Spring源代码解析（十）：Spring Acegi框架授权的实现
时间:2011-03-29 javaeye jiwenke
我们从FilterSecurityInterceptor我们从入手看看怎样进行授权的：
Java代码
//这里是拦截器拦截HTTP请求的入口
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain);
invoke(fi);
}
//这是具体的拦截调用
public void invoke(FilterInvocation fi) throws IOException, ServletException {
if ((fi.getRequest() != null) && (fi.getRequest ().getAttribute(FILTER_APPLIED) != null)
&& observeOncePerRequest) {
//在第一次进行过安全检查之后就不会再做了
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
} else {
//这是第一次收到相应的请求，需要做安全检测，同时把标志为设置好 - FILTER_APPLIED，下次就再有请求就不会作相同的安全检查了
if (fi.getRequest() != null) {
fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
}
//这里是做安全检查的地方
InterceptorStatusToken token = super.beforeInvocation(fi);
//接着向拦截器链执行
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse ());
} finally {
super.afterInvocation(token, null);
}
}
}
我们看看在AbstractSecurityInterceptor是怎样对HTTP请求作安全检测的：
Java代码
protected InterceptorStatusToken beforeInvocation(Object object) {
Assert.notNull(object, "Object was null");
if (!getSecureObjectClass().isAssignableFrom(object.getClass())) {
throw new IllegalArgumentException("Security invocation attempted for object "
+ object.getClass().getName()
+ " but AbstractSecurityInterceptor only configured to support secure objects of type: "
+ getSecureObjectClass());
}
//这里读取配置FilterSecurityInterceptor的ObjectDefinitionSource属性 ，这些属性配置了资源的安全设置
ConfigAttributeDefinition attr = this.obtainObjectDefinitionSource ().getAttributes(object);
if (attr == null) {
if(rejectPublicInvocations) {
throw new IllegalArgumentException(
"No public invocations are allowed via this AbstractSecurityInterceptor. "
+ "This indicates a configuration error because the "
+ "AbstractSecurityInterceptor.rejectPublicInvocations property is set to ''true''");
}
if (logger.isDebugEnabled()) {
logger.debug("Public object - authentication not attempted");
}
publishEvent(new PublicInvocationEvent(object));
return null; // no further work post-invoc
|
