spring security 之自定义表单登录源码跟踪

​ 上一节我们跟踪了security的默认登录页的源码，可以参考这里：https://www.cnblogs.com/process-h/p/15522267.html 这节我们来看看如何自定义单表认证页及源码跟踪。

​ 为了实现自定义表单及登录页，我们需要编写自己的WebSecurityConfig类，继承了WebSecurityConfigurerAdapter对象，通过重写configure方法，定义自己的登录页路径及失败跳转的路径。

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests(authorizeRequests ->
                        authorizeRequests
                                .antMatchers("/css/**", "/index").permitAll()
                                .antMatchers("/user/**").hasRole("USER")
                )
                .formLogin(formLogin ->
                        formLogin
                                .loginPage("/login")
                                .failureUrl("/login-error")
                );
    }
    // @formatter:on

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails userDetails = User.withDefaultPasswordEncoder()
                .username("user")
                .password("password")
                .roles("USER")
                .build();
        return new InMemoryUserDetailsManager(userDetails);
    }
}

我们通过引入Thymeleaf模板来实现跳转

@Controller
public class MainController {

   @RequestMapping("/")
   public String root() {
      return "redirect:/index";
   }

   @RequestMapping("/index")
   public String index() {
      return "index";
   }

   @RequestMapping("/user/index")
   public String userIndex() {
      return "user/index";
   }

   @RequestMapping("/login")
   public String login() {
      return "login";
   }

   @RequestMapping("/login-error")
   public String loginError(Model model) {
      model.addAttribute("loginError", true);
      return "login";
   }

}

上一节我们提到了WebSecurityConfig类，它会有一个init方法

@Override
public void init(WebSecurity web) throws Exception {
   HttpSecurity http = getHttp();
   web.addSecurityFilterChainBuilder(http).postBuildAction(() -> {
      FilterSecurityInterceptor securityInterceptor = http.getSharedObject(FilterSecurityInterceptor.class);
      web.securityInterceptor(securityInterceptor);
   });
}

这里提到了HttpSecurity对象，顾名思义，它的作用就是保证Http请求的安全，那么它是如何保证http请求的安全的呢？我们来看看getHttp()方法

protected final HttpSecurity getHttp() throws Exception {
   if (this.http != null) {
      return this.http;
   }
    // 初始化认证事件发布者，也就是定义了一些异常跟异常事件类之前的映射关系
   AuthenticationEventPublisher eventPublisher = getAuthenticationEventPublisher();
   this.localConfigureAuthenticationBldr.authenticationEventPublisher(eventPublisher);
    // 初始化认证管理者
   AuthenticationManager authenticationManager = authenticationManager();
   this.authenticationBuilder.parentAuthenticationManager(authenticationManager);
   Map<Class<?>, Object> sharedObjects = createSharedObjects();
   this.http = new HttpSecurity(this.objectPostProcessor, this.authenticationBuilder, sharedObjects);
   if (!this.disableDefaults) {
       // 默认情况下会去加载配置
      applyDefaultConfiguration(this.http);
      ClassLoader classLoader = this.context.getClassLoader();
      List<AbstractHttpConfigurer> defaultHttpConfigurers = SpringFactoriesLoader
            .loadFactories(AbstractHttpConfigurer.class, classLoader);
      for (AbstractHttpConfigurer configurer : defaultHttpConfigurers) {
         this.http.apply(configurer);
      }
   }
   configure(this.http);
   return this.http;
}

// 默认认证事件发布者
public DefaultAuthenticationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
		this.applicationEventPublisher = applicationEventPublisher;
		addMapping(BadCredentialsException.class.getName(), AuthenticationFailureBadCredentialsEvent.class);
		addMapping(UsernameNotFoundException.class.getName(), AuthenticationFailureBadCredentialsEvent.class);
		addMapping(AccountExpiredException.class.getName(), AuthenticationFailureExpiredEvent.class);
		addMapping(ProviderNotFoundException.class.getName(), AuthenticationFailureProviderNotFoundEvent.class);
		addMapping(DisabledException.class.getName(), AuthenticationFailureDisabledEvent.class);
		addMapping(LockedException.class.getName(), AuthenticationFailureLockedEvent.class);
		addMapping(AuthenticationServiceException.class.getName(), AuthenticationFailureServiceExceptionEvent.class);
		addMapping(CredentialsExpiredException.class.getName(), AuthenticationFailureCredentialsExpiredEvent.class);
		addMapping("org.springframework.security.authentication.cas.ProxyUntrustedException",
				AuthenticationFailureProxyUntrustedEvent.class);
		addMapping("org.springframework.security.oauth2.server.resource.InvalidBearerTokenException",
				AuthenticationFailureBadCredentialsEvent.class);
	}

我们来看看applyDefaultConfiguration这个方法，在上一节有讲到，这里是给httpSecurity对象配置一些默认的配置，比如默认会开启csrf跨站请求伪造防护，添加WebAsyncManagerIntegrationFilter过滤器，添加默认的登录页配置DefaultLoginPageConfigurer等。

private void applyDefaultConfiguration(HttpSecurity http) throws Exception {
   http.csrf();
   http.addFilter(new WebAsyncManagerIntegrationFilter());
   http.exceptionHandling();
   http.headers();
   http.sessionManagement();
   http.securityContext();
   http.requestCache();
   http.anonymous();
   http.servletApi();
   http.apply(new DefaultLoginPageConfigurer<>());
   http.logout();
}

回到调用applyDefaultConfiguration()的主方法这里，执行完if (!this.disableDefaults) {}分支之后，会调用自身的configure(this.http);方法，也就是我们自定义的WebSecurityConfig类中重写的方法，会去执行我们的表单登录配置策略。

.formLogin(formLogin ->
        formLogin
                .loginPage("/login")
                .failureUrl("/login-error")
);
@Override
public FormLoginConfigurer<H> loginPage(String loginPage) {
    return super.loginPage(loginPage);
}
protected T loginPage(String loginPage) {
    setLoginPage(loginPage);
    updateAuthenticationDefaults();
    this.customLoginPage = true;
    return getSelf();
}

点击.loginPage("/login")方法，再点击super.loginPage(loginPage); 可以看到登录页已经被重写了，自定义登录页标志也被写成了true。

​ 自定义表单登录页及源码跟踪就到这里，过程中还发现了跟security最为密切的filter顺序定义，在该FilterOrderRegistration类的构造方法中，定义了security中可能会用到的所有filter的顺序，有兴趣的读者自行阅读下。登录相关的源码跟的线条比较粗，接下来该看看认证跟授权的部分了。