在Spring Security中，认证授权都是通过过滤器来实现的。
当开始登陆的时候，有一个关键的过滤器UsernamePasswordAuthenticationFilter，该类继承抽象类AbstractAuthenticationProcessingFilter，在AbstractAuthenticationProcessingFilter里有一个doFilter方法，一切先从这里说起。
private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws IOException, ServletException {
if (!requiresAuthentication(request, response)) {
chain.doFilter(request, response);
return;
}
try {
Authentication authenticationResult = attemptAuthentication(request, response);
if (authenticationResult == null) {
// return immediately as subclass has indicated that it hasn't completed
return;
}
this.sessionStrategy.onAuthentication(authenticationResult, request, response);
// Authentication success
if (this.continueChainBeforeSuccessfulAuthentication) {
chain.doFilter(request, response);
}
successfulAuthentication(request, response, chain, authenticationResult);
}
catch (InternalAuthenticationServiceException failed) {
this.logger.error("An internal error occurred while trying to authenticate the user.", failed);
unsuccessfulAuthentication(request, response, failed);
}
catch (AuthenticationException ex) {
// Authentication failed
unsuccessfulAuthentication(request, response, ex);
}
}
首先requiresAuthentication先判断是否尝试校验，通过后调用attemptAuthentication方法，这个方法也就是UsernamePasswordAuthenticationFilter 中的attemptAuthentication方法。
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
throws AuthenticationException {
if (this.postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
}
String username = obtainUsername(request);
username = (username != null) ? username : "";
username = username.trim();
String password = obtainPassword(request);
password = (password != null) ? password : "";
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
// Allow subclasses to set the "details" property
setDetails(request, authRequest);
return this.getAuthenticationManager().authenticate(authRequest);
}
1.在UsernamePasswordAuthenticationFilter 的attemptAuthentication方法中，先是验证请求的类型，是否是POST请求，如果不是的话，抛出异常。(PS：登陆肯定要用POST方法了)
2.然后拿到username和password。这里使用的是obtainUsername方法，也就是get方法。
@Nullable
protected String obtainPassword(HttpServletRequest request) {
return re<p>本文来源gao!%daima.com搞$代*!码$网9</p>quest.getParameter(this.passwordParameter);
}
@Nullable
protected String obtainUsername(HttpServletRequest request) {
return request.getParameter(this.usernameParameter);
}
由此我们知道了Spring Security中是通过get方法来拿到参数，所以在进行前后端分离的时候是无法接受JSON数据，处理方法就是自定义一个Filter来继承UsernamePasswordAuthenticationFilter，重写attemptAuthentication方法，然后创建一个Filter实例写好登陆成功和失败的逻辑处理，在HttpSecurity参数的configure中通过addFilterAt来替换Spring Security官方提供的过滤器。
3.创建一个UsernamePasswordAuthenticationToken 实例。
4.设置Details，在这里关键的是在WebAuthenticationDetails类中记录了用户的remoteAddress和sessionId。
public WebAuthenticationDetails(HttpServletRequest request) {
this.remoteAddress = request.getRemoteAddr();
HttpSession session = request.getSession(false);
this.sessionId = (session != null) ? session.getId() : null;
}
转载请注明原文链接：Spring Security登陆流程讲解
