spring security 默认登录页面(项目搭建步骤)_Java

spring security是一个强大且高度可定制的身份验证和访问控制框架。天然与spring整合，易扩展，引入jar包就可以用了，在boot自动装载下，不需要任何配置就可以控制资源访问。那么默认登录页是如何产生的呢？

版本信息

内容	版本
jdk	17
spring-boot-starter-web	3.2.2
spring-boot-starter-security	3.2.2
spring-security	6.2.1

项目搭建步骤

访问 https://start.spring.io/ 自动生成项目

添加依赖 spring web、spring security

生成项目，点击 generate，会下载一个压缩包
添加 controller 代码

package com.example.security.controller;
import org.springframework.web.bind.annotation.getmapping;
import org.springframework.web.bind.annotation.restcontroller;
@restcontroller
public class hellocontroller {
    @getmapping(value = "/hello")
    public string hello() {
        return "hello security";
    }
}

启动项目，访问 http://localhost:8080/hello，会重定向到登录页面

为啥为重定向到登录页面？登录页面如何生成的？

源码解析

先找一下 spring-boot-test-autoconfigure jar 包，找到文件org.springframework.boot.autoconfigure.autoconfiguration.imports，检索 security, 发现有如下类

过滤器链是通过 securityautoconfiguration 导入的类springbootwebsecurityconfiguration 配置的 org.springframework.boot.autoconfigure.security.servlet.springbootwebsecurityconfiguration.websecurityenablerconfiguration

打印出默认过滤器链

2024-02-01t23:19:18.288+08:00  info 15696 --- [           main] o.s.s.web.defaultsecurityfilterchain     : will secure any request with [org.springframework.security.web.session.disableencodeurlfilter@748ac6f3, org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter@68f6e55d, org.springframework.security.web.context.securitycontextholderfilter@3238e2aa, org.springframework.security.web.header.headerwriterfilter@71adfedd, org.springframework.web.filter.corsfilter@6fff46bf, org.springframework.security.web.csrf.csrffilter@5f36c8e3, org.springframework.security.web.authentication.logout.logoutfilter@217bf99e, org.springframework.security.web.authentication.usernamepasswordauthenticationfilter@67022ea, org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter@38b3f208, org.springframework.security.web.authentication.ui.defaultlogoutpagegeneratingfilter@1835dc92, org.springframework.security.web.authentication.www.basicauthenticationfilter@7ec95456, org.springframework.security.web.savedrequest.requestcacheawarefilter@2577a95d, org.springframework.security.web.servletapi.securitycontextholderawarerequestfilter@1668919e, org.springframework.security.web.authentication.anonymousauthenticationfilter@3aaa3c39, org.springframework.security.web.access.exceptiontranslationfilter@17e9bc9e, org.springframework.security.web.access.intercept.authorizationfilter@7327a447]

/**
	 * adds the {@link enablewebsecurity @enablewebsecurity} annotation if spring security
	 * is on the classpath. this will make sure that the annotation is present with
	 * default security auto-configuration and also if the user adds custom security and
	 * forgets to add the annotation. if {@link enablewebsecurity @enablewebsecurity} has
	 * already been added or if a bean with name
	 * {@value beanids#spring_security_filter_chain} has been configured by the user, this
	 * will back-off.
	 */
	@configuration(proxybeanmethods = false)
	@conditionalonmissingbean(name = beanids.spring_security_filter_chain)
	@conditionalonclass(enablewebsecurity.class)
	@enablewebsecurity
	static class websecurityenablerconfiguration {
	}

核心的注解类 org.springframework.security.config.annotation.web.configuration.enablewebsecurity

org.springframework.security.config.annotation.web.builders.websecurity#performbuild

在类org.springframework.security.web.filterchainproxy.virtualfilterchain#dofilter 加一个断点，看每个过滤器做了啥

经过调试，发现默认页面在 org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter 这个类生成的，方法 generateloginpagehtml

过滤器处理具体分析

spring-boot-starter-security 默认会加载以下过滤器

[defaultsecurityfilterchain [requestmatcher=any request, filters=[
org.springframework.security.web.session.disableencodeurlfilter@65a9ea3c, 
org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter@70f68288, 
org.springframework.security.web.context.securitycontextholderfilter@22c53d82, 
org.springframework.security.web.header.headerwriterfilter@2577a95d, 
org.springframework.web.filter.corsfilter@46911148, 
org.springframework.security.web.csrf.csrffilter@6d0be7ab, 
org.springframework.security.web.authentication.logout.logoutfilter@58af5076, 
org.springframework.security.web.authentication.usernamepasswordauthenticationfilter@1fbf088b, 
org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter@3b4a1a75, 
org.springframework.security.web.authentication.ui.defaultlogoutpagegeneratingfilter@2db1b657, 
org.springframework.security.web.authentication.www.basicauthenticationfilter@650c405c, 
org.springframework.security.web.savedrequest.requestcacheawarefilter@68d6d775, 
org.springframework.security.web.servletapi.securitycontextholderawarerequestfilter@b67cc70, 
org.springframework.security.web.authentication.anonymousauthenticationfilter@7e351d7, 
org.springframework.security.web.access.exceptiontranslationfilter@9301672, 
org.springframework.security.web.access.intercept.authorizationfilter@11d045b4]]]

开启 trace 级别日志

修改 application.properties 文件，增加日志配置

logging.level.org.springframework.security=trace

访问地址 http://localhost:8080/hello，可以看到有详细的日志输出

2024-02-03t09:24:07.863+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : trying to match request against defaultsecurityfilterchain [requestmatcher=any request, filters=[org.springframework.security.web.session.disableencodeurlfilter@4eaa375c, org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter@2404b5a, org.springframework.security.web.context.securitycontextholderfilter@6088451e, org.springframework.security.web.header.headerwriterfilter@3ba3d4b6, org.springframework.web.filter.corsfilter@3af58f76, org.springframework.security.web.csrf.csrffilter@6bcb12e6, org.springframework.security.web.authentication.logout.logoutfilter@3a7e365, org.springframework.security.web.authentication.usernamepasswordauthenticationfilter@5f05c8d6, org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter@5416f8db, org.springframework.security.web.authentication.ui.defaultlogoutpagegeneratingfilter@2ead6ba4, org.springframework.security.web.authentication.www.basicauthenticationfilter@7885776b, org.springframework.security.web.savedrequest.requestcacheawarefilter@2f10f633, org.springframework.security.web.servletapi.securitycontextholderawarerequestfilter@1642eeae, org.springframework.security.web.authentication.anonymousauthenticationfilter@31a2a9fa, org.springframework.security.web.access.exceptiontranslationfilter@40de8f93, org.springframework.security.web.access.intercept.authorizationfilter@78422efb]] (1/1)
2024-02-03t09:24:07.864+08:00 debug 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : securing get /hello
2024-02-03t09:24:07.864+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking disableencodeurlfilter (1/16)
2024-02-03t09:24:07.864+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking webasyncmanagerintegrationfilter (2/16)
2024-02-03t09:24:07.864+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking securitycontextholderfilter (3/16)
2024-02-03t09:24:07.864+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking headerwriterfilter (4/16)
2024-02-03t09:24:07.864+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking corsfilter (5/16)
2024-02-03t09:24:07.865+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking csrffilter (6/16)
2024-02-03t09:24:07.865+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.csrf.csrffilter         : did not protect against csrf since request did not match csrfnotrequired [trace, head, get, options]
2024-02-03t09:24:07.865+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking logoutfilter (7/16)
2024-02-03t09:24:07.865+08:00 trace 13892 --- [nio-8080-exec-7] o.s.s.w.a.logout.logoutfilter            : did not match request to ant [pattern='/logout', post]
2024-02-03t09:24:07.865+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking usernamepasswordauthenticationfilter (8/16)
2024-02-03t09:24:07.865+08:00 trace 13892 --- [nio-8080-exec-7] w.a.usernamepasswordauthenticationfilter : did not match request to ant [pattern='/login', post]
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking defaultloginpagegeneratingfilter (9/16)
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking defaultlogoutpagegeneratingfilter (10/16)
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] .w.a.u.defaultlogoutpagegeneratingfilter : did not render default logout page since request did not match [ant [pattern='/logout', get]]
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking basicauthenticationfilter (11/16)
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.s.w.a.www.basicauthenticationfilter  : did not process authentication request since failed to find username and password in basic authorization header
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking requestcacheawarefilter (12/16)
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.s.w.s.httpsessionrequestcache        : matchingrequestparametername is required for getmatchingrequest to lookup a value, but not provided
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking securitycontextholderawarerequestfilter (13/16)
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking anonymousauthenticationfilter (14/16)
2024-02-03t09:24:07.866+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking exceptiontranslationfilter (15/16)
2024-02-03t09:24:07.867+08:00 trace 13892 --- [nio-8080-exec-7] o.s.security.web.filterchainproxy        : invoking authorizationfilter (16/16)
2024-02-03t09:24:07.867+08:00 trace 13892 --- [nio-8080-exec-7] estmatcherdelegatingauthorizationmanager : authorizing securitycontextholderawarerequestwrapper[ org.springframework.security.web.header.headerwriterfilter$headerwriterrequest@219ea36b]
2024-02-03t09:24:07.867+08:00 trace 13892 --- [nio-8080-exec-7] estmatcherdelegatingauthorizationmanager : checking authorization on securitycontextholderawarerequestwrapper[ org.springframework.security.web.header.headerwriterfilter$headerwriterrequest@219ea36b] using org.springframework.security.authorization.authenticatedauthorizationmanager@2973568c
2024-02-03t09:24:07.867+08:00 trace 13892 --- [nio-8080-exec-7] w.c.httpsessionsecuritycontextrepository : did not find securitycontext in httpsession 9103c6e281234fe6ba1b598a7fc64d41 using the spring_security_context session attribute
2024-02-03t09:24:07.867+08:00 trace 13892 --- [nio-8080-exec-7] .s.s.w.c.supplierdeferredsecuritycontext : created securitycontextimpl [null authentication]
2024-02-03t09:24:07.867+08:00 trace 13892 --- [nio-8080-exec-7] .s.s.w.c.supplierdeferredsecuritycontext : created securitycontextimpl [null authentication]
2024-02-03t09:24:07.868+08:00 trace 13892 --- [nio-8080-exec-7] o.s.s.w.a.anonymousauthenticationfilter  : set securitycontextholder to anonymousauthenticationtoken [principal=anonymoususer, credentials=[protected], authenticated=true, details=webauthenticationdetails [remoteipaddress=0:0:0:0:0:0:0:1, sessionid=9103c6e281234fe6ba1b598a7fc64d41], granted authorities=[role_anonymous]]
2024-02-03t09:24:07.868+08:00 trace 13892 --- [nio-8080-exec-7] o.s.s.w.a.exceptiontranslationfilter     : sending anonymousauthenticationtoken [principal=anonymoususer, credentials=[protected], authenticated=true, details=webauthenticationdetails [remoteipaddress=0:0:0:0:0:0:0:1, sessionid=9103c6e281234fe6ba1b598a7fc64d41], granted authorities=[role_anonymous]] to authentication entry point since access is denied
org.springframework.security.access.accessdeniedexception: access denied
	at org.springframework.security.web.access.intercept.authorizationfilter.dofilter(authorizationfilter.java:98) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.access.exceptiontranslationfilter.dofilter(exceptiontranslationfilter.java:126) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.access.exceptiontranslationfilter.dofilter(exceptiontranslationfilter.java:120) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.anonymousauthenticationfilter.dofilter(anonymousauthenticationfilter.java:100) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.servletapi.securitycontextholderawarerequestfilter.dofilter(securitycontextholderawarerequestfilter.java:179) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.savedrequest.requestcacheawarefilter.dofilter(requestcacheawarefilter.java:63) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.www.basicauthenticationfilter.dofilterinternal(basicauthenticationfilter.java:181) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.ui.defaultlogoutpagegeneratingfilter.dofilterinternal(defaultlogoutpagegeneratingfilter.java:58) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter.dofilter(defaultloginpagegeneratingfilter.java:189) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter.dofilter(defaultloginpagegeneratingfilter.java:175) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.abstractauthenticationprocessingfilter.dofilter(abstractauthenticationprocessingfilter.java:227) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.abstractauthenticationprocessingfilter.dofilter(abstractauthenticationprocessingfilter.java:221) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.logout.logoutfilter.dofilter(logoutfilter.java:107) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.authentication.logout.logoutfilter.dofilter(logoutfilter.java:93) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.csrf.csrffilter.dofilterinternal(csrffilter.java:117) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.corsfilter.dofilterinternal(corsfilter.java:91) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.header.headerwriterfilter.doheadersafter(headerwriterfilter.java:90) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.header.headerwriterfilter.dofilterinternal(headerwriterfilter.java:75) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.context.securitycontextholderfilter.dofilter(securitycontextholderfilter.java:82) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.context.securitycontextholderfilter.dofilter(securitycontextholderfilter.java:69) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter.dofilterinternal(webasyncmanagerintegrationfilter.java:62) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.session.disableencodeurlfilter.dofilterinternal(disableencodeurlfilter.java:42) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.web.filterchainproxy$virtualfilterchain.dofilter(filterchainproxy.java:374) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy.dofilterinternal(filterchainproxy.java:233) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.security.web.filterchainproxy.dofilter(filterchainproxy.java:191) ~[spring-security-web-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.compositefilter$virtualfilterchain.dofilter(compositefilter.java:113) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.servlet.handler.handlermappingintrospector.lambda$createcachefilter$3(handlermappingintrospector.java:195) ~[spring-webmvc-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.compositefilter$virtualfilterchain.dofilter(compositefilter.java:113) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.compositefilter.dofilter(compositefilter.java:74) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.security.config.annotation.web.configuration.webmvcsecurityconfiguration$compositefilterchainproxy.dofilter(webmvcsecurityconfiguration.java:225) ~[spring-security-config-6.2.1.jar:6.2.1]
	at org.springframework.web.filter.delegatingfilterproxy.invokedelegate(delegatingfilterproxy.java:352) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.delegatingfilterproxy.dofilter(delegatingfilterproxy.java:268) ~[spring-web-6.1.3.jar:6.1.3]
	at org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:174) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:149) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.springframework.web.filter.requestcontextfilter.dofilterinternal(requestcontextfilter.java:100) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:174) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:149) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.springframework.web.filter.formcontentfilter.dofilterinternal(formcontentfilter.java:93) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:174) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:149) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.springframework.web.filter.characterencodingfilter.dofilterinternal(characterencodingfilter.java:201) ~[spring-web-6.1.3.jar:6.1.3]
	at org.springframework.web.filter.onceperrequestfilter.dofilter(onceperrequestfilter.java:116) ~[spring-web-6.1.3.jar:6.1.3]
	at org.apache.catalina.core.applicationfilterchain.internaldofilter(applicationfilterchain.java:174) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.applicationfilterchain.dofilter(applicationfilterchain.java:149) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.standardwrappervalve.invoke(standardwrappervalve.java:167) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.standardcontextvalve.invoke(standardcontextvalve.java:90) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.authenticator.authenticatorbase.invoke(authenticatorbase.java:482) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.standardhostvalve.invoke(standardhostvalve.java:115) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.valves.errorreportvalve.invoke(errorreportvalve.java:93) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.core.standardenginevalve.invoke(standardenginevalve.java:74) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.catalina.connector.coyoteadapter.service(coyoteadapter.java:340) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.coyote.http11.http11processor.service(http11processor.java:391) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.coyote.abstractprocessorlight.process(abstractprocessorlight.java:63) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.coyote.abstractprotocol$connectionhandler.process(abstractprotocol.java:896) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.tomcat.util.net.nioendpoint$socketprocessor.dorun(nioendpoint.java:1744) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.tomcat.util.net.socketprocessorbase.run(socketprocessorbase.java:52) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.tomcat.util.threads.threadpoolexecutor.runworker(threadpoolexecutor.java:1191) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.tomcat.util.threads.threadpoolexecutor$worker.run(threadpoolexecutor.java:659) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at org.apache.tomcat.util.threads.taskthread$wrappingrunnable.run(taskthread.java:61) ~[tomcat-embed-core-10.1.18.jar:10.1.18]
	at java.base/java.lang.thread.run(thread.java:842) ~[na:na]
2024-02-03t09:24:07.878+08:00 debug 13892 --- [nio-8080-exec-7] o.s.s.w.s.httpsessionrequestcache        : saved request http://localhost:8080/hello?continue to session
2024-02-03t09:24:07.878+08:00 debug 13892 --- [nio-8080-exec-7] s.w.a.delegatingauthenticationentrypoint : trying to match using and [not [requestheaderrequestmatcher [expectedheadername=x-requested-with, expectedheadervalue=xmlhttprequest]], mediatyperequestmatcher [contentnegotiationstrategy=org.springframework.web.accept.contentnegotiationmanager@4f223bee, matchingmediatypes=[application/xhtml+xml, image/*, text/html, text/plain], useequals=false, ignoredmediatypes=[*/*]]]
2024-02-03t09:24:07.878+08:00 debug 13892 --- [nio-8080-exec-7] s.w.a.delegatingauthenticationentrypoint : match found! executing org.springframework.security.web.authentication.loginurlauthenticationentrypoint@d902300
2024-02-03t09:24:07.878+08:00 debug 13892 --- [nio-8080-exec-7] o.s.s.web.defaultredirectstrategy        : redirecting to http://localhost:8080/login
2024-02-03t09:24:07.878+08:00 trace 13892 --- [nio-8080-exec-7] o.s.s.w.header.writers.hstsheaderwriter  : not injecting hsts header since it did not match request to [is secure]
2024-02-03t09:24:07.885+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : trying to match request against defaultsecurityfilterchain [requestmatcher=any request, filters=[org.springframework.security.web.session.disableencodeurlfilter@4eaa375c, org.springframework.security.web.context.request.async.webasyncmanagerintegrationfilter@2404b5a, org.springframework.security.web.context.securitycontextholderfilter@6088451e, org.springframework.security.web.header.headerwriterfilter@3ba3d4b6, org.springframework.web.filter.corsfilter@3af58f76, org.springframework.security.web.csrf.csrffilter@6bcb12e6, org.springframework.security.web.authentication.logout.logoutfilter@3a7e365, org.springframework.security.web.authentication.usernamepasswordauthenticationfilter@5f05c8d6, org.springframework.security.web.authentication.ui.defaultloginpagegeneratingfilter@5416f8db, org.springframework.security.web.authentication.ui.defaultlogoutpagegeneratingfilter@2ead6ba4, org.springframework.security.web.authentication.www.basicauthenticationfilter@7885776b, org.springframework.security.web.savedrequest.requestcacheawarefilter@2f10f633, org.springframework.security.web.servletapi.securitycontextholderawarerequestfilter@1642eeae, org.springframework.security.web.authentication.anonymousauthenticationfilter@31a2a9fa, org.springframework.security.web.access.exceptiontranslationfilter@40de8f93, org.springframework.security.web.access.intercept.authorizationfilter@78422efb]] (1/1)
2024-02-03t09:24:07.885+08:00 debug 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : securing get /login
2024-02-03t09:24:07.885+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking disableencodeurlfilter (1/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking webasyncmanagerintegrationfilter (2/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking securitycontextholderfilter (3/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking headerwriterfilter (4/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking corsfilter (5/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking csrffilter (6/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.csrf.csrffilter         : did not protect against csrf since request did not match csrfnotrequired [trace, head, get, options]
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking logoutfilter (7/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.s.w.a.logout.logoutfilter            : did not match request to ant [pattern='/logout', post]
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking usernamepasswordauthenticationfilter (8/16)
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] w.a.usernamepasswordauthenticationfilter : did not match request to ant [pattern='/login', post]
2024-02-03t09:24:07.886+08:00 trace 13892 --- [nio-8080-exec-8] o.s.security.web.filterchainproxy        : invoking defaultloginpagegeneratingfilter (9/16)
2024-02-03t09:24:07.887+08:00 trace 13892 --- [nio-8080-exec-8] o.s.s.w.header.writers.hstsheaderwriter  : not injecting hsts header since it did not match request to [is secure]

重定向到 /login 流程图

流程图说明

过滤器链，org.springframework.security.web.filterchainproxy.virtualfilterchain#dofilter，一个接着一个filter 执行

defaultloginpagegeneratingfilter，默认登录页生成过滤器。判断当前url 是否是login、loginerror，logout 的url，如果是，就生成登录页面，并且输出到浏览器

authorizationfilter，权限过滤器，判断当前用户是否有权限访问url。当浏览器访问 /hello 地址，经过 anonymousauthenticationfilter 过滤器，未获取到认证信息，会生成匿名的认证token-anonymousauthenticationtoken。

授权认证器校验到当前的anonymousauthenticationtoken无权限访问/hello, 抛出accessdeniedexception异常

exceptiontranslationfilter，异常处理过滤器，处理 authenticationexception、accessdeniedexception异常。它catch 到 authorizationfilter 抛出的 accessdeniedexception异常，调用 handlespringsecurityexception 方法处理异常