Spring Security基于HttpRequest配置权限示例详解

http.authorizehttprequests(requestmatcherregstry -> 
// /admin/** 需要有amind角色
	requestmatcherregstry.requestmatchers("/admin/**").hasrole("admin")
			// /log/** 只要有amind、user角色之一
          .requestmatchers("/log/**").hasanyrole("admin", "user")
			// 任意请求 只要登录了即可访问
          .anyrequest().authenticated()
);

/**
 * 这个方法是httpsecurity的方法。
 * 作用是配置authorizationfilter。
 * 其入参authorizehttprequestscustomizer正是让我们配置authorizationfilter的关键。
 * customizer：就是定制。原理比较容易理解，就是我把你需要配置的东西丢给你，你往里面赋值。
 * authorizehttprequestsconfigurer<httpsecurity>：这个是configurer的实现，负责引入过滤器的。这里明显就是引入authorizationfilter
 * authorizationmanagerrequestmatcherregistry：这个就是我们最终配置的东西。而这个配置的正是我们上面的requestmatcherdelegatingauthorizationmanager。说白了就是往里面添加哪些路径对应哪些authorizationmanager。只不过，为了方便使用，也帮我们都封装好了。不妨继续往后看看。
 */
public httpsecurity authorizehttprequests(
			customizer<authorizehttprequestsconfigurer<httpsecurity>.authorizationmanagerrequestmatcherregistry> authorizehttprequestscustomizer)
			throws exception {
		applicationcontext context = getcontext();
		// 这里干了三个事情：
		// 1. 如果当前httpsecurity不存在authorizehttprequestsconfigurer，则创建一个，并注册到当前的httpsecurity对象中。
		// 2. 从authorizehttprequestsconfigurer拿到他的注册器也就是authorizationmanagerrequestmatcherregistry
		// 3. 调用传入的参数的customize。如此，我们传入的lambda表达式就被调用了。
		authorizehttprequestscustomizer
			.customize(getorapply(new authorizehttprequestsconfigurer<>(context)).getregistry());
		return httpsecurity.this;
	}

public final class authorizationmanagerrequestmatcherregistry
		extends abstractrequestmatcherregistry<authorizedurl> {
	/**
	 * 这是父类的方法
	 * c代表的是authorizedurl
	 */
	public c requestmatchers(string... patterns) {
		// 调用的重载方法第一个参数为httpmethod，也就是说，我们还可以指定http请求的方法，例如：post、get等
		return requestmatchers(null, patterns);
	}
	@override
	protected authorizedurl chainrequestmatchers(list<requestmatcher> requestmatchers) {
		this.unmappedmatchers = requestmatchers;
		return new authorizedurl(requestmatchers);
	}
}
public class authorizedurl {
	private final list<? extends requestmatcher> matchers;
	public authorizationmanagerrequestmatcherregistry permitall() {
		return access(permitallauthorizationmanager);
	}
	public authorizationmanagerrequestmatcherregistry hasrole(string role) {
		return access(withrolehierarchy(authorityauthorizationmanager.hasrole(role)));
	}
	public authorizationmanagerrequestmatcherregistry hasanyauthority(string... authorities) {
		return access(withrolehierarchy(authorityauthorizationmanager.hasanyauthority(authorities)));
	}
	public authorizationmanagerrequestmatcherregistry authenticated() {
		return access(authenticatedauthorizationmanager.authenticated());
	}
	public authorizationmanagerrequestmatcherregistry access(
		authorizationmanager<requestauthorizationcontext> manager) {
		assert.notnull(manager, "manager cannot be null");
		return authorizehttprequestsconfigurer.this.addmapping(this.matchers, manager);
	}
}
public final class authorizehttprequestsconfigurer<h extends httpsecuritybuilder<h>>
		extends abstracthttpconfigurer<authorizehttprequestsconfigurer<h>, h> {
	private authorizationmanagerrequestmatcherregistry addmapping(list<? extends requestmatcher> matchers,
		authorizationmanager<requestauthorizationcontext> manager) {
		for (requestmatcher matcher : matchers) {
			this.registry.addmapping(matcher, manager);
		}
		return this.registry;
	}
}

requestmatcherregstry -> requestmatcherregstry.requestmatchers("/admin/**").hasrole("admin")

public class authorizationfilter extends genericfilterbean {
	@override
	public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain chain)
			throws servletexception, ioexception {
		// 类型转换
		httpservletrequest request = (httpservletrequest) servletrequest;
		httpservletresponse response = (httpservletresponse) servletresponse;
		// 是否需要执行鉴权
		if (this.observeonceperrequest && isapplied(request)) {
			chain.dofilter(request, response);
			return;
		}
		// /error和异步请求不处理
		if (skipdispatch(request)) {
			chain.dofilter(request, response);
			return;
		}
		// 是否已经执行过鉴权逻辑了
		string alreadyfilteredattributename = getalreadyfilteredattributename();
		request.setattribute(alreadyfilteredattributename, boolean.true);
		try {
			// 从securitycontextholder中获取凭证，并通过authorizationmanager做出决策
			authorizationdecision decision = this.authorizationmanager.check(this::getauthentication, request);
			// 发布鉴权事件
			this.eventpublisher.publishauthorizationevent(this::getauthentication, request, decision);
			if (decision != null && !decision.isgranted()) {
				// 拒绝访问异常
				throw new accessdeniedexception("access denied");
			}
			// 正常执行后续业务逻辑
			chain.dofilter(request, response);
		}
		finally {
			// 处理完业务逻辑后，为当前请求清理标识			
			request.removeattribute(alreadyfilteredattributename);
		}
	}
}

public final class requestmatcherdelegatingauthorizationmanager implements authorizationmanager<httpservletrequest> {
@override
	public authorizationdecision check(supplier<authentication> authentication, httpservletrequest request) {
		// 遍历每一个已经登录好的路径，找到对应的authorizationmanager<requestauthorizationcontext>>
		for (requestmatcherentry<authorizationmanager<requestauthorizationcontext>> mapping : this.mappings) {
			requestmatcher matcher = mapping.getrequestmatcher();
			// 匹配当前请求
			matchresult matchresult = matcher.matcher(request);
			if (matchresult.ismatch()) {
				// 找到匹配的authorizationmanager就直接调用check方法并返回鉴权结果
				authorizationmanager<requestauthorizationcontext> manager = mapping.getentry();
				return manager.check(authentication,
						new requestauthorizationcontext(request, matchresult.getvariables()));
			}
		}
		// 没有匹配的authorizationmanager则返回拒绝当前请求
		return deny;
	}
}