securityContextPersistenceFilterWithASCTrue,
           formLoginFilter,
           exceptionTranslationFilter,
           filterSecurityInterceptor" />
    </list>
  </constructor-arg>
</bean>

如果上面是默认过滤器列表，那么在调试过程中，我发现它RequestCacheAwareFilter也被调用了。这个过滤器是从哪里调用的，它在过滤器链中的位置是什么？在什么条件下AnonymousAuthenticationFilter配置到链中？

为我配置的默认过滤器链是什么？

编辑：我有 applicationContext.xml 和 springSecurity.xml。以下是我的 applicationContext.xml ：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context" xmlns:aop="http://www.springframework.org/schema/aop"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/aop
        http://www.springframework.org/schema/aop/spring-aop.xsd">

    <context:annotation-config />
    <context:spring-configured />

    <!-- Make sure that the part of the file until "End of beans" is identical
         to bean definitions in applicationContext.xml of the main application. -->

    <bean id="adminService" class="org.daud.admin.server.AdminServiceImpl" />
    <bean id="feedbackService" class="org.daud.feedback.server.FeedbackServiceImpl" />
    <bean id="guideService" class="org.daud.guider.server.GuiderServiceImpl" />
    <bean id="messageService" class="org.daud.messages.server.MessageServiceImpl" />
    <bean id="wsService" class="org.daud.guider.server.WSServiceImpl" />

    <bean id="jabxUtil" class="org.daud.common.server.services.JAXBUtil" />
    <bean id="serviceAdvisor" class="org.daud.common.server.ServiceAdvisor" />

    <bean id="userPreferences" class="org.daud.preferences.server.UserPreferencesServiceImpl" />

    <bean id="dynamicClientFactory" class="org.apache.cxf.jaxws.endpoint.dynamic.JaxWsDynamicClientFactory" factory-method="newInstance" />

    <!-- End of beans. -->

    <!-- For testing. -->

    <bean id="guiderClientService" class="org.daud.guider.server.GuiderClientServiceImpl" />

    <bean id="entityManager" class="com.daud.jpa.DBUtil" factory-method="createEntityManager" lazy-init="true">
        <constructor-arg value="bb-test" />
    </bean>

    <bean id="testUtil" class="com.daud.jpa.JPATestUtil" lazy-init="true">
        <constructor-arg ref="entityManager" />
        <constructor-arg value="org.daud" />
        <constructor-arg value="fixtures" />
    </bean>

</beans>

这是我的 springSecurity.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:aop="http://www.springframework.org/schema/aop"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd
        http://www.springframework.org/schema/aop
        http://www.springframework.org/schema/aop/spring-aop.xsd">

    <aop:aspectj-autoproxy proxy-target-class="true" />
    <beans:bean class="com.gwt.ss.GwtExceptionTranslator" />

    <global-method-security secured-annotations="enabled" access-decision-manager-ref="methodSecurityAccessDecisionManager"/>
    <http use-expressions="true" auto-config="false" disable-url-rewriting="true" access-decision-manager-ref="urlSecurityAccessDecisionManager"> 
        <intercept-url pattern="/favicon.ico" filters="none" />
        <intercept-url pattern="/login.jsp" filters="none" />

        <!-- Allow access only to admins and superadmins for the following 2 url patterns -->
        <intercept-url pattern="/do/admin/*" access="hasAdminStatus(3,4)" />
        <intercept-url pattern="/admin/*" access="hasAdminStatus(3,4)" />

        <intercept-url pattern="/**/*.html" access="isAuthenticated()" /> <!-- access="isAuthenticated()"-->
        <intercept-url pattern="/do/**" access="isAuthenticated()" />
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <custom-filter after="FILTER_SECURITY_INTERCEPTOR" ref="switchUserProcessingFilter"/>

        <form-login login-page="/login" login-processing-url="/do/login" authentication-failure-url="/login?authfailed=true" authentication-success-handler-ref="myAuthenticationSuccessHandler"/>

        <!-- Using success-handler-ref instead of logout-success-url for asynchronous logout. -->
        <logout invalidate-session="true" success-handler-ref="logoutSuccessHandler" logout-url="/do/logout" />
    </http>

    <beans:bean id="urlSecurityAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
        <beans:property name="decisionVoters">
            <beans:list>
                <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                    <beans:property name="expressionHandler" ref="myWebSecurityExpressionHandler"/>
                </beans:bean>
            </beans:list>
        </beans:property>
    </beans:bean>
    <beans:bean id="myWebSecurityExpressionHandler" class="org.daud.common.server.security.MyWebSecurityExpressionHandler"/>
    <beans:bean id="myWebSecurityExpressionRoot" class="org.daud.common.server.security.MyWebSecurityExpressionRoot" scope="prototype"/>
    <!-- For asynchronous login -->

    <beans:bean id="methodSecurityAccessDecisionManager"
        class="org.springframework.security.access.vote.AffirmativeBased">
        <beans:property name="decisionVoters">
            <beans:list>
                <beans:bean class="org.springframework.security.access.vote.RoleVoter" p:rolePrefix="" />
                <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
                <beans:bean class="org.daud.common.server.security.AllowPrivilegedRolesVoter">
                    <beans:property name="privilegedRoleTypes">
                        <beans:set>
                            <beans:value>ROOT</beans:value>
                        </beans:set>
                    </beans:property>
                </beans:bean>
            </beans:list>
        </beans:property>
    </beans:bean>

    <beans:bean class="com.gwt.ss.GwtUsernamePasswordAuthority">
        <beans:property name="authenticationManager" ref="authenticationManager" />
    </beans:bean>
    <beans:bean id="myAuthenticationSuccessHandler" class="org.daud.common.server.security.myAuthenticationSuccessHandler">
        <!-- If redirection after logging in is to URLs containing these strings, the redirection will instead be to '/' -->
        <beans:property name="partialURLsRequiringRedirection">
            <beans:list>
                <beans:value>/do/</beans:value>
                <beans:value>/exitUser</beans:value>
            </beans:list>
        </beans:property>
    </beans:bean>
    <beans:bean id="userSwitchSuccessHandler" class="org.daud.common.server.security.myUserSwitchSuccessHandler"/>
    <beans:bean id="userServices" class="org.daud.common.server.security.myUserServices"/>

    <beans:bean id="switchUserProcessingFilter" class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter">
        <beans:property name="userDetailsService" ref="userServices" />
        <beans:property name="switchUserUrl" value="/admin/switchUser" />
        <beans:property name="exitUserUrl" value="/admin/exitUser" />
        <beans:property name="successHandler" ref="userSwitchSuccessHandler"></beans:property>
    </beans:bean>

    <!-- For asynchronous logout -->

    <beans:bean id="logoutSuccessHandler" class="com.gwt.ss.GwtLogoutSuccessHandler" p:logoutSuccessUrl="/login" />

    <beans:bean id="myAuthenticationProvider" class="org.daud.common.server.security.myAuthenticationProvider" />
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="myAuthenticationProvider" />
    </authentication-manager>

</beans:beans>
4

3 回答 3

31

如果您打开调试日志记录，org.springframework.security.web.FilterChainProxy您将看到，对于每个请求，它通过的每个过滤器。

例如（我也在使用 Spring Security OAuth）。

11:18:39.123 FilterChainProxy - /user/login at position 1 of 17 in additional filter chain; firing Filter: 'BasicUserApprovalFilter'
11:18:39.123 FilterChainProxy - /user/login at position 2 of 17 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
11:18:39.124 FilterChainProxy - /user/login at position 3 of 17 in additional filter chain; firing Filter: 'LogoutFilter'
11:18:39.124 FilterChainProxy - /user/login at position 4 of 17 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
11:18:39.124 FilterChainProxy - /user/login at position 5 of 17 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
11:18:39.124 FilterChainProxy - /user/login at position 6 of 17 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
11:18:39.124 FilterChainProxy - /user/login at position 7 of 17 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
11:18:39.124 FilterChainProxy - /user/login at position 8 of 17 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
11:18:39.125 FilterChainProxy - /user/login at position 9 of 17 in additional filter chain; firing Filter: 'ForgotPasswordAuthenticationFilter'
11:18:39.125 FilterChainProxy - /user/login at position 10 of 17 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
11:18:39.125 FilterChainProxy - /user/login at position 11 of 17 in additional filter chain; firing Filter: 'SessionManagementFilter'
11:18:39.125 FilterChainProxy - /user/login at position 12 of 17 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
11:18:39.125 FilterChainProxy - /user/login at position 13 of 17 in additional filter chain; firing Filter: 'OAuth2ExceptionHandlerFilter'
11:18:39.125 FilterChainProxy - /user/login at position 14 of 17 in additional filter chain; firing Filter: 'VerificationCodeFilter'
11:18:39.125 FilterChainProxy - /user/login at position 15 of 17 in additional filter chain; firing Filter: 'OAuth2AuthorizationFilter'
11:18:39.125 FilterChainProxy - /user/login at position 16 of 17 in additional filter chain; firing Filter: 'OAuth2ProtectedResourceFilter'
11:18:39.125 FilterChainProxy - /user/login at position 17 of 17 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'

如果您想以编程方式获取过滤器，您可以注入FilterChainProxy并获取filterChainMap的值。

例如：

@Autowired var filterChainProxy: FilterChainProxy = _
//...
val filterChains = filterChainProxy.getFilterChainMap.values

如果您只想查看添加的过滤器，<http>那么您应该查看HttpSecurityBeanDefinitionParser.

于 2012-04-13T15:22:51.233 回答
31

您可以在 Spring Security 3.1 中做的另一件事是添加

<sec:debug />

或者

@EnableWebSecurity(debug = true)

到您的应用程序上下文。这添加了一个额外的过滤器，它将（除其他外）报告将应用于每个请求的安全过滤器列表。

于 2012-04-13T23:18:09.887 回答
3

几乎完整的 Spring Security 过滤器类型列表 在这里GenericFilterBean，尽管您可以在 SEC 中显示 all的子类并阅读Spring Security 参考手册的第 8-13 章，因为例如，您可以选择少数AbstractPreAuthenticatedProcessingFilter实现之一（和通过扩展现有过滤器或GenericFilterBean) 添加您自己的。

您在此处使用的示例FilterChainProxy通过过滤器链元素使用 bean 配置，并且不是默认链 - 您必须明确定义自己的链才能对请求应用过滤器。

另一方面，您正在询问<http>element: 它具有执行以下操作的auto-config属性：

 <http>
    <form-login />
    <http-basic />
    <logout />
  </http>

分别设置表单登录、基本认证和注销处理服务。

RequestCacheAwareFilter之所以调用它，是因为它可能包含在您的应用程序的过滤器链中 - 您的 context.xml 在这里会很有帮助。

AnonymousAuthenticationFilter如果您通过<sec:filter-chain>元素添加 bean 并使用给定的 id 配置 bean（通常它的类名以小写字母 ie 开头anonymousAuthenticationFilter），则（和任何其他过滤器）将被添加到链中。例如：

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
  <constructor-arg>
    <list>
      <sec:filter-chain pattern="/anonym/**" filters="
           anonymousAuthenticationFilter" />
      <sec:filter-chain pattern="/**" filters="none" />
    </list>
  </constructor-arg>
</bean>

<bean id="anonymousAuthenticationFilter"
    class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
  <property name="key" value="foobar"/>
  <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/>
</bean>

<bean id="authenticationManager"
     class="org.springframework.security.authentication.ProviderManager">
  <property name="providers">
    <list>
      <ref local="anonymousAuthenticationProvider"/>
    </list>
  </property>
</bean>

<bean id="anonymousAuthenticationProvider"
    class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
  <property name="key" value="foobar"/>
</bean>
于 2012-04-13T12:43:19.427 回答