diff --git a/README.md b/README.md index 7c03b12..7e40342 100644 --- a/README.md +++ b/README.md @@ -112,6 +112,9 @@ - [SpringBoot 日志系统](/docs/SpringBoot/SpringBoot-LogSystem.md) - [SpringBoot ConditionalOnBean](/docs/SpringBoot/SpringBoot-ConditionalOnBean.md) +### SpringSecurity +- [SpringSecurity请求全过程解析](/docs/SpringSecurity/SpringSecurity请求全过程解析.md) + ## MyBatis ### 基础支持层 diff --git a/docs/SpringSecurity/SpringSecurity请求全过程解析.md b/docs/SpringSecurity/SpringSecurity请求全过程解析.md new file mode 100644 index 0000000..209193c --- /dev/null +++ b/docs/SpringSecurity/SpringSecurity请求全过程解析.md @@ -0,0 +1,140 @@ +# Spring Security请求全过程解析 + +Spring Security是一款基于Spring的安全框架,主要包含认证和授权两大安全模块,和另外一款流行的安全框架Apache Shiro相比,它拥有更为强大的功能。Spring Security也可以轻松的自定义扩展以满足各种需求,并且对常见的Web安全攻击提供了防护支持。如果你的Web框架选择的是Spring,那么在安全方面Spring Security会是一个不错的选择。 + +这里我们使用Spring Boot来集成Spring Security,Spring Boot版本为***2.5.3***,Spring Security版本为***5.5.1***。 + +## 开启Spring Security + +使用IDEA创建一个Spring Boot项目,然后引入***spring-boot-starter-security***: + +```java +dependencies { + implementation 'org.springframework.boot:spring-boot-starter-security' + implementation 'org.springframework.boot:spring-boot-starter-web' + implementation 'org.projectlombok:lombok:1.18.8' + annotationProcessor 'org.projectlombok:lombok:1.18.8' + providedRuntime 'org.springframework.boot:spring-boot-starter-tomcat' + testImplementation 'org.springframework.boot:spring-boot-starter-test' + testImplementation 'org.springframework.security:spring-security-test' +} +``` + +接下来我们创建一个***HelloController***,对外提供一个/hello服务: + +```java +@RestController +public class HelloController { + @GetMapping("hello") + public String hello() { + return "hello world"; + } +} +``` + +这时候我们直接启动项目,访问http://localhost:8080/hello,可以看到页面跳转到一个登陆页面: + +![image-20210811091508157](../../images/SpringSecurity/image-20210811091508157.png) + +默认的用户名为user,密码由Sping Security自动生成,回到IDEA的控制台,可以找到密码信息: + +```java +Using generated security password: 4f06ba04-37e9-4bdd-a085-3305260da0d6 +``` + +输入用户名user,密码4f06ba04-37e9-4bdd-a085-3305260da0d6后,我们便可以成功访问/hello接口。 + +## 基本原理 + +Spring Security默认为我们开启了一个简单的安全配置,下面让我们来了解其原理。 + +当Spring Boot项目配置了Spring Security后,Spring Security的整个加载过程如下图所示: + +![image-20210811091633434](../../images/SpringSecurity/image-20210811091633434.png) + +而当我们访问http://localhost:8080/hello时,代码的整个执行过程如下图所示: + +![image-20210811091659121](../../images/SpringSecurity/image-20210811091659121.png) + +如上图所示,Spring Security包含了众多的过滤器,这些过滤器形成了一条链,所有请求都必须通过这些过滤器后才能成功访问到资源。 + +下面我们通过debug来验证这个过程: + +首先,通过前面可以知道,当有请求来到时,最先由***DelegatingFilterProxy***负责接收,因此在***DelegatingFilterProxy***的doFilter()的首行打上断点: + +![image-20210811091719470](../../images/SpringSecurity/image-20210811091719470.png) + +接着***DelegatingFilterProxy***会将请求委派给***FilterChainProxy***进行处理,在***FilterChainProxy***的首行打上断点: + +![img](../../images/SpringSecurity/56ac5128-eab7-4b92-912f-ff50bac68a4f.png) + +***FilterChainProxy***会在doFilterInternal()中生成一个内部类***VirtualFilterChain***的实例,以此来调用Spring Security的整条过滤器链,在***VirtualFilterChain***的doFilter()首行打上断点: + +![image-20210811091755498](../../images/SpringSecurity/image-20210811091755498.png) + +接下来***VirtualFilterChain***会通过***currentPosition***依次调用存在***additionalFilters***中的过滤器,其中比较重要的几个过滤器有:***UsernamePasswordAuthenticationFilter***、***DefaultLoginPageGeneratingFilter***、***AnonymousAuthenticationFilter***、***ExceptionTranslationFilter***、***FilterSecurityInterceptor***,我们依次在这些过滤器的doFilter()的首行打上断点: + +![image-20210811091815473](../../images/SpringSecurity/image-20210811091815473.png) + +准备完毕后,我们启动项目,然后访问http://localhost:8080/hello,程序首先跳转到***DelegatingFilterProxy***的断点上: + +![image-20210811091833065](../../images/SpringSecurity/image-20210811091833065.png) + +此时***delegate***还是null的,接下来依次执行代码,可以看到***delegate***最终被赋值一个***FilterChainProxy***的实例: + +![img](../../images/SpringSecurity/f045b025-bd97-4222-8a02-51634be6745b.png) + +接下来程序依次跳转到***FilterChainProxy***的doFilter()和***VirtualFilterChain***的doFilter()中: + +![img](../../images/SpringSecurity/90d3e369-510f-45cb-982d-241d2eedb55c.png) + +![image-20210811092048784](../../images/SpringSecurity/image-20210811092048784.png) + +接着程序跳转到***AbstractAuthenticationProcessingFilter***(***UsernamePasswordAuthenticationFilter***的父类)的doFilter()中,通过requiresAuthentication()判定为false(是否是POST请求): + +![img](../../images/SpringSecurity/2e5440bc-9488-4213-a030-0d25153bb2ea.png) + +接着程序跳转到***DefaultLoginPageGeneratingFilter***的doFilter()中,通过isLoginUrlRequest()判定为false(请求路径是否是/login): + +![img](../../images/SpringSecurity/47a7bca4-d858-4cb1-b126-347805b74053.png) + +接着程序跳转到***AnonymousAuthenticationFilter***的doFilter()中,由于是首次请求,此时SecurityContextHolder.getContext().getAuthentication()为null,因此会生成一个***AnonymousAuthenticationToken***的实例: + +![img](../../images/SpringSecurity/6b1aded6-5229-47ba-b192-78a7c2622b8c.png) + +接着程序跳转到***ExceptionTranslationFilter***的doFilter()中,***ExceptionTranslationFilter***负责处理***FilterSecurityInterceptor***抛出的异常,我们在catch代码块的首行打上断点: + +**![img](../../images/SpringSecurity/8efa0b1c-2b32-4d5b-9655-985374326e10.png)** + +接着程序跳转到***FilterSecurityInterceptor***的doFilter()中,依次执行代码后程序停留在其父类(***AbstractSecurityInterceptor***)的attemptAuthorization()中: + +![img](../../images/SpringSecurity/d6e99143-6207-43a5-8d04-f0c81baa11b4.png) + +***accessDecisionManager***是***AccessDecisionManager***(访问决策器)的实例,***AccessDecisionManager***主要有3个实现类:***AffirmativeBased***(一票通过),**ConsensusBased**(少数服从多数)、UnanimousBased(一票否决),此时***AccessDecisionManager***的的实现类是***AffirmativeBased***,我们可以看到程序进入***AffirmativeBased***的decide()中: + +![img](../../images/SpringSecurity/6724647c-34ee-4a57-8cfa-b46f57400d14.png) + +从上图可以看出,决策的关键在voter.vote(authentication, object, configAttributes)这句代码上,通过跟踪调试,程序最终进入***AuthenticationTrustResolverImpl***的isAnonymous()中: + +![img](../../images/SpringSecurity/4beaa02f-a93d-4d95-9ad1-0d7213cb0e46.png) + +isAssignableFrom()判断前者是否是后者的父类,而***anonymousClass***被固定为***AnonymousAuthenticationToken.class***,参数***authentication***由前面***AnonymousAuthenticationFilter***可以知道是***AnonymousAuthenticationToken***的实例,因此isAnonymous()返回true,***FilterSecurityInterceptor***抛出***AccessDeniedException***异常,程序返回***ExceptionTranslationFilter***的catch块中: + +![img](../../images/SpringSecurity/8e1ac9db-5987-484d-abf4-4c6535c60cc6.png) + +接着程序会依次进入***DelegatingAuthenticationEntryPoint***、***LoginUrlAuthenticationEntryPoint***中,最后由***LoginUrlAuthenticationEntryPoint***的commence()决定重定向到/login: + +![img](../../images/SpringSecurity/1b03bdd4-6773-4b39-a664-fdf65d104403.png) + +后续对/login的请求同样会经过之前的执行流程,在***DefaultLoginPageGeneratingFilter***的doFilter()中,通过isLoginUrlRequest()判定为true(请求路径是否是/login),直接返回***login.html***,也就是我们开头看到的登录页面。 + +当我们输入用户名和密码,点击***Sign in***,程序来到***AbstractAuthenticationProcessingFilter***的doFilter()中,通过requiresAuthentication()判定为true(是否是POST请求),因此交给其子类***UsernamePasswordAuthenticationFilter***进行处理,***UsernamePasswordAuthenticationFilter***会将用户名和密码封装成一个***UsernamePasswordAuthenticationToken***的实例并进行校验,当校验通过后会将请求重定向到我们一开始请求的路径:/hello。 + +后续对/hello的请求经过过滤器链时就可以一路开绿灯直到最终交由***HelloController***返回"Hello World"。 + +## 参考 + +1. [Spring Security Reference](https://docs.spring.io/spring-security/site/docs/current/reference/html5/) + +2. [Spring Boot中开启Spring Security](https://mrbird.cc/Spring-Boot&Spring-Security.html) + diff --git a/images/SpringSecurity/1b03bdd4-6773-4b39-a664-fdf65d104403.png b/images/SpringSecurity/1b03bdd4-6773-4b39-a664-fdf65d104403.png new file mode 100644 index 0000000..781c22a Binary files /dev/null and b/images/SpringSecurity/1b03bdd4-6773-4b39-a664-fdf65d104403.png differ diff --git a/images/SpringSecurity/2e5440bc-9488-4213-a030-0d25153bb2ea.png b/images/SpringSecurity/2e5440bc-9488-4213-a030-0d25153bb2ea.png new file mode 100644 index 0000000..10aae2c Binary files /dev/null and b/images/SpringSecurity/2e5440bc-9488-4213-a030-0d25153bb2ea.png differ diff --git a/images/SpringSecurity/47a7bca4-d858-4cb1-b126-347805b74053.png b/images/SpringSecurity/47a7bca4-d858-4cb1-b126-347805b74053.png new file mode 100644 index 0000000..27451b7 Binary files /dev/null and b/images/SpringSecurity/47a7bca4-d858-4cb1-b126-347805b74053.png differ diff --git a/images/SpringSecurity/4beaa02f-a93d-4d95-9ad1-0d7213cb0e46.png b/images/SpringSecurity/4beaa02f-a93d-4d95-9ad1-0d7213cb0e46.png new file mode 100644 index 0000000..c852b01 Binary files /dev/null and b/images/SpringSecurity/4beaa02f-a93d-4d95-9ad1-0d7213cb0e46.png differ diff --git a/images/SpringSecurity/56ac5128-eab7-4b92-912f-ff50bac68a4f.png b/images/SpringSecurity/56ac5128-eab7-4b92-912f-ff50bac68a4f.png new file mode 100644 index 0000000..dd655f9 Binary files /dev/null and b/images/SpringSecurity/56ac5128-eab7-4b92-912f-ff50bac68a4f.png differ diff --git a/images/SpringSecurity/6724647c-34ee-4a57-8cfa-b46f57400d14.png b/images/SpringSecurity/6724647c-34ee-4a57-8cfa-b46f57400d14.png new file mode 100644 index 0000000..a7a708b Binary files /dev/null and b/images/SpringSecurity/6724647c-34ee-4a57-8cfa-b46f57400d14.png differ diff --git a/images/SpringSecurity/6b1aded6-5229-47ba-b192-78a7c2622b8c.png b/images/SpringSecurity/6b1aded6-5229-47ba-b192-78a7c2622b8c.png new file mode 100644 index 0000000..ab3c047 Binary files /dev/null and b/images/SpringSecurity/6b1aded6-5229-47ba-b192-78a7c2622b8c.png differ diff --git a/images/SpringSecurity/8e1ac9db-5987-484d-abf4-4c6535c60cc6.png b/images/SpringSecurity/8e1ac9db-5987-484d-abf4-4c6535c60cc6.png new file mode 100644 index 0000000..b5eaa8f Binary files /dev/null and b/images/SpringSecurity/8e1ac9db-5987-484d-abf4-4c6535c60cc6.png differ diff --git a/images/SpringSecurity/8efa0b1c-2b32-4d5b-9655-985374326e10.png b/images/SpringSecurity/8efa0b1c-2b32-4d5b-9655-985374326e10.png new file mode 100644 index 0000000..0ad925f Binary files /dev/null and b/images/SpringSecurity/8efa0b1c-2b32-4d5b-9655-985374326e10.png differ diff --git a/images/SpringSecurity/90d3e369-510f-45cb-982d-241d2eedb55c.png b/images/SpringSecurity/90d3e369-510f-45cb-982d-241d2eedb55c.png new file mode 100644 index 0000000..cd38744 Binary files /dev/null and b/images/SpringSecurity/90d3e369-510f-45cb-982d-241d2eedb55c.png differ diff --git a/images/SpringSecurity/d6e99143-6207-43a5-8d04-f0c81baa11b4.png b/images/SpringSecurity/d6e99143-6207-43a5-8d04-f0c81baa11b4.png new file mode 100644 index 0000000..b51f856 Binary files /dev/null and b/images/SpringSecurity/d6e99143-6207-43a5-8d04-f0c81baa11b4.png differ diff --git a/images/SpringSecurity/f045b025-bd97-4222-8a02-51634be6745b.png b/images/SpringSecurity/f045b025-bd97-4222-8a02-51634be6745b.png new file mode 100644 index 0000000..f2e7a0b Binary files /dev/null and b/images/SpringSecurity/f045b025-bd97-4222-8a02-51634be6745b.png differ diff --git a/images/SpringSecurity/image-20210811091508157.png b/images/SpringSecurity/image-20210811091508157.png new file mode 100644 index 0000000..ac5b449 Binary files /dev/null and b/images/SpringSecurity/image-20210811091508157.png differ diff --git a/images/SpringSecurity/image-20210811091633434.png b/images/SpringSecurity/image-20210811091633434.png new file mode 100644 index 0000000..f98fdda Binary files /dev/null and b/images/SpringSecurity/image-20210811091633434.png differ diff --git a/images/SpringSecurity/image-20210811091659121.png b/images/SpringSecurity/image-20210811091659121.png new file mode 100644 index 0000000..31e8f3f Binary files /dev/null and b/images/SpringSecurity/image-20210811091659121.png differ diff --git a/images/SpringSecurity/image-20210811091719470.png b/images/SpringSecurity/image-20210811091719470.png new file mode 100644 index 0000000..9b2084d Binary files /dev/null and b/images/SpringSecurity/image-20210811091719470.png differ diff --git a/images/SpringSecurity/image-20210811091755498.png b/images/SpringSecurity/image-20210811091755498.png new file mode 100644 index 0000000..5ec049f Binary files /dev/null and b/images/SpringSecurity/image-20210811091755498.png differ diff --git a/images/SpringSecurity/image-20210811091815473.png b/images/SpringSecurity/image-20210811091815473.png new file mode 100644 index 0000000..669662f Binary files /dev/null and b/images/SpringSecurity/image-20210811091815473.png differ diff --git a/images/SpringSecurity/image-20210811091833065.png b/images/SpringSecurity/image-20210811091833065.png new file mode 100644 index 0000000..ee27f6f Binary files /dev/null and b/images/SpringSecurity/image-20210811091833065.png differ diff --git a/images/SpringSecurity/image-20210811092048784.png b/images/SpringSecurity/image-20210811092048784.png new file mode 100644 index 0000000..4ca4f56 Binary files /dev/null and b/images/SpringSecurity/image-20210811092048784.png differ