SpringSecurity之WebSecurity和HttpSecurity

SpringSecurity启动过程中有两个重要的类。分别是WebSecurity和HttpSecurity。

 

看看WebSecurity的定义：

public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter, WebSecurity> implements SecurityBuilder<Filter>, ApplicationContextAware, ServletContextAware

SecurityBuilder用于创建对象。WebSecurity的定义中SecurityBuilder的参数是Filter，也就是WebSecurity创建FilterChainProxy对象。

 

WebSecurity的继承结构图：

 

AbstractSecurityBuilder实现了SecurityBuilder接口，重写了build() 方法：

	@Override
public final O build() throws Exception {
	if (this.building.compareAndSet(false, true)) {
		this.object = doBuild();
		return this.object;
	}
	throw new AlreadyBuiltException("This object has already been built");
}

通过AtomicBoolean参数控制只能调用一次build()。

 

AbstractConfiguredSecurityBuilder继承了AbstractSecurityBuilder。重写了doBuild()方法：

	@Override
protected final O doBuild() throws Exception {
	synchronized (this.configurers) {
		this.buildState = BuildState.INITIALIZING;
		beforeInit();
		init();
		this.buildState = BuildState.CONFIGURING;
		beforeConfigure();
		configure();
		this.buildState = BuildState.BUILDING;
		O result = performBuild();
		this.buildState = BuildState.BUILT;
		return result;
	}
}

定义了构建的生命周期。AbstractConfiguredSecurityBuilder还增加了一些操作SecurityConfigurer的方法。比如getConfigurer，removeConfigurer，add等。

 

再来看看HttpSecurity的定义：

HttpSecurity extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain, HttpSecurity> implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity>

实现了SecurityBuilder接口，上面定义中的参数是DefaultSecurityFilterChain，HttpSecurity是配置DefaultSecurityFilterChain。

 

HttpSecurity类结构图如下：

 

HttpSecurityBuilder继承了SecurityBuilder接口，增加了操作SecurityConfigurer的方法，操作sharedObject的方法，操作Filter的方法。