Spring-security源码-Filter之HeaderWriterFilter(十二)

合集 - spring-security源码阅读(28)

1.Spring-Security系列导航2021-11-152.spring-security使用-登录(一)2020-12-103.spring-security使用-自定义数据源(二)2020-12-224.spring-security使用-更友好的方式扩展登录AuthenticationProvider(三)2021-01-045.spring-security使用-获得当前用户信息(四)2021-01-056.spring-security使用-同一个账号只允许登录一次(五)2021-01-067.spring-security使用-session共享(六)2021-01-078.spring-security使用-安全防护HttpFirewall(七)2021-01-299.spring-security使用-权限控制(八)2021-11-0310.spring-security源码-初始化(九)2021-11-0411.spring-security源码-如何初始化SecurityFilterChain到Servlet2024-03-1012.spring-security源码-FilterChainProxy2024-03-1013.spring-security源码-Filter之WebAsyncManagerIntegrationFilter(十)2021-11-0914.Spring-security源码-Filter之SecurityContextPersistenceFilter(十一)2021-11-09

15.Spring-security源码-Filter之HeaderWriterFilter(十二)2021-11-10

16.Spring-security源码-Filter之LogoutFilter(十三)2021-11-1017.Spring-security源码-Filter之UsernamePasswordAuthenticationFilter(十四)2021-11-1018.Spring-security源码-Filter之ConcurrentSessionFilter(十五)2021-11-1019.Spring-security源码-Filter之SessionManagementFilter(十六)2021-11-1120.Spring-security源码-Filter之RememberMeAuthenticationFilter(十七)2021-11-1121.Spring-security源码-Filter之ExceptionTranslationFilter(十八)2021-11-1222.Spring-security源码-Filter之FilterSecurityInterceptor(十九)2021-11-1323.Spring-security源码-注解权限原理(二十)2021-11-1324.Spring-security源码-注解权限原理之MethodSecurityInterceptor(二十一)2021-11-1525.Spring-Security基于源码扩展-一套系统多套登录逻辑(二十二)2021-11-1526.Spring-Security基于源码扩展-自定义登录(二十三)2021-11-1527.Spring-Security基于源码扩展-自定义认证失败返回(二十四)2021-11-1528.Spring-Security基于源码扩展-自定义授权注解(二十五)2021-11-15

收起

文章主目录

• <1>
• <2>
• <3>
• <4>
• <5>

提供我们在Filter链 执行之前或者之后往Header写入内容

通过HttpSecurity  可以指定 默认是在之后调用

 http.headers().addHeaderWriter()

通过org.springframework.security.config.annotation.web.configurers.HeadersConfigurer 初始化

默认初始化处参考https://www.cnblogs.com/LQBlog/p/15508248.html#autoid-12-0-0

private void applyDefaultConfiguration(HttpSecurity http) throws Exception {
        //http本质也是build 这里都是配置默认的config configure add CsrfConfigurer
        http.csrf();
        //默认增加一个WebAsyncManagerIntegrationFilter
        http.addFilter(new WebAsyncManagerIntegrationFilter());
        //configures add ExceptionHandlingConfigurer
        http.exceptionHandling();
        //configures add HeadersConfigurer
        http.headers();
        //configures add SessionManagementConfigurer
        http.sessionManagement();
        //configure add SecurityContextConfigurer
        http.securityContext();
        //configure add RequestCacheConfigurer
        http.requestCache();
        ///configure add AnonymousConfigurer
        http.anonymous();
        ///configure add ServletApiConfigurer
        http.servletApi();
        //configure DefaultLoginPageConfigurer
        http.apply(new DefaultLoginPageConfigurer<>());
        //configure LogoutConfigurer
        http.logout();
    }

回到顶部

<1>

org.springframework.security.web.header.HeaderWriterFilter#doFilterInternal

   @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        //在Filter链执行之前执行 默认是false 不建议直接修改，如果有需求可以自定在定义一个HeaderFilter 因为默认的有许多默认Writer需要在之后执行
        if (this.shouldWriteHeadersEagerly) {
             //<2>
            doHeadersBefore(request, response, filterChain);
        }
        else {
            //<4>在Filter链条执行之后
            doHeadersAfter(request, response, filterChain);
        }
    }

回到顶部

<2>

org.springframework.security.web.header.HeaderWriterFilter#doHeadersBefore

  private void doHeadersBefore(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws IOException, ServletException {
        //<3>调用我们的HeaderWriters
        writeHeaders(request, response);
        //执行调用链
        filterChain.doFilter(request, response);
    }

回到顶部

<3>

org.springframework.security.web.header.HeaderWriterFilter#writeHeaders

  void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
        //调用HeaderWriters 我们可以动态指定 扩展点
        for (HeaderWriter writer : this.headerWriters) {
            writer.writeHeaders(request, response);
        }
    }

回到顶部

<4>

org.springframework.security.web.header.HeaderWriterFilter#doHeadersAfter

 private void doHeadersAfter(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws IOException, ServletException {
        //通过HeaderWriterResponse和HeaderWriterRequest 装饰 内部类 应该是为了发生异常或者重定向 调用WriteHeader
        HeaderWriterResponse headerWriterResponse = new HeaderWriterResponse(request, response);
        HeaderWriterRequest headerWriterRequest = new HeaderWriterRequest(request, headerWriterResponse);
        try {
            filterChain.doFilter(headerWriterRequest, headerWriterResponse);
        }
        finally {
            //<5>调用writeHeader
            headerWriterResponse.writeHeaders();
        }
    }

回到顶部

<5>

org.springframework.security.web.header.HeaderWriterFilter.HeaderWriterResponse#writeHeaders

 protected void writeHeaders() {
        //如果触发了Wapper的writeHeaders 则不再触发 避免重复调用
        if (isDisableOnResponseCommitted()) {
            return;
        }
        //<2>
        HeaderWriterFilter.this.writeHeaders(this.request, getHttpResponse());
    }