spring security 4 filter UsernamePasswordAuthenticationFilter（一）

最新推荐文章于 2025-06-23 20:00:00 发布

原创

最新推荐文章于 2025-06-23 20:00:00 发布 · 1.1k 阅读

0 ·

CC 4.0 BY-SA版权

本文探讨了Spring Security框架中的UsernamePasswordAuthenticationFilter过滤器，它主要用于处理表单登录请求。从源码分析，讲解了过滤器的属性、工作流程，包括如何在配置中启用，并详细阐述了AuthenticationManager和AuthenticationProvider的角色，强调了自定义userDetailService在认证过程中的关键作用。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

spring security 就是由一系列filter组成的一个安全认证框架，熟悉其中一些重要的filter是对熟悉spring security本身就是一种方式。首先我将先附上spring security官网上几个默认的filter

然后我会重点讲几个，今天我们先说UsernamePasswordAuthenticationFilter这个过滤器，从官网上的截图可以看到左边的别名是“FORM_LOGIN_FILTER”，最右边的是其namespace element（命名空间）以及 attribute（配置属性），可以看到这个filter显示的是http/form-login。那这filter主要做什么，其实我们从别名和属性可以看主要处理form-login，form表单登录请求处理的filter。这个就体现出其重要性了，毕竟是登录这一块。

我们先来看一下源码，我们先看一下UsernamePasswordAuthenticationFilter父类AbstractAuthenticationProcessingFilter

public abstract class AbstractAuthenticationProcessingFilter extends GenericFilterBean implements ApplicationEventPublisherAware, MessageSourceAware {
    protected ApplicationEventPublisher eventPublisher;
    protected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
    private AuthenticationManager authenticationManager;
    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
    private RememberMeServices rememberMeServices = new NullRememberMeServices();
    private RequestMatcher requiresAuthenticationRequestMatcher;
    private boolean continueChainBeforeSuccessfulAuthentication = false;
    private SessionAuthenticationStrategy sessionStrategy = new NullAuthenticatedSessionStrategy();
    private boolean allowSessionCreation = true;
    private AuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
    private AuthenticationFailureHandler failureHandler = new SimpleUrlAuthenticationFailureHandler();

    protected AbstractAuthenticationProcessingFilter(String defaultFilterProcessesUrl) {
        this.setFilterProcessesUrl(defaultFilterProcessesUrl);
    }

    protected AbstractAuthenticationProcessingFilter(RequestMatcher requiresAuthenticationRequestMatcher) {
        Assert.notNull(requiresAuthenticationRequestMatcher, "requiresAuthenticationRequestMatcher cannot be null");
        this.requiresAuthenticationRequestMatcher = requiresAuthenticationRequestMatcher;
    }

    public void afterPropertiesSet() {
        Assert.notNull(this.authenticationManager, "authenticationManager must be specified");
    }

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest)req;
        HttpServletResponse response = (HttpServletResponse)res;
         // 判断访问是否需要过滤
        // 默认过滤 /login  post方式
        if (!this.requiresAuthentication(request, response)) {
            chain.doFilter(request, response);
        } else {
            if (this.logger.isDebugEnabled()) {
                this.logger.debug("Request is to process authentication");
            }

            Authentication authResult;
            try {
                authResult = this.attemptAuthentication(request, response);
                if (authResult == null) {
                    return;
                }

                this.sessionStrategy.onAuthentication(authResult, request, response);
            } catch (InternalAuthenticationServiceException var8) {
                this.logger.error("An internal error occurred while trying to authenticate the user.", var8);