04 SecurityContextHolder与SecurityContext说明

该篇记录一下SecurityContextHolder与SecurityContext两个类，当然还有与它们关系密码的SecurityContextPersistenceFilter.java这个过滤器

1. SecurityContext.java

查看spring security的源码，发现它就是个接口，spring security提供了一个默认的实现SecurityContextImpl.java. 仔细一看，该类其实就是对Authentication对象进行了封装，当然，覆写了equals和hashCode两个方法。

public class SecurityContextImpl implements SecurityContext {

    private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

    // ~ Instance fields
    // ================================================================================================

    private Authentication authentication;

    public SecurityContextImpl() {}

    public SecurityContextImpl(Authentication authentication) {
        this.authentication = authentication;
    }

    // ~ Methods
    // ========================================================================================================

    @Override
    public boolean equals(Object obj) {
        if (obj instanceof SecurityContextImpl) {
            SecurityContextImpl test = (SecurityContextImpl) obj;

            if ((this.getAuthentication() == null) && (test.getAuthentication() == null)) {
                return true;
            }

            if ((this.getAuthentication() != null) && (test.getAuthentication() != null)
                    && this.getAuthentication().equals(test.getAuthentication())) {
                return true;
            }
        }

        return false;
    }

    @Override
    public Authentication getAuthentication() {
        return authentication;
    }

    @Override
    public int hashCode() {
        if (this.authentication == null) {
            return -1;
        }
        else {
            return this.authentication.hashCode();
        }
    }

    @Override
    public void setAuthentication(Authentication authentication) {
        this.authentication = authentication;
    }

}

2. SecurityContextHolder.java

官方解释就是： Associates a given {@link SecurityContext} with the current execution thread.（与当前线程的securitycontext有关）

其实，它就是存储SecurityContext对象。

默认的策略采用ThreadLocal

源代码如下：

public class SecurityContextHolder {
    // ~ Static fields/initializers
    // =====================================================================================

    public static final String MODE_THREADLOCAL = "MODE_THREADLOCAL";
    public static final String MODE_INHERITABLETHREADLOCAL = "MODE_INHERITABLETHREADLOCAL";
    public static final String MODE_GLOBAL = "MODE_GLOBAL";
    public static final String SYSTEM_PROPERTY = "spring.security.strategy";
    private static String strategyName = System.getProperty(SYSTEM_PROPERTY);
    private static SecurityContextHolderStrategy strategy;
    private static int initializeCount = 0;

    static {
        initialize();
    }


    private static void initialize() {
        // 如果没有设置自定义的策略，就采用MODE_THREADLOCAL模式
        if (!StringUtils.hasText(strategyName)) {
            // Set default
            strategyName = MODE_THREADLOCAL;
        }
        // ThreadLocal策略
        if (strategyName.equals(MODE_THREADLOCAL)) {
            strategy = new ThreadLocalSecurityContextHolderStrategy();
        }
        // 采用InheritableThreadLocal，它是ThreadLocal的一个子类
        else if (strategyName.equals(MODE_INHERITABLETHREADLOCAL)) {
            strategy = new InheritableThreadLocalSecurityContextHolderStrategy();
        }
        // 全局策略，实现方式就是static SecurityContext contextHolder
        else if (strategyName.equals(MODE_GLOBAL)) {
            strategy = new GlobalSecurityContextHolderStrategy();
        }
        else {
            // 自定义的策略，通过返回创建出
            try {
                Class<?> clazz = Class.forName(strategyName);
                Constructor<?> customStrategy = clazz.getConstructor();
                strategy = (SecurityContextHolderStrategy) customStrategy.newInstance();
            }
            catch (Exception ex) {
                ReflectionUtils.handleReflectionException(ex);
            }
        }

        initializeCount++;
    }

}

补充说明： InheritableThreadLocal 与 ThreadLocal的区别

ThreadLocal ， 存储变量只能被当前线程使用

InheritableThreadLocal  ， 父线程中存储的变量子线程也可使用

3. SecurityContextPersistenceFilter.java 

该过滤器是spring security 过滤器链的第一个过滤器，所以请求进来时，第一个经过它，响应数据时，最后一个经过它。

请求进来时, 它会检测session中是否有SecurityContext,如果有，它会将SecurityContext从session中拿出来，放到线程中。

当请求响应时，它会检测线程是否有SecurityContext，如果有，它会将SecurityContext放到session中去。

这样，不同的请求，就可以拿到同一个认证信息 Authentication

下面看具体源码：

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        ......
        
        // 将request与response对象封装成一个HttpRequestResponseHolder对象，减少方法列表个数
        HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request,response);
        
        // 检测session中是否有SecurityContext,如果有就从session中获取，如果没有，创建一个新的
        SecurityContext contextBeforeChainExecution = repo.loadContext(holder);

        try {
            // 将SecurityContext对象放到当前执行的线程中
            SecurityContextHolder.setContext(contextBeforeChainExecution);
            // 调用过滤器链
            chain.doFilter(holder.getRequest(), holder.getResponse());

        }
        finally {
            // 从当前线程中获取SecurityContext对象
            SecurityContext contextAfterChainExecution = SecurityContextHolder.getContext();
            // 清空当前线程中的SecurityContext
            SecurityContextHolder.clearContext();
            // 将SecurityContext放入到session中
            repo.saveContext(contextAfterChainExecution, holder.getRequest(),holder.getResponse());
        }
    }

接着看下loadContext(holder)方法的源码

public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) {
        HttpServletRequest request = requestResponseHolder.getRequest();
        HttpServletResponse response = requestResponseHolder.getResponse();
        // 获取session
        HttpSession httpSession = request.getSession(false);
        // 从session中获取SecurityContext对象
        SecurityContext context = readSecurityContextFromSession(httpSession);

        // 如果是null,就创建一个新的
        if (context == null) {
            context = generateNewContext();

        }
        .......

        return context;
    }

4. 总结 

这几个相关的类看完了，感叹spring的代码就是写得好！

(1) SecurityContextHolder它的责任就是存储SecurityContext对象，但是怎么存储，采用何种存储策略则是通过SecurityContextHolderStrategy来实现的。SecurityContextHolderStrategy只是一个抽象接口，spring security 默认提供了几种存储策略，它们都实现了SecurityContextHolderStrategy接口。如果我们想自定义存储策略，肯定也得实现SecurityContextHolderStrategy。这样子，SecurityContextHolder 只需要提供存储策略的方式，至于如何实现这种存储策略，则完全交给了SecurityContextHolderStrategy及其实现类来控制，做到责任分离吧！

(2) SecurityContextPersistenceFilter也是骚了一逼，将交量转换用得神了！