requestMatchers)` -> `return new AuthorizedUrl(requestMatchers);`
+
+`http.authorizeRequests().anyRequest().authenticated();`是需要所有请求登录后才能访问
+
+1. `authorizeRequests`是创建了一个`ExpressionUrlAuthorizationConfigurer`并添加入configurer中.
+2. `anyRequest`是创建了一个`new AuthorizedUrl(requestMatchers)`,其中 `requestMatchers`是`AnyRequestMatcher.INSTANCE;`也就是`AnyRequestMatcher`对象.里面`matches(HttpServletRequest request)`直接返回ture
+3. `authenticated()`也就是授权,`ExpressionInterceptUrlRegistry#addMapping`.里面放入了一个`UrlMapping`,`UrlMapping`的俩个属性,一个是`AnyRequestMatcher`(所有请求),`configAttrs`表示`SecurityConfig`.`SecurityConfig`的值为`private static final String authenticated = "authenticated"`
+
+> http.formLogin();
+
+创建了一个`FormLoginConfigurer`,也就是`SecurityConfigurer`.关注`init`和`configure`方法.后面统一讲解
+
+> http.httpBasic();
+
+`HttpBasicConfigurer`类
+
+> http.build()
+
+进行构建,这个就是非常重要的一个方法,build对象,老规矩.进入`AbstractConfiguredSecurityBuilder#doBuild()`方法
+`beforeInit();`: 还是没有什么
+
+`init()`: 调用里面所有的`configurers`里面的`init方法`,后面`HttpSecurity#doBuild`统一讲解,先把流程捋一遍
+
+接下来`SecurityFilterChain`就已经创建好了,看一下里面的方法
+```java
+/**
+ * Defines a filter chain which is capable of being matched against an
+ * {@code HttpServletRequest}. in order to decide whether it applies to that request.
+ *
+ * Used to configure a {@code FilterChainProxy}.
+ *
+ * @author Luke Taylor
+ * @since 3.1
+ */
+public interface SecurityFilterChain {
+
+ boolean matches(HttpServletRequest request);
+
+ List getFilters();
+}
+```
+肯定是先匹配,如果成功了,就返回里面所有的filter进行过滤,比如刚刚设置的所有请求需要登录,也还有我们需要排除的请求
+
+`SecurityAutoConfiguration`类就已经大致讲完了,
+
+### @EnableGlobalAuthentication
+当前注解在`@EnableSecurity`中会自动加上
+
+#### @Import(AuthenticationConfiguration.class)
+
+`AuthenticationConfiguration`上面`@Import(ObjectPostProcessorConfiguration.class)`. 以前使用的`ObjectPostProcessor`就是在这里注入的,注入`AutowireBeanFactoryObjectPostProcessor`对象
+
+#### AuthenticationManagerBuilder
+```java
+@Bean
+ public AuthenticationManagerBuilder authenticationManagerBuilder(ObjectPostProcessor