Spring Security提供了很多過濾器，它們攔截Servlet請求，并将這些請求轉交給認證處理過濾器和通路決策過濾器進行處理，并強制安全性認證使用者身份和使用者權限以達到保護WEB資源的目的，Spring Security安全機制包括兩個主要的操作，「認證」和「驗證」，驗證也可以稱為權限控制，這是Spring Security兩個主要的方向，認證是為使用者建立一個他所聲明的主體的過程，這個主體一般是指使用者裝置或可以在系統中執行行動的其他系統，驗證指使用者能否在應用中執行某個操作，在到達授權判斷之前身份的主體已經由身份認證過程建立了。下面列出幾種常用認證模式，這裡不對它們作詳細介紹，需要詳細了解的老鐵們可以自行查查對應的資料。
* Implementations are not used directly by Spring Security for security purposes. They
* simply store user information which is later encapsulated into {@link Authentication}
* objects. This allows non-security related user information (such as email addresses,
* telephone numbers etc) to be stored in a convenient location.
*
* Concrete implementations must take particular care to ensure the non-null contract
* detailed for each method is enforced. See
* {@link org.springframework.security.core.userdetails.User} for a reference
* implementation (which you might like to extend or use in your code).
*
* @see UserDetailsService
* @see UserCache
*
* @author Ben Alex
*/
parameter, as this is used by various classes to specify the
* authentication token should not be trusted. If an implementation wishes to reject
* an invocation with a
true
parameter (which would indicate the
* authentication token is trusted - a potential security risk) the implementation
* should throw an {@link IllegalArgumentException}.
*
* @param isAuthenticated
true
if the token should be trusted (which may
* result in an exception) or
false
if the token should not be trusted
*
* @throws IllegalArgumentException if an attempt to make the authentication token
* trusted (by passing
true
as the argument) is rejected due to the
* implementation being immutable or implementing its own alternative approach to
* {@link #isAuthenticated()}
*/
* Handles configuration of a bean context defined list of {@link AccessDecisionVoter}s
* and the access control behaviour if all voters abstain from voting (defaults to deny
* access).
*/
public abstract class AbstractAccessDecisionManager implements AccessDecisionManager,InitializingBean, MessageSourceAware {
protected final Log logger = LogFactory.getLog(getClass());
private List> decisionVoters;protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();private boolean allowIfAllAbstainDecisions = false;protected AbstractAccessDecisionManager(
List> decisionVoters) {
Assert.notEmpty(decisionVoters, "A list of AccessDecisionVoters is required");this.decisionVoters = decisionVoters;
}public void afterPropertiesSet() {
Assert.notEmpty(this.decisionVoters, "A list of AccessDecisionVoters is required");
Assert.notNull(this.messages, "A message source must be set");
}protected final void checkAllowIfAllAbstainDecisions() {if (!this.isAllowIfAllAbstainDecisions()) {throw new AccessDeniedException(messages.getMessage("AbstractAccessDecisionManager.accessDenied", "Access is denied"));
}
}public List> getDecisionVoters() {return this.decisionVoters;
}public boolean isAllowIfAllAbstainDecisions() {return allowIfAllAbstainDecisions;
}public void setAllowIfAllAbstainDecisions(boolean allowIfAllAbstainDecisions) {this.allowIfAllAbstainDecisions = allowIfAllAbstainDecisions;
}public void setMessageSource(MessageSource messageSource) {this.messages = new MessageSourceAccessor(messageSource);
}public boolean supports(ConfigAttribute attribute) {for (AccessDecisionVoter voter : this.decisionVoters) {if (voter.supports(attribute)) {return true;
}
}return false;
}
這個方法。Spring security 5.0之後新增了多種加密方式，改變了預設的密碼格式，新的密碼存儲格式是“{id}…………”.前面的id是加密方式，id可以是bcrypt、sha256等，後面跟着的是加密後的密碼。也就是說，程式拿到傳過來的密碼的時候，會首先查找被“{”和“}”包括起來的id，來确定後面的密碼是被怎麼樣加密的，如果找不到就認為id是null。這時候程式會報錯:There is no PasswordEncoder mapped for the id “null”.實際應用中也可以自定義加密方式，隻需要繼承
