pig4cloud自定义SecurityFilterChain、Filter

news2024/9/20 17:55:25

1. 环境

SpringBoot版本：2.7.16

SpringSecurity版本：5.7.11

pig4cloud版本：3.7.1-JDK8

2. 概述

pig4cloud也没有自定义SecurityFilterChain的实现，还是基于SpringSecurity去实现的。但是pig4cloud使用的SpringSecurity的5.7.11版本，这个版本要配置SecurityFilterChain在写法上是有别于之前较早的版本（5.7.0之前）的。在现在pig4cloud的版本中具体的做法是声明一个Configuration配置类，然后声明要生成SecurityFilterChain的方法，逻辑里将要添加的Filter可以做成一个List集合，然后添加到SecurityFilterChain中；还可以定义SecurityFilterChain的匹配规则的RequestMatcher。

关于写法的版本变更，参考官方文档：https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter

3. 自定义Filter

Filter的自定义就是实现Filter接口；然后重写doFilter方法即可：

Java
package cn.only.hww.todo.server.filter;

import javax.servlet.*;
import java.io.IOException;

/**
* date created : Created in 2024/2/26 15:43
* description : TODO
* class name   : MyFilter
*/
public class MyFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // 处理过滤器的逻辑
        System.out.println("MyFilter doFilter");
        chain.doFilter(request, response);
    }
}

4. 自定义SecurityFilterChain

4.1 观察现有的SecurityFilterChain

启动项目后，在FilterChainProxy的doFilterInternal方法中打断点，然后发送一个请求

观察SecurityFilterChain的数量和内容：可以看到现在只有一个SecurityFilterChain，而匹配规则是any request（匹配任何请求），有12个Filter;这些配置是pig4cloud帮我们配置好的默认的。

4.2 添加MySecurityConfig类

实现MySecurityConfig

Java
package cn.only.hww.todo.server.config;

import cn.only.hww.todo.server.filter.MyFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
/**
* date created : Created in 2024/2/26 14:25
* description : TODO 测试SecurityFilterChain
* class name   : MySecurityConfig
*/
@Configuration
public class MySecurityConfig {

    @Bean
    @Order(10)
    public SecurityFilterChain test1(HttpSecurity http) throws Exception {

        MyFilter filter = new MyFilter();

        RequestMatcher matcher = new AntPathRequestMatcher("/testMatcher");

        DefaultSecurityFilterChain defaultSecurityFilterChain = new DefaultSecurityFilterChain(matcher, filter);
        return defaultSecurityFilterChain;
    }

}

首先是声明此类是配置类，添加@Configuration注解

实现一个test1方法，注解@Bean声明是一个bean；注解@Order声明此SecurityFilterChain的顺序，值越小越靠前

然后声明一个filter、声明一个RequestMatcher对象，并且设置匹配规则为：匹配”testMatcher“的请求

最后通过filter和RequestMatcher对象new出DefaultSecurityFilterChain，返回此对象

4.3 再次观察SecurityFilterChain

重新启动项目，然后发送请求；观察FilterChainProxy

可以看到变成了两个SecurityFilterChain，而第二条就是我们添加的了，可以看到匹配的规则是我们自定义的，Filter也是我们自定义的MyFilter

5. 自定义多个SecurityFilterChain

要自定义多个SecurityFilterChain只需要在MySecurityConfig中再写一个返回SecurityFilterChain的方法，跟4.2中的一样，添加test2的SecurityFilterChain；匹配路径为：”/test222Matcher“

Java
package cn.only.hww.todo.server.config;

import cn.only.hww.todo.server.filter.MyFilter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;

/**
* date created : Created in 2024/2/26 14:25
* description : TODO 测试SecurityFilterChain
* class name   : MySecurityConfig
*/
@Configuration
public class MySecurityConfig {

    @Bean
    @Order(10)
    public SecurityFilterChain test1(HttpSecurity http) throws Exception {

        MyFilter filter = new MyFilter();

        RequestMatcher matcher = new AntPathRequestMatcher("/testMatcher");

        DefaultSecurityFilterChain defaultSecurityFilterChain = new DefaultSecurityFilterChain(matcher, filter);
        return defaultSecurityFilterChain;
    }

    @Bean
    @Order(8)
    public SecurityFilterChain test2(HttpSecurity http) throws Exception {

       MyFilter filter = new MyFilter();

        RequestMatcher matcher = new AntPathRequestMatcher("/test222Matcher");

        DefaultSecurityFilterChain defaultSecurityFilterChain = new DefaultSecurityFilterChain(matcher, filter);
        return defaultSecurityFilterChain;
    }

}