Java 类org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter 实例源码

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .addFilterBefore(new HeaderSecurityFilter(), SecurityContextHolderAwareRequestFilter.class)
            .cors()
                .and()
            .csrf()
                .disable()
            .authorizeRequests()
                .antMatchers("/health").permitAll()
                .antMatchers("/websocket").permitAll()
                .antMatchers(HttpMethod.OPTIONS,"**").permitAll()
                .antMatchers(HttpMethod.POST, "/api/**").hasAuthority(SecurityAuthoritiesEnum.COLLECTOR.toString())
                .antMatchers(HttpMethod.DELETE, "/api/**").hasAuthority(SecurityAuthoritiesEnum.COLLECTOR.toString())
                .antMatchers(HttpMethod.POST, "/reviews/**").hasAuthority(SecurityAuthoritiesEnum.REGULAR.toString())
                .antMatchers(HttpMethod.GET, "/dashboards/**").hasAnyAuthority(SecurityAuthoritiesEnum.REGULAR.toString(), SecurityAuthoritiesEnum.SCREEN.toString())
                .antMatchers(HttpMethod.GET, "/emitter/**").hasAnyAuthority(SecurityAuthoritiesEnum.REGULAR.toString(), SecurityAuthoritiesEnum.SCREEN.toString())
                .antMatchers(HttpMethod.POST, "/dashboards/**").hasAuthority(SecurityAuthoritiesEnum.REGULAR.toString())
                .antMatchers(HttpMethod.DELETE, "/dashboards/**").hasAuthority(SecurityAuthoritiesEnum.REGULAR.toString())
                .antMatchers(HttpMethod.PUT, "/dashboards/**").hasAuthority(SecurityAuthoritiesEnum.REGULAR.toString());
}

@Override
public Object postProcessAfterInitialization(Object bean, String beanName)
    throws BeansException {

    // remove this if you are not using JSR-250
    if(bean instanceof Jsr250MethodSecurityMetadataSource) {
        ((Jsr250MethodSecurityMetadataSource) bean).setDefaultRolePrefix(null);
    }

    if(bean instanceof DefaultMethodSecurityExpressionHandler) {
        ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if(bean instanceof DefaultWebSecurityExpressionHandler) {
        ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if(bean instanceof SecurityContextHolderAwareRequestFilter) {
        ((SecurityContextHolderAwareRequestFilter)bean).setRolePrefix("");
    }
    if(bean instanceof RoleVoter){
        ((RoleVoter) bean).setRolePrefix("");
    }
    return bean;
}

@Override
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {

  // remove this if you are not using JSR-250
  if (bean instanceof Jsr250MethodSecurityMetadataSource) {
    ((Jsr250MethodSecurityMetadataSource) bean).setDefaultRolePrefix(this.rolePrefix);
  }

  if (bean instanceof DefaultMethodSecurityExpressionHandler) {
    ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix(this.rolePrefix);
  }
  if (bean instanceof DefaultWebSecurityExpressionHandler) {
    ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix(this.rolePrefix);
  }
  if (bean instanceof SecurityContextHolderAwareRequestFilter) {
    ((SecurityContextHolderAwareRequestFilter) bean).setRolePrefix(this.rolePrefix);
  }
  return bean;
}

@Override
public Object postProcessAfterInitialization( Object bean, String beanName )
    throws BeansException
{
    if ( bean instanceof Jsr250MethodSecurityMetadataSource )
    {
        ((Jsr250MethodSecurityMetadataSource) bean).setDefaultRolePrefix( null );
    }

    if ( bean instanceof DefaultMethodSecurityExpressionHandler )
    {
        ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix( null );
    }

    if ( bean instanceof DefaultWebSecurityExpressionHandler )
    {
        ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix( null );
    }

    if ( bean instanceof SecurityContextHolderAwareRequestFilter )
    {
        ((SecurityContextHolderAwareRequestFilter) bean).setRolePrefix( "" );
    }

    return bean;
}

@Override
public Object postProcessAfterInitialization(final Object bean, final String beanName) {
    if (bean instanceof DefaultMethodSecurityExpressionHandler) {
        ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if (bean instanceof DefaultWebSecurityExpressionHandler) {
        ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if (bean instanceof SecurityContextHolderAwareRequestFilter) {
        SecurityContextHolderAwareRequestFilter filter = (SecurityContextHolderAwareRequestFilter) bean;
        filter.setRolePrefix(StringUtils.EMPTY);
        try {
            filter.afterPropertiesSet();
        } catch (ServletException e) {
            throw new FatalBeanException(e.getMessage(), e);
        }
    }

    return bean;
}

@Override
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
    // remove this if you are not using JSR-250
    if (bean instanceof Jsr250MethodSecurityMetadataSource) {
        ((Jsr250MethodSecurityMetadataSource) bean).setDefaultRolePrefix(null);
    }

    if (bean instanceof DefaultMethodSecurityExpressionHandler) {
        ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if (bean instanceof DefaultWebSecurityExpressionHandler) {
        ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if (bean instanceof SecurityContextHolderAwareRequestFilter) {
        ((SecurityContextHolderAwareRequestFilter) bean).setRolePrefix("");
    }
    return bean;
}

private List<SecurityFilterChain> filterChain() {
List<SecurityFilterChain> filters = new ArrayList<SecurityFilterChain>(12);
       RequestMatcher req = new AntPathRequestMatcher("/**");

       filters.add(new DefaultSecurityFilterChain(req, new SecurityContextPersistenceFilter(), 
               logoutFilter(),cojAuthenticationProcessingFilter(),new SecurityContextHolderAwareRequestFilter(),
               rememberMeAuthenticationFilter(),anonymousAuthenticationFilter(),exceptionTranslationFilter(),filterInvocationInterceptor()
               ));
return filters;
   }

protected void configure(HttpSecurity httpSecurity) throws Exception {

        //@formatter:off
        httpSecurity
                .authorizeRequests().anyRequest().authenticated()
                .and()
                    .headers().disable()
                    .servletApi()
                .and()
                    .csrf().disable()
                    .sessionManagement()
                    .enableSessionUrlRewriting(false)
                    .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
                    .sessionFixation()
                    .newSession()
                .and()
                    .formLogin()
                        .loginPage("/login.jsp")
                        .loginProcessingUrl("/j_spring_security_check")
                        .successHandler(successHandler)
                        .failureHandler(failureHandler)
                        .usernameParameter("j_username")
                        .passwordParameter("j_password")
                .and()
                    .logout()
                        .logoutSuccessUrl("/login.jsp")
                        .deleteCookies("ATLASSESSIONID")
                        .logoutUrl("/logout.html")
                .and()
                    .httpBasic()
                    .authenticationEntryPoint(getDelegatingAuthenticationEntryPoint());
        //@formatter:on

        if (configuration.getBoolean("atlas.server.ha.enabled", false)) {
            LOG.info("Atlas is in HA Mode, enabling ActiveServerFilter");
            httpSecurity.addFilterAfter(activeServerFilter, BasicAuthenticationFilter.class);
        }
        httpSecurity
                .addFilterAfter(staleTransactionCleanupFilter, BasicAuthenticationFilter.class)
                .addFilterAfter(ssoAuthenticationFilter, BasicAuthenticationFilter.class)
                .addFilterAfter(atlasAuthenticationFilter, SecurityContextHolderAwareRequestFilter.class)
                .addFilterAfter(csrfPreventionFilter, AtlasAuthenticationFilter.class)
                .addFilterAfter(atlasAuthorizationFilter, FilterSecurityInterceptor.class);
    }

private void addSecurityContextHolderAwareRequestFilter(List<Filter> filters) throws ServletException {
    SecurityContextHolderAwareRequestFilter securityFilter = new SecurityContextHolderAwareRequestFilter();
    securityFilter.setTrustResolver(new AuthenticationTrustResolverImpl());
    securityFilter.afterPropertiesSet();
    filters.add(securityFilter);
}

/**
 * Gets the security context holder aware request filter.
 *
 * @return the security context holder aware request filter
 */
@Bean(name = "securityContextHolderAwareRequestFilter")
public SecurityContextHolderAwareRequestFilter getSecurityContextHolderAwareRequestFilter() {
  return new SecurityContextHolderAwareRequestFilter();
}