Spring Security3源码分析-SecurityContextHolderAwareRequestFilter分析

最新推荐文章于 2024-11-02 08:55:59 发布

Dead_Knight

最新推荐文章于 2024-11-02 08:55:59 发布

阅读量443

点赞数

Spring Security 专栏收录该内容

21 篇文章

订阅专栏

本文探讨了 Spring Security 中 SecurityContextHolderAwareRequestFilter 的作用，它主要负责包装请求对象，实现 Servlet API 的相关接口，如 isUserInRole 和 getRemoteUser 方法，通过这个过滤器，Spring Security 能够在应用中实现认证和授权功能。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

SecurityContextHolderAwareRequestFilter过滤器对应的类路径为
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter

从类名称可以猜出这个过滤器主要是包装请求对象request的，看源码


    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        chain.doFilter(new SecurityContextHolderAwareRequestWrapper((HttpServletRequest) req, rolePrefix), res);
    }

SecurityContextHolderAwareRequestWrapper类对request包装的目的主要是实现servlet api的一些接口方法isUserInRole、getRemoteUser


    //从SecurityContext中获取认证实体Authentication
    private Authentication getAuthentication() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();

        if (!authenticationTrustResolver.isAnonymous(auth)) {
            return auth;
        }

        return null;
    }

    //实现getRemoteUser方法。首先获取认证实体，再从认证实体中获取登录账号
    @Override
    public String getRemoteUser() {
        Authentication auth = getAuthentication();

        if ((auth == null) || (auth.getPrincipal() == null)) {
            return null;
        }

        if (auth.getPrincipal() instanceof UserDetails) {
            return ((UserDetails) auth.getPrincipal()).getUsername();
        }

        return auth.getPrincipal().toString();
    }

    //实现getUserPrincipal方法
    @Override
    public Principal getUserPrincipal() {
        Authentication auth = getAuthentication();

        if ((auth == null) || (auth.getPrincipal() == null)) {
            return null;
        }

        return auth;
    }

    //判断是否授权。这里注意一下rolePrefix，就是角色的前缀
    private boolean isGranted(String role) {
        Authentication auth = getAuthentication();

        if( rolePrefix != null ) {
            role = rolePrefix + role;
        }

        if ((auth == null) || (auth.getPrincipal() == null)) {
            return false;
        }

        Collection<GrantedAuthority> authorities = auth.getAuthorities();

        if (authorities == null) {
            return false;
        }


        for (GrantedAuthority grantedAuthority : authorities) {
            if (role.equals(grantedAuthority.getAuthority())) {
                return true;
            }
        }

        return false;
    }

    //实现isUserInRole
    @Override
    public boolean isUserInRole(String role) {
        return isGranted(role);
    }