Spring Security 入门到实践（一）HTTP Basic 在 Spring Security 中的应用原理浅析

<dependencies>
        <!-- Spring Security的核心依赖 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <!-- Spring Boot Web的核心依赖 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
</dependencies>

@Slf4j
@Controller
@RequestMapping("/demo")
public class DemoController {
    @GetMapping
    @ResponseBody
    public String index() {
        return "Welcome to learn Spring Security!";
    }
}

# 配置用户名和密码
spring.security.user.name=user
spring.security.user.password=1234

protected void configure(HttpSecurity http) throws Exception {
		logger.debug("Using default configure(HttpSecurity). If subclassed this will potentially override subclass configure(HttpSecurity).");
		http
			.authorizeRequests() // 拦截请求，创建了FilterSecurityInterceptor拦截器
				.anyRequest().authenticated() // 设置所有请求都得经过认证后才可以访问
				.and() // 用and来表示配置过滤器结束，以便进行下一个过滤器的创建和配置
			.formLogin() // 设置表单登录，创建UsernamePasswordAuthenticationFilter拦截器
        .and()
			.httpBasic(); // 开启HTTP Basic，创建BasicAuthenticationFilter拦截器
	}

@Override
public void configure(B http) throws Exception {
    AuthenticationManager authenticationManager = http
        .getSharedObject(AuthenticationManager.class);
    // 创建一个BasicAuthenticationFilter过滤器
    BasicAuthenticationFilter basicAuthenticationFilter = new BasicAuthenticationFilter(
        authenticationManager, this.authenticationEntryPoint);
    if (this.authenticationDetailsSource != null) {
        basicAuthenticationFilter
          .setAuthenticationDetailsSource(this.authenticationDetailsSource);
    }
    RememberMeServices rememberMeServices = http.getSharedObject(RememberMeServices.class);
    if (rememberMeServices != null) {
        basicAuthenticationFilter.setRememberMeServices(rememberMeServices);
    }
    basicAuthenticationFilter = postProcess(basicAuthenticationFilter);
    // 将当前的BasicAuthenticationFilter对象添加到拦截器链中
    http.addFilter(basicAuthenticationFilter);
}

public HttpSecurity addFilter(Filter filter) {
		Class<? extends Filter> filterClass = filter.getClass();
		if (!comparator.isRegistered(filterClass)) {
			throw new IllegalArgumentException(
					"The Filter class "
							  filterClass.getName()
							  " does not have a registered order and cannot be added without a specified order. Consider using addFilterBefore or addFilterAfter instead.");
		}
    // 加入到拦截器列表中
		this.filters.add(filter);
		return this;
}

public boolean isRegistered(Class<? extends Filter> filter) {
		return getOrder(filter) != null;
}

private Integer getOrder(Class<?> clazz) {
		while (clazz != null) {
			Integer result = filterToOrder.get(clazz.getName());
			if (result != null) {
				return result;
			}
			clazz = clazz.getSuperclass();
		}
		return null;
}

FilterComparator() {
		Step order = new Step(INITIAL_ORDER, ORDER_STEP);
		put(ChannelProcessingFilter.class, order.next());
		put(ConcurrentSessionFilter.class, order.next());
		put(WebAsyncManagerIntegrationFilter.class, order.next());
		put(SecurityContextPersistenceFilter.class, order.next());
		put(HeaderWriterFilter.class, order.next());
		put(CorsFilter.class, order.next());
		put(CsrfFilter.class, order.next());
		put(LogoutFilter.class, order.next());
		filterToOrder.put(
			"org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter",
				order.next());
		put(X509AuthenticationFilter.class, order.next());
		put(AbstractPreAuthenticatedProcessingFilter.class, order.next());
		filterToOrder.put("org.springframework.security.cas.web.CasAuthenticationFilter",
				order.next());
		filterToOrder.put(
			"org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter",
				order.next());
		put(UsernamePasswordAuthenticationFilter.class, order.next());
		put(ConcurrentSessionFilter.class, order.next());
		filterToOrder.put(
				"org.springframework.security.openid.OpenIDAuthenticationFilter", order.next());
		put(DefaultLoginPageGeneratingFilter.class, order.next());
		put(DefaultLogoutPageGeneratingFilter.class, order.next());
		put(ConcurrentSessionFilter.class, order.next());
		put(DigestAuthenticationFilter.class, order.next());
		filterToOrder.put(
				"org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter", order.next());
		put(BasicAuthenticationFilter.class, order.next());
		put(RequestCacheAwareFilter.class, order.next());
		put(SecurityContextHolderAwareRequestFilter.class, order.next());
		put(JaasApiIntegrationFilter.class, order.next());
		put(RememberMeAuthenticationFilter.class, order.next());
		put(AnonymousAuthenticationFilter.class, order.next());
		filterToOrder.put(
			"org.springframework.security.oauth2.client.web.OAuth2AuthorizationCodeGrantFilter",
				order.next());
		put(SessionManagementFilter.class, order.next());
		put(ExceptionTranslationFilter.class, order.next());
		put(FilterSecurityInterceptor.class, order.next());
		put(SwitchUserFilter.class, order.next());
}

@Override
protected void doFilterInternal(HttpServletRequest request,
			HttpServletResponse response, FilterChain chain)
					throws IOException, ServletException {
		final boolean debug = this.logger.isDebugEnabled();
		// 从请求头中获取头属性为Authorization的值
		String header = request.getHeader("Authorization");
		// 判断请求头中是否含有该属性或者该属性的值是否是以basic开头的
		if (header == null || !header.toLowerCase().startsWith("basic ")) {
      // 说明不是HTTP Basic认证方式，所以进入到拦截器链的下一个拦截器中，本拦截器不作处理
			chain.doFilter(request, response);
			return;
		}
		try {
      // extractAndDecodeHeader是解码Base64编码后的字符串，获取用户名和密码组成的字符数组
			String[] tokens = extractAndDecodeHeader(header, request);
			assert tokens.length == 2;
			// 数组的第一个值是用户名，第二个值是密码
			String username = tokens[0];
			if (debug) {
				this.logger
						.debug("Basic Authentication Authorization header found for user '"
								  username   "'");
			}
			// 判断当前请求是否需要认证，具体的判断标准可以进入到authenticationIsRequired中查看，这里简单表述一下，这个方法的逻辑是：首先判断Spring Security的上下文环境中是否存在当前用户名对应的认证信息，如果没有或者是有，但是没有认证的，那么就返回true，其次是认证信息是UsernamePasswordAuthenticationToken类型且认证信息的用户名和传入的用户名不一致，那么返回true，最后认证信息是AnonymousAuthenticationToken类型（匿名类型），那么直接返回true，否则其他情况直接返回false，也就是无需再次认证。
			if (authenticationIsRequired(username)) {
        // 将用户名和密码封装成UsernamePasswordAuthenticationToken，并标记为未认证
				UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
						username, tokens[1]);
				authRequest.setDetails(
						this.authenticationDetailsSource.buildDetails(request));
        // 调用认证管理器来进行认证操作，具体的认证步骤在ProviderManager类authenticate方法中，该方法首先是获取Token的类型，此次认证的Token类型是UsernamePasswordAuthenticationToken，然后根据类型找到支持UsernamePasswordAuthenticationToken的Provider对象进行认证
				Authentication authResult = this.authenticationManager
						.authenticate(authRequest);
				if (debug) {
					this.logger.debug("Authentication success: "   authResult);
				}
				// 将认证成功后结果存储到上下文环境中
				SecurityContextHolder.getContext().setAuthentication(authResult);
				// “记住我”中设置记住当前认证信息，这个功能后期会重点介绍
				this.rememberMeServices.loginSuccess(request, response, authResult);
				// 认证成功后的一些处理，可以自行实现
				onSuccessfulAuthentication(request, response, authResult);
			}
		}
    // 如果认证失败，上述的authenticate方法会抛出异常表示认证失败
		catch (AuthenticationException failed) {
      // 清除认证失败的上下文环境
			SecurityContextHolder.clearContext();
			if (debug) {
				this.logger.debug("Authentication request for failed: "   failed);
			}
			// “记住我”的认证失败后的处理，后面会介绍
			this.rememberMeServices.loginFail(request, response);
			// 认证失败后的处理，可以自行实现
			onUnsuccessfulAuthentication(request, response, failed);
			// 是否忽略认证失败，这里默认为false
			if (this.ignoreFailure) {
				chain.doFilter(request, response);
			}
			else {
        // 认证失败后，默认会进入到这里，从而调用到了BasicAuthenticationEntryPoint类中的commence方法，该方法的具体逻辑是在响应体中添加“WWW-Authenticate”的响应头，并设置值为Basic realm="Realm"，这也就是用到了HTTP Basic的基本原理，当浏览器接收到响应之后，发现响应头中包含WWW-Authenticate，就会弹出一个要求输入用户名和密码的对话框，输入用户名和密码后，如果正确，那么就会访问到具体的资源，否则会一直会弹出对话框
				this.authenticationEntryPoint.commence(request, response, failed);
			}
			return;
		}
		chain.doFilter(request, response);
}