SpringSecurity源码剖析

原创于 2025-12-19 10:43:06 发布 · 198 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#java

架构2025 专栏收录该内容

14 篇文章

订阅专栏

过滤器链加载源码

spring boot启动中会加载spring.factories文件，在文件中有对应Spring Security的过滤器链的配置信息。

# 安全过滤器自动配置
org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoCo
nfiguration

SecurityFilterAutoConfiguration类

@EnableConfigurationProperties({SecurityProperties.class})
@ConditionalOnClass({AbstractSecurityWebApplicationInitializer.class, SessionCreationPolicy.class})
@AutoConfigureAfter({SecurityAutoConfiguration.class})
public class SecurityFilterAutoConfiguration {
    
}

SecurityAutoConfiguration类

@ConditionalOnClass({DefaultAuthenticationEventPublisher.class})
@EnableConfigurationProperties({SecurityProperties.class})
@Import({SpringBootWebSecurityConfiguration.class, WebSecurityEnablerConfiguration.class, SecurityDataConfiguration.class})
public class SecurityAutoConfiguration {
    
}

WebScurityEnableConfiguration类

@Configuration(
    proxyBeanMethods = false
)
@ConditionalOnBean({WebSecurityConfigurerAdapter.class})
@ConditionalOnMissingBean(
    name = {"springSecurityFilterChain"}
)
@ConditionalOnWebApplication(
    type = Type.SERVLET
)
@EnableWebSecurity
public class WebSecurityEnablerConfiguration {
    public WebSecurityEnablerConfiguration() {
    }
}

WebSecurityConfiguration类

 /**
     * 声明 Spring Security 核心过滤器链（默认名称：springSecurityFilterChain）
     * 对应 AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME
     */
    @Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
    public Filter springSecurityFilterChain() throws Exception {
        // 检查是否有自定义的 WebSecurityConfigurer 配置
        boolean hasConfigurers = webSecurityConfigurers != null && !webSecurityConfigurers.isEmpty();
        
        // 如果没有自定义配置，创建默认空适配器（避免构建失败）
        if (!hasConfigurers) {
            WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor.postProcess(
                new WebSecurityConfigurerAdapter() {
                    // 空适配器：仅保证过滤器链能构建，无实际安全规则
                    @Override
                    protected void configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http) throws Exception {
                        // 6.x 需替换为 http.csrf(AbstractHttpConfigurer::disable)
                        http.csrf().disable(); // 示例：禁用 CSRF（根据业务调整）
                    }
                }
            );
            webSecurity.apply(adapter); // 将默认适配器应用到 WebSecurity
        } else {
            // 如果有自定义配置，遍历应用所有 WebSecurityConfigurer
            for (WebSecurityConfigurerAdapter configurer : webSecurityConfigurers) {
                webSecurity.apply(configurer);
            }
        }
        
        // 构建过滤器链（返回 FilterChainProxy，实现 Filter 接口）
        Filter filterChain = webSecurity.build();
        return filterChain;
    }