Shulou(Shulou.com)06/01 Report--

This article mainly explains "how to understand the WebSecurityConfigurerAdapter inheritance relationship in spring boot". The content in the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "how to understand the WebSecurityConfigurerAdapter inheritance relationship in spring boot".

Let's first look at an inheritance diagram of WebSecurityConfigurerAdapter:

In this inheritance relationship, there are two very important classes:

SecurityBuilderSecurityConfigurer1.WebSecurityConfigurer

WebSecurityConfigurer is actually an empty interface, but it constrains some generics, as follows:

Public interface WebSecurityConfigurer extends

SecurityConfigurer {

}

The generics in it are crucial, and it's about what the purpose of WebSecurityConfigurer is!

The generic Filter in SecurityBuilder indicates that the ultimate goal of SecurityBuilder is to build a Filter object. There are two generics in SecurityConfigurer, and the first representation is also the object that SecurityBuilder finally builds.

At the same time, it is also defined that the new generic WebSecurityConfigurerAdapter T needs to be inherited from SecurityBuilder. According to the definition in WebSecurityConfigurerAdapter, we can know that T is WebSecurity, and we can probably guess that WebSecurity is a subclass of SecurityBuilder.

So the purpose of WebSecurityConfigurer can be understood to be to configure WebSecurity.

2.WebSecurity

Let's look at the definition of WebSecurity:

Public final class WebSecurity extends

AbstractConfiguredSecurityBuilder implements

SecurityBuilder, ApplicationContextAware {

}

Yes, it is! WebSecurity inherits from AbstractConfiguredSecurityBuilder and implements the SecurityBuilder interface.

These interfaces and inherited classes of WebSecurity.

AbstractConfiguredSecurityBuilder

First of all, an enumeration class is defined in AbstractConfiguredSecurityBuilder, which divides the whole construction process into five states, which can also be understood as the five stages of the construction process life cycle, as follows:

Private enum BuildState {

UNBUILT (0)

INITIALIZING (1)

CONFIGURING (2)

BUILDING (3)

BUILT (4)

Private final int order

BuildState (int order) {

This.order = order

}

Public boolean isInitializing () {

Return INITIALIZING.order = = order

}

Public boolean isConfigured () {

Return order > = CONFIGURING.order

}

}

The five states are UNBUILT, INITIALIZING, CONFIGURING, BUILDING, and BUILT. In addition, two methods are provided: isInitializing determines whether it is initializing, and isConfigured indicates whether it has been configured.

There are many methods in AbstractConfiguredSecurityBuilder. Brother Song lists two key methods and analyzes them here:

Private void add (C configurer) {

Assert.notNull (configurer, "configurer cannot be null")

Class, Object > sharedObjects = createSharedObjects ()

Http = new HttpSecurity (objectPostProcessor, authenticationBuilder

SharedObjects)

If (! disableDefaults) {

/ / @ formatter:off

Http

.csrf () .and ()

.addFilter (new WebAsyncManagerIntegrationFilter ())

.promotionHandling () .and ()

.headers () .and ()

.sessionManagement () .and ()

.securityContext () .and ()

.requestCache () .and ()

And ()

.servletApi () .and ()

.apply (new DefaultLoginPageConfigurer ()) .and ()

.logout ()

/ / @ formatter:on

ClassLoader classLoader = this.context.getClassLoader ()

List defaultHttpConfigurers =

SpringFactoriesLoader.loadFactories (AbstractHttpConfigurer.class, classLoader)

For (AbstractHttpConfigurer configurer: defaultHttpConfigurers) {

Http.apply (configurer)

}

}

Configure (http)

Return http

}

Protected void configure (HttpSecurity http) throws Exception {

Logger.debug ("Using default configure (HttpSecurity). If subclassed this will potentially override subclass configure (HttpSecurity)")

Http

.authorizeRequests ()

.anyRequest () .authenticated ()

.and ()

.formLogin () .and ()

.httpBasic ()

}

The init method can be regarded as the entry method here: first call the getHttp method to initialize the HttpSecurity. The initialization of HttpSecurity actually configures a bunch of default filters, and after configuration, the configure (http) method is finally called, which is also configured with some interceptors, but in actual development, we often override the configure (http) method. After the HttpSecurity is configured, put the HttpSecurity into WebSecurity and save it in the securityFilterChainBuilders collection of WebSecurity

The configure (WebSecurity web) method is actually an empty method, which we might override in actual development:

Public void configure (WebSecurity web) throws Exception {

} Thank you for your reading. The above is the content of "how to understand the WebSecurityConfigurerAdapter inheritance relationship in spring boot". After the study of this article, I believe you have a deeper understanding of how to understand the WebSecurityConfigurerAdapter inheritance relationship in spring boot, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.