当前位置：首页 > news >正文

SpringSecurity源码剖析

news 2026/6/8 16:04:22

过滤器链加载源码

spring boot启动中会加载spring.factories文件，在文件中有对应Spring Security的过滤器链的配置信息。

# 安全过滤器自动配置 org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoCo nfiguration

SecurityFilterAutoConfiguration类

@EnableConfigurationProperties({SecurityProperties.class}) @ConditionalOnClass({AbstractSecurityWebApplicationInitializer.class, SessionCreationPolicy.class}) @AutoConfigureAfter({SecurityAutoConfiguration.class}) public class SecurityFilterAutoConfiguration { }

SecurityAutoConfiguration类

@ConditionalOnClass({DefaultAuthenticationEventPublisher.class}) @EnableConfigurationProperties({SecurityProperties.class}) @Import({SpringBootWebSecurityConfiguration.class, WebSecurityEnablerConfiguration.class, SecurityDataConfiguration.class}) public class SecurityAutoConfiguration { }

WebScurityEnableConfiguration类

@Configuration( proxyBeanMethods = false ) @ConditionalOnBean({WebSecurityConfigurerAdapter.class}) @ConditionalOnMissingBean( name = {"springSecurityFilterChain"} ) @ConditionalOnWebApplication( type = Type.SERVLET ) @EnableWebSecurity public class WebSecurityEnablerConfiguration { public WebSecurityEnablerConfiguration() { } }

WebSecurityConfiguration类

/** * 声明 Spring Security 核心过滤器链（默认名称：springSecurityFilterChain） * 对应 AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME */ @Bean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME) public Filter springSecurityFilterChain() throws Exception { // 检查是否有自定义的 WebSecurityConfigurer 配置 boolean hasConfigurers = webSecurityConfigurers != null && !webSecurityConfigurers.isEmpty(); // 如果没有自定义配置，创建默认空适配器（避免构建失败） if (!hasConfigurers) { WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor.postProcess( new WebSecurityConfigurerAdapter() { // 空适配器：仅保证过滤器链能构建，无实际安全规则 @Override protected void configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http) throws Exception { // 6.x 需替换为 http.csrf(AbstractHttpConfigurer::disable) http.csrf().disable(); // 示例：禁用 CSRF（根据业务调整） } } ); webSecurity.apply(adapter); // 将默认适配器应用到 WebSecurity } else { // 如果有自定义配置，遍历应用所有 WebSecurityConfigurer for (WebSecurityConfigurerAdapter configurer : webSecurityConfigurers) { webSecurity.apply(configurer); } } // 构建过滤器链（返回 FilterChainProxy，实现 Filter 接口） Filter filterChain = webSecurity.build(); return filterChain; }