Spring Security介绍（三）过滤器（2）自定义

除了使用security自带的过滤器链，我们还可以自定义过滤器拦截器。

下面看下自定义的和security自带的执行顺序。

一、总结

1、自定义过滤器：

一般自定义fliter都是：

import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import java.io.IOException;

@Component
@Slf4j
public class UrlFilter implements Filter {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        log.info("进入UrlFilter");
        filterChain.doFilter(servletRequest,servletResponse);
    }
}

但是结合spring security，这样的filter不会被执行， 需要修改为继承OncePerRequestFilter

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
public class UrlFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {
        log.info("进入UrlFilter");
        filterChain.doFilter(request,response);
    }
}
2、执行顺序
2.1、默认顺序：

security自带的过滤器链-->自定义过滤器-->自定义拦截器。

2.2、修改自定义interceptor顺序

修改在WebMvcConfigurer中注册的顺序即可。

2.3、修改自定义filter顺序

加@Order()注解，在注解中加入数字，数字越小，优先级越高，最先执行。其中这个数字可以：

（1）自定义

如

@Component
@Order(1)
public class XxxFilter extends OncePerRequestFilter{}

@Component
@Order(2)
public class Xxx1Filter extends OncePerRequestFilter{}

这时执行的顺序是： security自带的过滤器链-->自定义过滤器的顺序-->自定义拦截器的顺序。

（2）使用枚举

源码：

1）HIGHEST_PRECEDENCE

代表这个过滤器在众多过滤器中级别最高，也就是过滤的时候最先执行，这时执行的顺序为：

自定义过滤器的顺序--> security自带的过滤器链-->自定义拦截器的顺序。 

2）LOWEST_PRECEDENCE

表示级别最低，最后执行过滤操作。

2.4、配置文件修改自定义filter顺序

filter的执行顺序除了可以用上面的@Order注解外，还可以通过配置文件设置，这时配置文件设置的优先级--》注解设置的优先级。如我两个filter都设置为Ordered.HIGHEST_PRECEDENCE + 1，其中一个在配置文件设置的，另外一个通过注解设置的，这时配置文件设置的那个会先执行。

package com.demo.security.config;

import com.demo.security.filter.UrlTwoFilter;
import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

import java.util.List;

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Autowired
    private ParamInterceptor paramInterceptor;

    @Autowired
    private ParamOneInterceptor paramOneInterceptor;


    @Autowired
    private UrlTwoFilter twoFilter;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(paramOneInterceptor);
        registry.addInterceptor(paramInterceptor).addPathPatterns("/**");
        //registry.addInterceptor(paramOneInterceptor);
    }

    @Bean
    public FilterRegistrationBean<UrlTwoFilter> getIpFilter() {
        FilterRegistrationBean<UrlTwoFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(twoFilter);
        registrationBean.setEnabled(true);
        registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE + 1);
        registrationBean.setUrlPatterns(List.of("/*"));
        return registrationBean;
    }
}

@Component
@Slf4j
//@Order(1)
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlOneFilter extends OncePerRequestFilter

下面通过demo来验证下 

二、demo

1、使用security过滤器
（1）编写过滤器
package com.demo.security.filter;

import com.demo.security.constant.UserConstants;
import com.demo.security.dto.UserDTO;
import com.demo.security.util.JwtUtil;
import com.demo.security.util.RedisClient;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.apache.http.entity.ContentType;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.util.StringUtils;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Map;
@Slf4j
public class LoginFilter extends UsernamePasswordAuthenticationFilter {

    private AuthenticationManager authenticationManager;
    private RedisClient redisClient;

    public LoginFilter(AuthenticationManager authenticationManager, RedisClient redisClient) {
        //super(new AntPathRequestMatcher("/login", "POST"));
        this.authenticationManager = authenticationManager;
        this.redisClient = redisClient;
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {
        try {
            logger.info("进入LoginFilter");
            String userName = req.getParameter("userName");
            String passWord = req.getParameter("passWord");
            if (StringUtils.isEmpty(userName)) {
                throw new UsernameNotFoundException("请输入账号");
            }
            if (StringUtils.isEmpty(passWord)) {
                throw new UsernameNotFoundException("请输入密码");
            }
            //验证用户名密码是否正确
            Map<String, String> userMap = UserConstants.getUsers();
            if(!userMap.keySet().contains(userName)){
                throw new UsernameNotFoundException("用户不存在");
            }
            if(!passWord.equals(userMap.get(userName))){
                throw new UsernameNotFoundException("密码错误");
            }
            //这里权限返回空，由后面的授权过滤器查询
            return authenticationManager.authenticate(
                    new UsernamePasswordAuthenticationToken(userName, passWord, new ArrayList<>()));
        } catch (UsernameNotFoundException e) {
            //返回错误信息
            res.setCharacterEncoding("UTF-8");
            res.setContentType("application/text;charset=utf-8");
            try {
                res.getWriter().write(e.getMessage());
            } catch (IOException e1) {
                e1.printStackTrace();
            }
            return null;
        }catch (Exception e){
            throw new RuntimeException(e);
        }
    }


    @Override
    protected void successfulAuthentication(
            HttpServletRequest request,
            HttpServletResponse res,
            jakarta.servlet.FilterChain chain,
            Authentication authResult)
            throws IOException, jakarta.servlet.ServletException {
        UserDTO userDTO = (UserDTO) authResult.getPrincipal();
        String userName = userDTO.getUsername();
        String password = userDTO.getPassword();
        String jwtToken = JwtUtil.sign(userName, password);
        //缓存到redis中
        redisClient.set(userName,jwtToken);
        //返回
        res.setContentType(ContentType.TEXT_HTML.toString());
        res.getWriter().write(jwtToken);
    }
}

package com.demo.security.filter;

import com.demo.security.util.JwtUtil;
import com.demo.security.util.RedisClient;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.util.StringUtils;

import java.io.IOException;
@Slf4j
public class TokenAuthenticationFilter extends BasicAuthenticationFilter {
    private RedisClient redisClient;

    private UserDetailsService userDetailsService;

    public TokenAuthenticationFilter(AuthenticationManager authenticationManager, RedisClient redisClient, UserDetailsService userDetailsService) {
        super(authenticationManager);
        this.redisClient = redisClient;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
        logger.info("登陆成功后访问,url={}"+req.getRequestURI());
        String token = req.getHeader("token");
        res.setCharacterEncoding("UTF-8");
        res.setContentType("application/text;charset=utf-8");
        if(StringUtils.isEmpty(token)){
            logger.info("登陆成功后访问,url={},token为空"+req.getRequestURI());
            res.getWriter().write("token为空");
            return;
        }
        //1、token是否正确，是否能反解析出userName
        String userName = JwtUtil.getUsername(token);
        if(StringUtils.isEmpty(userName)){
            logger.info("登陆成功后访问,url={},token错误"+req.getRequestURI());
            res.getWriter().write("token错误");
            return;
        }
        //2、验证token是否过期
        String redisToken = redisClient.get(userName);
        if(StringUtils.isEmpty(redisToken) || !token.equals(redisToken)){
            logger.info("登陆成功后访问,url={},token过期"+req.getRequestURI());
            res.getWriter().write("token过期");
            return;
        }
        UserDetails currentUser = userDetailsService.loadUserByUsername(userName);
        UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(currentUser,null,currentUser.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(authentication);
        chain.doFilter(req, res);
    }
}
（2）注册到过滤器链中
package com.demo.security.config;

//import com.demo.security.filter.AuthenticationFilter;
//import com.demo.security.filter.LoginFilter;
import com.demo.security.filter.LoginFilter;
import com.demo.security.filter.TokenAuthenticationFilter;
import com.demo.security.util.RedisClient;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.authentication.configuration.GlobalAuthenticationConfigurerAdapter;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;


import static io.netty.util.CharsetUtil.encoder;

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityWebConfig {

    @Autowired
    private RedisClient redisClient;

    @Autowired
    private UserDetailsService userDetailsService;



    @Bean
    public PasswordEncoder passwordEncoder() {
        return new MyPasswordEncoder();
    }


    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain configure(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {

        http.csrf(AbstractHttpConfigurer::disable);
       http.headers(AbstractHttpConfigurer::disable);

       http.sessionManagement(sessionManagement -> {
           sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS);
       });
       http.authorizeRequests().anyRequest().authenticated().and()

               //1、登陆、退出url，均由前端拦截器控制，这里注释掉。
               //1.1、前端拦截器中判断缓存token为空，为空则post请求访问/login，目的是进入LoginFilter获取token
               //1.2、不为空则带token访问接口，如果AuthenticationFilter拦截token不合法则根据错误码跳转到登陆页面，重复1.1的操作
               //.logout().logoutUrl("/logout").and()
               //2、身份认证filter，访问系统（除了白名单接口）需要先登陆。post请求/login接口会进入这个拦截器
               // 校验用户名密码是否正确，正确返回token给前端，不正确则返回异常信息
               .addFilterBefore(new LoginFilter(authenticationManager,redisClient), LoginFilter.class)
               //3、授权filer，authenticationManager为BasicAuthenticationFilter的必传参数。所有的接口都会走到这里
               // 根据用户id查询权限,连同身份一起塞入SecurityContextHolder全局变量，后面获取用户信息则直接从SecurityContextHolder中get
               .addFilterBefore(new TokenAuthenticationFilter(authenticationManager,redisClient,userDetailsService),TokenAuthenticationFilter.class);
       return http.build();
    }

}
2、自定义过滤器拦截器
2.1、过滤器
package com.demo.security.filter;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
public class UrlFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {
        log.info("进入UrlFilter");
        filterChain.doFilter(request,response);
    }
}

package com.demo.security.filter;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
public class UrlOneFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {
        log.info("进入UrlFilter-one");
        filterChain.doFilter(request,response);
    }
}
  2.2、拦截器

（1）编写拦截器

package com.demo.security.interceptor;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

@Component
@Slf4j
public class ParamInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        log.info("进入ParamInterceptor");
        return true;
    }
}

package com.demo.security.interceptor;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

@Component
@Slf4j
public class ParamOneInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        log.info("进入ParamInterceptor-one");
        return true;
    }
}

（2）注册

package com.demo.security.config;

import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Autowired
    private ParamInterceptor paramInterceptor;

    @Autowired
    private ParamOneInterceptor paramOneInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(paramInterceptor).addPathPatterns("/**");
        registry.addInterceptor(paramOneInterceptor);
    }
}
3、测试默认顺序

（1）LoginFilter为特定情况下才能进入（/login的post请求），认证成功即返回：

访问localhost:2222/securityDemo/login?userName=zs&passWord=123后台打印

2024-04-27T09:14:57.210+08:00  INFO 14836 --- [nio-2222-exec-3] com.demo.security.filter.LoginFilter     : 进入LoginFilter

（2）访问其他接口，如localhost:2222/securityDemo/menu/test

如果沒有登录，在TokenAuthenticationFilter就返回了，控制台打印

2024-04-27T09:31:01.715+08:00  INFO 37920 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-27T09:31:01.734+08:00  INFO 37920 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={},token过期/securityDemo/menu/test

如果登录了，后台打印

2024-04-27T09:32:56.046+08:00  INFO 37920 --- [nio-2222-exec-7] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-27T09:32:56.064+08:00  INFO 37920 --- [nio-2222-exec-7] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-27T09:32:56.064+08:00  INFO 37920 --- [nio-2222-exec-7] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-27T09:32:56.070+08:00  INFO 37920 --- [nio-2222-exec-7] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor
2024-04-27T09:32:56.070+08:00  INFO 37920 --- [nio-2222-exec-7] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one

可以看到，执行顺序是security自带的过滤器链-->自定义过滤器-->自定义拦截器

4、修改执行顺序

下面修改自定义的过滤器拦截器的顺序：

4.1、拦截器

在WebMvcConfigurer中修改注册顺序

package com.demo.security.config;

import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Autowired
    private ParamInterceptor paramInterceptor;

    @Autowired
    private ParamOneInterceptor paramOneInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(paramOneInterceptor);
        registry.addInterceptor(paramInterceptor).addPathPatterns("/**");
        //registry.addInterceptor(paramOneInterceptor);
    }
}
4.2、过滤器
package com.demo.security.filter;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
@Order(2)
public class UrlFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {
        log.info("进入UrlFilter");
        filterChain.doFilter(request,response);
    }
}

package com.demo.security.filter;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
@Order(1)
public class UrlOneFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {
        log.info("进入UrlFilter-one");
        filterChain.doFilter(request,response);
    }
}

 再次测试，可以看到执行顺序已经修改了

2024-04-27T09:39:09.419+08:00  INFO 65540 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-27T09:39:09.471+08:00  INFO 65540 --- [nio-2222-exec-3] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-27T09:39:09.471+08:00  INFO 65540 --- [nio-2222-exec-3] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-27T09:39:09.476+08:00  INFO 65540 --- [nio-2222-exec-3] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-27T09:39:09.476+08:00  INFO 65540 --- [nio-2222-exec-3] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor

执行顺序为：security自带的过滤器链-->自定义过滤器的顺序-->自定义拦截器的顺序。

5、设置自定义filter优先级最高

（1）只修改一个

package com.demo.security.filter;

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

@Component
@Slf4j
//所有filter中优先级最高
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {
        log.info("进入UrlFilter");
        filterChain.doFilter(request,response);
    }
}

 另外一个不变：

@Component
@Slf4j
@Order(1)
public class UrlOneFilter extends OncePerRequestFilter

这时访问登录接口后台打印：

2024-04-28T11:11:31.846+08:00  INFO 37052 --- [nio-2222-exec-5] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:11:31.847+08:00  INFO 37052 --- [nio-2222-exec-5] com.demo.security.filter.LoginFilter     : 进入LoginFilter

再访问localhost:2222/securityDemo/menu/test，后台打印：

2024-04-28T11:10:53.685+08:00  INFO 37052 --- [nio-2222-exec-4] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:10:53.686+08:00  INFO 37052 --- [nio-2222-exec-4] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-28T11:10:53.688+08:00  INFO 37052 --- [nio-2222-exec-4] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:10:53.689+08:00  INFO 37052 --- [nio-2222-exec-4] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-28T11:10:53.689+08:00  INFO 37052 --- [nio-2222-exec-4] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor

可以看到，自定义的filter比security自带的过滤器链顺序都高。

（2）再把另外一个filter优先级也提高：

@Component
@Slf4j
//@Order(1)
@Order(Ordered.HIGHEST_PRECEDENCE+2)
public class UrlOneFilter extends OncePerRequestFilter

访问登录接口localhost:2222/securityDemo/login?userName=zs&passWord=123

2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] o.a.c.c.C.[.[localhost].[/securityDemo]  : Initializing Spring DispatcherServlet 'dispatcherServlet'
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] o.s.web.servlet.DispatcherServlet        : Completed initialization in 0 ms
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:14:35.919+08:00  INFO 56456 --- [nio-2222-exec-2] com.demo.security.filter.LoginFilter     : 进入LoginFilter

再访问localhost:2222/securityDemo/menu/test，后台打印：

2024-04-28T11:15:30.019+08:00  INFO 56456 --- [nio-2222-exec-5] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:15:30.019+08:00  INFO 56456 --- [nio-2222-exec-5] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:15:30.020+08:00  INFO 56456 --- [nio-2222-exec-5] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-28T11:15:30.021+08:00  INFO 56456 --- [nio-2222-exec-5] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-28T11:15:30.021+08:00  INFO 56456 --- [nio-2222-exec-5] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor
6、测试相同Order顺序

再加一个filter，且优先级都设置成相同的：

@Component
@Slf4j
//所有filter中优先级最高
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlFilter extends OncePerRequestFilter
@Component
@Slf4j
//@Order(1)
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlOneFilter extends OncePerRequestFilter

@Component
@Slf4j
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlTwoFilter extends OncePerRequestFilter

测试，执行顺序为：

2024-04-28T11:28:38.217+08:00  INFO 41668 --- [nio-2222-exec-5] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:28:38.217+08:00  INFO 41668 --- [nio-2222-exec-5] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:28:38.218+08:00  INFO 41668 --- [nio-2222-exec-5] com.demo.security.filter.UrlTwoFilter    : 进入UrlFilter-two

现在将two放到配置文件中指定顺序：

package com.demo.security.config;

import com.demo.security.filter.UrlTwoFilter;
import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

import java.util.List;

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Autowired
    private ParamInterceptor paramInterceptor;

    @Autowired
    private ParamOneInterceptor paramOneInterceptor;


    @Autowired
    private UrlTwoFilter twoFilter;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(paramOneInterceptor);
        registry.addInterceptor(paramInterceptor).addPathPatterns("/**");
        //registry.addInterceptor(paramOneInterceptor);
    }

    @Bean
    public FilterRegistrationBean<UrlTwoFilter> getIpFilter() {
        FilterRegistrationBean<UrlTwoFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(twoFilter);
        registrationBean.setEnabled(true);
        registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE + 1);
        registrationBean.setUrlPatterns(List.of("/*"));
        return registrationBean;
    }
}

再次查看执行顺序：

2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] com.demo.security.filter.UrlTwoFilter    : 进入UrlFilter-two
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：/a/581868.html

如若内容造成侵权/违法违规/事实不符，请联系我们进行投诉反馈qq邮箱809451989@qq.com，一经查实，立即删除！

相关文章

0418EmpTomCat项目 初次使用ajax实现局部动态离职

0418EmpTomCat项目 初次使用ajax实现局部动态离职

0418EmpTomCat项目包-CSDN博客 数据库字段&#xff1a; 员工部门表 分页查询&#xff1b; 多条件查询&#xff1b; 添加新员工&#xff1b; ajax点击离职操作效果&#xff1a;
阅读更多...
R-Tree: 原理及实现代码

R-Tree: 原理及实现代码

文章目录 R-Tree: 原理及实现代码1. R-Tree 原理1.1 R-Tree 概述1.2 R-Tree 结构1.3 R-Tree 插入与查询 2. R-Tree 实现代码示例&#xff08;Python&#xff09;结语 R-Tree: 原理及实现代码 R-Tree 是一种用于管理多维空间数据的数据结构&#xff0c;常用于数据库系统和地理信…
阅读更多...
使用FPGA发送一个经过曼彻斯特编码的伪随机序列

使用FPGA发送一个经过曼彻斯特编码的伪随机序列

介绍 这几天突然就不知道要使用FPGA实现什么样的功能了，然后就跑去学习数电了，学的也是晕晕的。正好之前写了一个使用FPGA发送伪随机序列的代码，然后因为需要使用曼彻斯特编码，所以又加了一个模块吧，使得最后输出的波形经过曼彻斯特编码。 曼彻斯特编码 首先，曼彻斯特编…
阅读更多...
Spark-机器学习（7）分类学习之决策树

Spark-机器学习（7）分类学习之决策树

在之前的文章中&#xff0c;我们学习了分类学习之支持向量机&#xff0c;并带来简单案例&#xff0c;学习用法。想了解的朋友可以查看这篇文章。同时&#xff0c;希望我的文章能帮助到你&#xff0c;如果觉得我的文章写的不错&#xff0c;请留下你宝贵的点赞&#xff0c;谢谢。…
阅读更多...
C语言——栈的实现

C语言——栈的实现

栈&#xff08;Stack&#xff09;是一种基于先进后出&#xff08;LIFO&#xff09;原则的数据结构&#xff0c;类似于我们平常堆放书籍或者盘子的方式。 栈通常是从高地址向低地址增长的&#xff0c;也就是说&#xff0c;栈顶位于较高的内存地址&#xff0c;而栈底位于较低的内…
阅读更多...
初始计算机网络

初始计算机网络

TCP/IP TCP/IP模型 TCP/IP网络模型&#xff1a;对于不同设备之间的通信&#xff0c;就需要网络通信&#xff0c;而设备是多样性的&#xff0c;所以要兼容多种多样的设备&#xff0c;就协商出了一套通用的网络协议。 TCP/IP分层 这个网络协议是分层的&#xff0c;每一层都有…
阅读更多...
PyVista 3D数据可视化 Python 库 简介

PyVista 3D数据可视化 Python 库 简介

Pyvista是一个用于科学可视化和分析的Python库 &#xff1b;我认为它适合做一些网格数据的处理&#xff1b; 它封装了VTK&#xff08;Visualization Toolkit&#xff09;之上&#xff0c;提供了一些高级接口&#xff0c; 3D数据可视化变得更加简单和易用。 1.安装 pyvista&…
阅读更多...
【Qt】控件的核心属性

【Qt】控件的核心属性

1 &#x1f351;控件概述&#x1f351; Widget 是 Qt 中的核⼼概念. 英⽂原义是 “⼩部件”, 我们此处也把它翻译为 “控件” .控件是构成⼀个图形化界⾯的基本要素。 Qt 作为⼀个成熟的 GUI 开发框架, 内置了⼤量的常⽤控件。这⼀点在 Qt Designer 中就可以看到端倪&#xf…
阅读更多...
装饰器模式、代理模式、适配器模式对比

装饰器模式、代理模式、适配器模式对比

装饰器模式、代理模式和适配器模式都是结构型设计模式&#xff0c;它们的主要目标都是将将类或对象按某种布局组成更大的结构&#xff0c;使得程序结构更加清晰。这里将装饰器模式、代理模式和适配器模式进行比较&#xff0c;主要是因为三个设计模式的类图结构相似度较高、且功…
阅读更多...
10分钟了解数据质量管理-奥斯汀格里芬 Apache Griffin

10分钟了解数据质量管理-奥斯汀格里芬 Apache Griffin

在不重视数据质量的大数据发展时期&#xff0c;Griffin并不能引起重视&#xff0c;但是随着数据治理在很多企业的全面开展与落地&#xff0c;数据质量的问题开始引起重视。 1.Griffin简介 Griffin是一个开源的大数据数据质量解决方案&#xff0c;由eBay开源&#xff0c;它支持…
阅读更多...
httpClient提交报文中文乱码

httpClient提交报文中文乱码

httpClient提交中文乱码&#xff0c;ContentType类型application/json 指定提交参数的编码即可 StringEntity se new StringEntity(paramBody.toJSONString(),"UTF-8");se.setContentType("application/json");context.httpPost.setHeader("Cookie&…
阅读更多...
【PPT设计】颜色对比、渐变填充、简化框线、放大镜效果、渐变形状配图、线条的使用

【PPT设计】颜色对比、渐变填充、简化框线、放大镜效果、渐变形状配图、线条的使用

目录 图表颜色对比、渐变填充、简化框线放大镜效果渐变形状配图 线条的使用区分标题与说明信息区分标题与正文,区分不同含义的内容**聚焦****引导****注解****装饰** 图表 颜色对比、渐变填充、简化框线 小米汽车正式亮相&#xff01;你们都在讨论价格&#xff0c;我全程只关…
阅读更多...
【实时数仓架构】方法论（未完）

【实时数仓架构】方法论（未完）

笔者不是专业的实时数仓架构&#xff0c;这是笔者从其他人经验和网上资料整理而来&#xff0c;仅供参考。写此文章意义&#xff0c;加深对实时数仓理解。 实时数仓背景和场景 一、实时数仓架构技术演进 1.1、四种架构演进 1&#xff09;离线大数据架构 一种批处理离线数据分…
阅读更多...
State.initState() must be a void method without an `async` keyword错误解析

State.initState() must be a void method without an `async` keyword错误解析

文章目录 报错问题报错的代码 错误原因解决方法解析 另外的方法 报错问题 State.initState() must be a void method without an async keyword如下图&#xff1a; 报错的代码 报错的代码如下&#xff1a; overridevoid initState() async{super.initState();await getConf…
阅读更多...
springboot权限验证学习-上

springboot权限验证学习-上

创建maven项目 创建父工程 这类项目和原来项目的区别在于&#xff0c;打包方式是pom 由于pom项目一般都是用来做父项目的&#xff0c;所以该项目的src文件夹可以删除掉。 创建子工程 子工程pom.xml 父工程pom.xml 添加依赖 父工程导入依赖包 <!--导入springboot 父工程…
阅读更多...
李沐70_bert微调——自学笔记

李沐70_bert微调——自学笔记

微调BERT 1.BERT滴哦每一个词元返回抽取了上下文信息的特征向量 2.不同的任务使用不同的特性 句子分类 将cls对应的向量输入到全连接层分类 命名实体识别 1.识别应该词元是不是命名实体&#xff0c;例如人名、机构、位置 2.将非特殊词元放进全连接层分类 问题回答 1.给…
阅读更多...
fetch请求后端返回文件流，并下载。

fetch请求后端返回文件流，并下载。

前端&#xff1a; <script src"~/layui/layui.js"></script> <script src"~/Content/js/common/js/vue.min.js"></script> <script src"~/Content/js/common/js/jquery-1.10.2.min.js"></script><styl…
阅读更多...
[论文笔记]GAUSSIAN ERROR LINEAR UNITS (GELUS)

[论文笔记]GAUSSIAN ERROR LINEAR UNITS (GELUS)

引言 今天来看一下GELU的原始论文。 作者提出了GELU(Gaussian Error Linear Unit,高斯误差线性单元)非线性激活函数&#xff1a; GELU x Φ ( x ) \text{GELU} x\Phi(x) GELUxΦ(x)&#xff0c;其中 Φ ( x ) \Phi(x) Φ(x)​是标准高斯累积分布函数。与ReLU激活函数通过输入…
阅读更多...
pycharm配置wsl开发环境(conda)

pycharm配置wsl开发环境(conda)

背景 在研究qanything项目的过程中&#xff0c;为了进行二次开发&#xff0c;需要在本地搭建开发环境。然后根据文档说明发现该项目并不能直接运行在windows开发环境&#xff0c;但可以运行在wsl环境中。于是我需要先创建wsl环境并配置pycharm。 wsl环境创建 WSL是“Windows Su…
阅读更多...
【多模态大模型】AI对视频内容解析问答

【多模态大模型】AI对视频内容解析问答

文章目录 1. 项目背景2. 直接对视频进行解析进行AI问答&#xff1a;MiniGPT4-Video2.1 MiniGPT4-Video效果 3. 对视频抽帧为图片再进行AI问答3.1 视频抽帧3.2 图片AI问答3.2.1 阿里通义千问大模型 Qwen-vl-plus3.2.2 Moonshot 1. 项目背景 最近在做一个项目,需要使用AI技术对视…
阅读更多...
最新文章

Copyright @ 2022~2023