Spring Security 源码分析十：认证跳转逻辑 (login redirect)

@Controller
@EnableAutoConfiguration
public class DemoApplication {

    // 通过 ViewControllerRegistry 快速的注册 controller 与 html 页面之间的映射，注意必须使用到 thymeleaf
    @Configuration
    static class MvcConfig extends WebMvcConfigurerAdapter {
        @Override
        public void addViewControllers(ViewControllerRegistry registry) {
         
         // 备注，login Getter 登录路径必须配置在 Spring Security 的相对路径中；否则 csrf token 等与 Spring Security 相关的信息并不会返回；
            registry.addViewController("/web/login").setViewName("login"); 
            
            registry.addViewController("/web/report").setViewName("report");
            
            registry.addViewController("/").setViewName("index");
            
        }
    }
    
    /**
     * 在执行过程中，测试了两个 Filter Chain，两者是使用的不同的 SecurityChainFilter 对象，一个是对象的 ID 是 92 一个是 138
     * 
     * @author shangyang
     */
    
    @Configuration
    @EnableWebSecurity
    @Order(1)
    static class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      
      @Autowired
      public void configUser(AuthenticationManagerBuilder builder) throws Exception {
         
         builder
            .inMemoryAuthentication()
               .withUser("user").password("password").roles("USER").and()  
               .withUser("manager").password("password").roles("MANAGER");
         
      }
      
        @Override
        protected void configure(HttpSecurity http) throws Exception {
         
            http.antMatcher("/web/**") // the filter chain defined for web request
               .authorizeRequests()
                  .antMatchers("/web/report/**").hasRole("MANAGER")
                  .anyRequest().authenticated()
               .and()
               .formLogin()
                  // login 的相对路径必须与 security chain 的的相对路径吻合，这里是 /web/**；注意 login 分两步，一步是 Getter 会到 login.html，另外一步是从 login.html -> post -> /web/login/
                  .loginPage("/web/login")
                  // 允许访问
                  .permitAll(); 
            
        }    
    }
}

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
      throws IOException, ServletException {

   HttpServletRequest request = (HttpServletRequest) req;
   HttpServletResponse response = (HttpServletResponse) res;

   // ① 如果访问请求不是 POST 或 PUT 操作将不会执行后续的操作
   if (!requiresAuthentication(request, response)) {
      chain.doFilter(request, response);

      return;
   }

   ......

   // ② 进行验证和跳转操作

   Authentication authResult;

   try {
      // 2.1 使用相关子类进行用户认证操作，这里使用的是 UsernamePasswordAuthentcationFilter
      authResult = attemptAuthentication(request, response);
      if (authResult == null) {
         return;
      }
      // 2.2 认证成功以后，使用 Session Authentication Strategies 进行后续处理
      sessionStrategy.onAuthentication(authResult, request, response);
   }
   catch (InternalAuthenticationServiceException failed) {
      logger.error(
            "An internal error occurred while trying to authenticate the user.",
            failed);
      // 认证异常处理流程
      unsuccessfulAuthentication(request, response, failed);

      return;
   }
   catch (AuthenticationException failed) {
      // Authentication failed
      unsuccessfulAuthentication(request, response, failed);

      return;
   }

   ...

   // 2.3 成功以后的跳转逻辑
   successfulAuthentication(request, response, chain, authResult);
}

public class RequestCacheAwareFilter extends GenericFilterBean {

   private RequestCache requestCache;

   public RequestCacheAwareFilter() {
      this(new HttpSessionRequestCache());
   }

   public RequestCacheAwareFilter(RequestCache requestCache) {
      Assert.notNull(requestCache, "requestCache cannot be null");
      this.requestCache = requestCache;
   }

   public void doFilter(ServletRequest request, ServletResponse response,
         FilterChain chain) throws IOException, ServletException {

      HttpServletRequest wrappedSavedRequest = requestCache.getMatchingRequest(
            (HttpServletRequest) request, (HttpServletResponse) response);

      chain.doFilter(wrappedSavedRequest == null ? request : wrappedSavedRequest,
            response);
   }

}

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
      throws IOException, ServletException {
   HttpServletRequest request = (HttpServletRequest) req;
   HttpServletResponse response = (HttpServletResponse) res;

   try {
      chain.doFilter(request, response);

      logger.debug("Chain processed normally");
   }
   catch (IOException ex) {
      throw ex;
   }
   catch (Exception ex) {
      // Try to extract a SpringSecurityException from the stacktrace
      Throwable[] causeChain = throwableAnalyzer.determineCauseChain(ex);
      RuntimeException ase = (AuthenticationException) throwableAnalyzer
            .getFirstThrowableOfType(AuthenticationException.class, causeChain);

      if (ase == null) {
         ase = (AccessDeniedException) throwableAnalyzer.getFirstThrowableOfType(
               AccessDeniedException.class, causeChain);
      }

      if (ase != null) {
         handleSpringSecurityException(request, response, chain, ase);
      }
      else {
         // Rethrow ServletExceptions and RuntimeExceptions as-is
         if (ex instanceof ServletException) {
            throw (ServletException) ex;
         }
         else if (ex instanceof RuntimeException) {
            throw (RuntimeException) ex;
         }

         // Wrap other Exceptions. This shouldn't actually happen
         // as we've already covered all the possibilities for doFilter
         throw new RuntimeException(ex);
      }
   }
}

protected String buildRedirectUrlToLoginPage(HttpServletRequest request,
      HttpServletResponse response, AuthenticationException authException) {

   String loginForm = determineUrlToUseForThisRequest(request, response,
         authException);

   if (UrlUtils.isAbsoluteUrl(loginForm)) {
      return loginForm;
   }

   int serverPort = portResolver.getServerPort(request);
   String scheme = request.getScheme();

   RedirectUrlBuilder urlBuilder = new RedirectUrlBuilder();

   urlBuilder.setScheme(scheme);
   urlBuilder.setServerName(request.getServerName());
   urlBuilder.setPort(serverPort);
   urlBuilder.setContextPath(request.getContextPath());
   urlBuilder.setPathInfo(loginForm);

   if (forceHttps && "http".equals(scheme)) {
      Integer httpsPort = portMapper.lookupHttpsPort(Integer.valueOf(serverPort));

      if (httpsPort != null) {
         // Overwrite scheme and port in the redirect URL
         urlBuilder.setScheme("https");
         urlBuilder.setPort(httpsPort.intValue());
      }
      else {
         logger.warn("Unable to redirect to HTTPS as no port mapping found for HTTP port "
               + serverPort);
      }
   }

   return urlBuilder.getUrl();
}