Spring Security介绍（三）过滤器（2）自定义

除了使用security自带的过滤器链，我们还可以自定义过滤器拦截器。

下面看下自定义的和security自带的执行顺序。

一、总结

1、自定义过滤器：

一般自定义fliter都是：

import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;import javax.servlet.*;
import java.io.IOException;@Component
@Slf4j
public class UrlFilter implements Filter {@Overridepublic void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {log.info("进入UrlFilter");filterChain.doFilter(servletRequest,servletResponse);}
}

但是结合spring security，这样的filter不会被执行， 需要修改为继承OncePerRequestFilter

import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;import java.io.IOException;@Component
@Slf4j
public class UrlFilter extends OncePerRequestFilter {@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {log.info("进入UrlFilter");filterChain.doFilter(request,response);}
}
2、执行顺序
2.1、默认顺序：

security自带的过滤器链-->自定义过滤器-->自定义拦截器。

2.2、修改自定义interceptor顺序

修改在WebMvcConfigurer中注册的顺序即可。

2.3、修改自定义filter顺序

加@Order()注解，在注解中加入数字，数字越小，优先级越高，最先执行。其中这个数字可以：

（1）自定义

如

@Component
@Order(1)
public class XxxFilter extends OncePerRequestFilter{}@Component
@Order(2)
public class Xxx1Filter extends OncePerRequestFilter{}

这时执行的顺序是： security自带的过滤器链-->自定义过滤器的顺序-->自定义拦截器的顺序。

（2）使用枚举

源码：

1）HIGHEST_PRECEDENCE

代表这个过滤器在众多过滤器中级别最高，也就是过滤的时候最先执行，这时执行的顺序为：

自定义过滤器的顺序--> security自带的过滤器链-->自定义拦截器的顺序。 

2）LOWEST_PRECEDENCE

表示级别最低，最后执行过滤操作。

2.4、配置文件修改自定义filter顺序

filter的执行顺序除了可以用上面的@Order注解外，还可以通过配置文件设置，这时配置文件设置的优先级--》注解设置的优先级。如我两个filter都设置为Ordered.HIGHEST_PRECEDENCE + 1，其中一个在配置文件设置的，另外一个通过注解设置的，这时配置文件设置的那个会先执行。

package com.demo.security.config;import com.demo.security.filter.UrlTwoFilter;
import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;import java.util.List;@Configuration
public class WebMvcConfig implements WebMvcConfigurer {@Autowiredprivate ParamInterceptor paramInterceptor;@Autowiredprivate ParamOneInterceptor paramOneInterceptor;@Autowiredprivate UrlTwoFilter twoFilter;@Overridepublic void addInterceptors(InterceptorRegistry registry) {registry.addInterceptor(paramOneInterceptor);registry.addInterceptor(paramInterceptor).addPathPatterns("/**");//registry.addInterceptor(paramOneInterceptor);}@Beanpublic FilterRegistrationBean<UrlTwoFilter> getIpFilter() {FilterRegistrationBean<UrlTwoFilter> registrationBean = new FilterRegistrationBean<>();registrationBean.setFilter(twoFilter);registrationBean.setEnabled(true);registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE + 1);registrationBean.setUrlPatterns(List.of("/*"));return registrationBean;}
}

@Component
@Slf4j
//@Order(1)
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlOneFilter extends OncePerRequestFilter

下面通过demo来验证下 

二、demo

1、使用security过滤器
（1）编写过滤器
package com.demo.security.filter;import com.demo.security.constant.UserConstants;
import com.demo.security.dto.UserDTO;
import com.demo.security.util.JwtUtil;
import com.demo.security.util.RedisClient;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.apache.http.entity.ContentType;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.util.StringUtils;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Map;
@Slf4j
public class LoginFilter extends UsernamePasswordAuthenticationFilter {private AuthenticationManager authenticationManager;private RedisClient redisClient;public LoginFilter(AuthenticationManager authenticationManager, RedisClient redisClient) {//super(new AntPathRequestMatcher("/login", "POST"));this.authenticationManager = authenticationManager;this.redisClient = redisClient;}@Overridepublic Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {try {logger.info("进入LoginFilter");String userName = req.getParameter("userName");String passWord = req.getParameter("passWord");if (StringUtils.isEmpty(userName)) {throw new UsernameNotFoundException("请输入账号");}if (StringUtils.isEmpty(passWord)) {throw new UsernameNotFoundException("请输入密码");}//验证用户名密码是否正确Map<String, String> userMap = UserConstants.getUsers();if(!userMap.keySet().contains(userName)){throw new UsernameNotFoundException("用户不存在");}if(!passWord.equals(userMap.get(userName))){throw new UsernameNotFoundException("密码错误");}//这里权限返回空，由后面的授权过滤器查询return authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(userName, passWord, new ArrayList<>()));} catch (UsernameNotFoundException e) {//返回错误信息res.setCharacterEncoding("UTF-8");res.setContentType("application/text;charset=utf-8");try {res.getWriter().write(e.getMessage());} catch (IOException e1) {e1.printStackTrace();}return null;}catch (Exception e){throw new RuntimeException(e);}}@Overrideprotected void successfulAuthentication(HttpServletRequest request,HttpServletResponse res,jakarta.servlet.FilterChain chain,Authentication authResult)throws IOException, jakarta.servlet.ServletException {UserDTO userDTO = (UserDTO) authResult.getPrincipal();String userName = userDTO.getUsername();String password = userDTO.getPassword();String jwtToken = JwtUtil.sign(userName, password);//缓存到redis中redisClient.set(userName,jwtToken);//返回res.setContentType(ContentType.TEXT_HTML.toString());res.getWriter().write(jwtToken);}
}

package com.demo.security.filter;import com.demo.security.util.JwtUtil;
import com.demo.security.util.RedisClient;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.util.StringUtils;import java.io.IOException;
@Slf4j
public class TokenAuthenticationFilter extends BasicAuthenticationFilter {private RedisClient redisClient;private UserDetailsService userDetailsService;public TokenAuthenticationFilter(AuthenticationManager authenticationManager, RedisClient redisClient, UserDetailsService userDetailsService) {super(authenticationManager);this.redisClient = redisClient;this.userDetailsService = userDetailsService;}@Overrideprotected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {logger.info("登陆成功后访问,url={}"+req.getRequestURI());String token = req.getHeader("token");res.setCharacterEncoding("UTF-8");res.setContentType("application/text;charset=utf-8");if(StringUtils.isEmpty(token)){logger.info("登陆成功后访问,url={},token为空"+req.getRequestURI());res.getWriter().write("token为空");return;}//1、token是否正确，是否能反解析出userNameString userName = JwtUtil.getUsername(token);if(StringUtils.isEmpty(userName)){logger.info("登陆成功后访问,url={},token错误"+req.getRequestURI());res.getWriter().write("token错误");return;}//2、验证token是否过期String redisToken = redisClient.get(userName);if(StringUtils.isEmpty(redisToken) || !token.equals(redisToken)){logger.info("登陆成功后访问,url={},token过期"+req.getRequestURI());res.getWriter().write("token过期");return;}UserDetails currentUser = userDetailsService.loadUserByUsername(userName);UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(currentUser,null,currentUser.getAuthorities());SecurityContextHolder.getContext().setAuthentication(authentication);chain.doFilter(req, res);}
}
（2）注册到过滤器链中
package com.demo.security.config;//import com.demo.security.filter.AuthenticationFilter;
//import com.demo.security.filter.LoginFilter;
import com.demo.security.filter.LoginFilter;
import com.demo.security.filter.TokenAuthenticationFilter;
import com.demo.security.util.RedisClient;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.authentication.configuration.GlobalAuthenticationConfigurerAdapter;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;import static io.netty.util.CharsetUtil.encoder;@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityWebConfig {@Autowiredprivate RedisClient redisClient;@Autowiredprivate UserDetailsService userDetailsService;@Beanpublic PasswordEncoder passwordEncoder() {return new MyPasswordEncoder();}@Beanpublic AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {return authConfig.getAuthenticationManager();}@Beanpublic SecurityFilterChain configure(HttpSecurity http, AuthenticationManager authenticationManager) throws Exception {http.csrf(AbstractHttpConfigurer::disable);http.headers(AbstractHttpConfigurer::disable);http.sessionManagement(sessionManagement -> {sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS);});http.authorizeRequests().anyRequest().authenticated().and()//1、登陆、退出url，均由前端拦截器控制，这里注释掉。//1.1、前端拦截器中判断缓存token为空，为空则post请求访问/login，目的是进入LoginFilter获取token//1.2、不为空则带token访问接口，如果AuthenticationFilter拦截token不合法则根据错误码跳转到登陆页面，重复1.1的操作//.logout().logoutUrl("/logout").and()//2、身份认证filter，访问系统（除了白名单接口）需要先登陆。post请求/login接口会进入这个拦截器// 校验用户名密码是否正确，正确返回token给前端，不正确则返回异常信息.addFilterBefore(new LoginFilter(authenticationManager,redisClient), LoginFilter.class)//3、授权filer，authenticationManager为BasicAuthenticationFilter的必传参数。所有的接口都会走到这里// 根据用户id查询权限,连同身份一起塞入SecurityContextHolder全局变量，后面获取用户信息则直接从SecurityContextHolder中get.addFilterBefore(new TokenAuthenticationFilter(authenticationManager,redisClient,userDetailsService),TokenAuthenticationFilter.class);return http.build();}}
2、自定义过滤器拦截器
2.1、过滤器
package com.demo.security.filter;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;import java.io.IOException;@Component
@Slf4j
public class UrlFilter extends OncePerRequestFilter {@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {log.info("进入UrlFilter");filterChain.doFilter(request,response);}
}

package com.demo.security.filter;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;import java.io.IOException;@Component
@Slf4j
public class UrlOneFilter extends OncePerRequestFilter {@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {log.info("进入UrlFilter-one");filterChain.doFilter(request,response);}
}
  2.2、拦截器

（1）编写拦截器

package com.demo.security.interceptor;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;@Component
@Slf4j
public class ParamInterceptor implements HandlerInterceptor {@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {log.info("进入ParamInterceptor");return true;}
}

package com.demo.security.interceptor;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;@Component
@Slf4j
public class ParamOneInterceptor implements HandlerInterceptor {@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {log.info("进入ParamInterceptor-one");return true;}
}

（2）注册

package com.demo.security.config;import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;@Configuration
public class WebMvcConfig implements WebMvcConfigurer {@Autowiredprivate ParamInterceptor paramInterceptor;@Autowiredprivate ParamOneInterceptor paramOneInterceptor;@Overridepublic void addInterceptors(InterceptorRegistry registry) {registry.addInterceptor(paramInterceptor).addPathPatterns("/**");registry.addInterceptor(paramOneInterceptor);}
}
3、测试默认顺序

（1）LoginFilter为特定情况下才能进入（/login的post请求），认证成功即返回：

访问localhost:2222/securityDemo/login?userName=zs&passWord=123后台打印

2024-04-27T09:14:57.210+08:00  INFO 14836 --- [nio-2222-exec-3] com.demo.security.filter.LoginFilter     : 进入LoginFilter

（2）访问其他接口，如localhost:2222/securityDemo/menu/test

如果沒有登录，在TokenAuthenticationFilter就返回了，控制台打印

2024-04-27T09:31:01.715+08:00  INFO 37920 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-27T09:31:01.734+08:00  INFO 37920 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={},token过期/securityDemo/menu/test

如果登录了，后台打印

2024-04-27T09:32:56.046+08:00  INFO 37920 --- [nio-2222-exec-7] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-27T09:32:56.064+08:00  INFO 37920 --- [nio-2222-exec-7] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-27T09:32:56.064+08:00  INFO 37920 --- [nio-2222-exec-7] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-27T09:32:56.070+08:00  INFO 37920 --- [nio-2222-exec-7] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor
2024-04-27T09:32:56.070+08:00  INFO 37920 --- [nio-2222-exec-7] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one

可以看到，执行顺序是security自带的过滤器链-->自定义过滤器-->自定义拦截器

4、修改执行顺序

下面修改自定义的过滤器拦截器的顺序：

4.1、拦截器

在WebMvcConfigurer中修改注册顺序

package com.demo.security.config;import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;@Configuration
public class WebMvcConfig implements WebMvcConfigurer {@Autowiredprivate ParamInterceptor paramInterceptor;@Autowiredprivate ParamOneInterceptor paramOneInterceptor;@Overridepublic void addInterceptors(InterceptorRegistry registry) {registry.addInterceptor(paramOneInterceptor);registry.addInterceptor(paramInterceptor).addPathPatterns("/**");//registry.addInterceptor(paramOneInterceptor);}
}
4.2、过滤器
package com.demo.security.filter;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;import java.io.IOException;@Component
@Slf4j
@Order(2)
public class UrlFilter extends OncePerRequestFilter {@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {log.info("进入UrlFilter");filterChain.doFilter(request,response);}
}

package com.demo.security.filter;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;import java.io.IOException;@Component
@Slf4j
@Order(1)
public class UrlOneFilter extends OncePerRequestFilter {@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {log.info("进入UrlFilter-one");filterChain.doFilter(request,response);}
}

 再次测试，可以看到执行顺序已经修改了

2024-04-27T09:39:09.419+08:00  INFO 65540 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-27T09:39:09.471+08:00  INFO 65540 --- [nio-2222-exec-3] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-27T09:39:09.471+08:00  INFO 65540 --- [nio-2222-exec-3] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-27T09:39:09.476+08:00  INFO 65540 --- [nio-2222-exec-3] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-27T09:39:09.476+08:00  INFO 65540 --- [nio-2222-exec-3] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor

执行顺序为：security自带的过滤器链-->自定义过滤器的顺序-->自定义拦截器的顺序。

5、设置自定义filter优先级最高

（1）只修改一个

package com.demo.security.filter;import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;import java.io.IOException;@Component
@Slf4j
//所有filter中优先级最高
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlFilter extends OncePerRequestFilter {@Overrideprotected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, IOException {log.info("进入UrlFilter");filterChain.doFilter(request,response);}
}

 另外一个不变：

@Component
@Slf4j
@Order(1)
public class UrlOneFilter extends OncePerRequestFilter

这时访问登录接口后台打印：

2024-04-28T11:11:31.846+08:00  INFO 37052 --- [nio-2222-exec-5] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:11:31.847+08:00  INFO 37052 --- [nio-2222-exec-5] com.demo.security.filter.LoginFilter     : 进入LoginFilter

再访问localhost:2222/securityDemo/menu/test，后台打印：

2024-04-28T11:10:53.685+08:00  INFO 37052 --- [nio-2222-exec-4] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:10:53.686+08:00  INFO 37052 --- [nio-2222-exec-4] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-28T11:10:53.688+08:00  INFO 37052 --- [nio-2222-exec-4] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:10:53.689+08:00  INFO 37052 --- [nio-2222-exec-4] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-28T11:10:53.689+08:00  INFO 37052 --- [nio-2222-exec-4] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor

可以看到，自定义的filter比security自带的过滤器链顺序都高。

（2）再把另外一个filter优先级也提高：

@Component
@Slf4j
//@Order(1)
@Order(Ordered.HIGHEST_PRECEDENCE+2)
public class UrlOneFilter extends OncePerRequestFilter

访问登录接口localhost:2222/securityDemo/login?userName=zs&passWord=123

2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] o.a.c.c.C.[.[localhost].[/securityDemo]  : Initializing Spring DispatcherServlet 'dispatcherServlet'
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] o.s.web.servlet.DispatcherServlet        : Completed initialization in 0 ms
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:14:35.904+08:00  INFO 56456 --- [nio-2222-exec-2] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:14:35.919+08:00  INFO 56456 --- [nio-2222-exec-2] com.demo.security.filter.LoginFilter     : 进入LoginFilter

再访问localhost:2222/securityDemo/menu/test，后台打印：

2024-04-28T11:15:30.019+08:00  INFO 56456 --- [nio-2222-exec-5] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:15:30.019+08:00  INFO 56456 --- [nio-2222-exec-5] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:15:30.020+08:00  INFO 56456 --- [nio-2222-exec-5] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-28T11:15:30.021+08:00  INFO 56456 --- [nio-2222-exec-5] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-28T11:15:30.021+08:00  INFO 56456 --- [nio-2222-exec-5] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor
6、测试相同Order顺序

再加一个filter，且优先级都设置成相同的：

@Component
@Slf4j
//所有filter中优先级最高
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlFilter extends OncePerRequestFilter
@Component
@Slf4j
//@Order(1)
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlOneFilter extends OncePerRequestFilter

@Component
@Slf4j
@Order(Ordered.HIGHEST_PRECEDENCE+1)
public class UrlTwoFilter extends OncePerRequestFilter

测试，执行顺序为：

2024-04-28T11:28:38.217+08:00  INFO 41668 --- [nio-2222-exec-5] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:28:38.217+08:00  INFO 41668 --- [nio-2222-exec-5] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:28:38.218+08:00  INFO 41668 --- [nio-2222-exec-5] com.demo.security.filter.UrlTwoFilter    : 进入UrlFilter-two

现在将two放到配置文件中指定顺序：

package com.demo.security.config;import com.demo.security.filter.UrlTwoFilter;
import com.demo.security.interceptor.ParamInterceptor;
import com.demo.security.interceptor.ParamOneInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;import java.util.List;@Configuration
public class WebMvcConfig implements WebMvcConfigurer {@Autowiredprivate ParamInterceptor paramInterceptor;@Autowiredprivate ParamOneInterceptor paramOneInterceptor;@Autowiredprivate UrlTwoFilter twoFilter;@Overridepublic void addInterceptors(InterceptorRegistry registry) {registry.addInterceptor(paramOneInterceptor);registry.addInterceptor(paramInterceptor).addPathPatterns("/**");//registry.addInterceptor(paramOneInterceptor);}@Beanpublic FilterRegistrationBean<UrlTwoFilter> getIpFilter() {FilterRegistrationBean<UrlTwoFilter> registrationBean = new FilterRegistrationBean<>();registrationBean.setFilter(twoFilter);registrationBean.setEnabled(true);registrationBean.setOrder(Ordered.HIGHEST_PRECEDENCE + 1);registrationBean.setUrlPatterns(List.of("/*"));return registrationBean;}
}

再次查看执行顺序：

2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] com.demo.security.filter.UrlTwoFilter    : 进入UrlFilter-two
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] com.demo.security.filter.UrlFilter       : 进入UrlFilter
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] com.demo.security.filter.UrlOneFilter    : 进入UrlFilter-one
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] c.d.s.filter.TokenAuthenticationFilter   : 登陆成功后访问,url={}/securityDemo/menu/test
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] c.d.s.interceptor.ParamOneInterceptor    : 进入ParamInterceptor-one
2024-04-28T11:31:22.754+08:00  INFO 18328 --- [nio-2222-exec-3] c.d.s.interceptor.ParamInterceptor       : 进入ParamInterceptor

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.hqwc.cn/news/661379.html

如若内容造成侵权/违法违规/事实不符，请联系编程知识网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

3.C++动态内存管理（超全）

3.C++动态内存管理（超全）

目录 1 .C/C 内存分布 2. C语言中动态内存管理方式&#xff1a;malloc/calloc/realloc/free 3. C内存管理方式 3.1 new/delete操作内置类型 3.2 new和delete操作自定义类型 3.3 operator new函数 3.4 定位new表达式(placement-new) &#xff08;了解&#xff09; 4. 常…
阅读更多...
nginx配置ip_hash负载均衡策略

nginx配置ip_hash负载均衡策略

一、nginx配置ip_hash负载均衡策略 nginx默认的负载均衡策略为轮询&#xff0c;某些场景需要使用ip_hash负载策略&#xff0c;即&#xff1a;同一个ip地址&#xff0c;永远访问nginx后面同一台tomcat。配置示例如下&#xff0c;主要是设置ip_hash&#xff1a; upstream www.ab…
阅读更多...
【PCB专题】案例：PCB出货报告会体现什么信息？

【PCB专题】案例：PCB出货报告会体现什么信息？

不知道在实际的生活中大家有没有拿到一个设备或东西看用户手册的习惯。比如拿到一个电风扇看一下说明书怎么使用，怎么安装，怎么做维护等。 一般情况下我拿到东西会先抽一点时间看一下用户手册学习如何使用，如果说明书比较重要的话会保留起来。本文章其实就是PCB打样后供应商…
阅读更多...
ES集群分布式查询原理

ES集群分布式查询原理

集群分布式查询 elasticsearch的查询分成两个阶段&#xff1a; scatter phase&#xff1a;分散阶段&#xff0c;coordinating node会把请求分发到每一个分片gather phase&#xff1a;聚集阶段&#xff0c;coordinating node汇总data node的搜索结果&#xff0c;并处理为最终结…
阅读更多...
Avalonia .NET构建Linux桌面应用

Avalonia .NET构建Linux桌面应用

目录 &#x1f47b;前言 &#x1f4bb;安装Avalonia &#x1f4e6;创建项目 &#x1f4da;在win下运行 ​&#x1f511;打包发布​编辑 &#x1f4fb;在linux下运行 环境WIN10 VS2022 debian &#x1f47b;前言 Avalonia 是一个用于创建跨平台用户界面 (UI) 的开源框架…
阅读更多...
QT之信号和槽

QT之信号和槽

在刚刚了解Qt的时候&#xff0c;为了通过按钮显示 hello world 的时候曾说明过信号与槽&#xff0c;虽然没有细说&#xff0c;不过也算是接触过。 而本文就会细细说明什么是 Qt 的信号与槽。 概念初识 在 linux 学进程相关的内容的时候&#xff0c;曾了解过信号是操作系统控…
阅读更多...
数据仓库和数据仓库分层

数据仓库和数据仓库分层

一、数据仓库概念 数据仓库(Data Warehouse)&#xff0c;可简写为DW或DWH。数据仓库&#xff0c;是为企业所有级别的决策制定过程&#xff0c;提供所有类型数据支持的战略集合。它是单个数据存储&#xff0c;出于分析性报告和决策支持目的而创建。 为需要业务智能的企业&#…
阅读更多...
基于STC12C5A60S2系列1T 8051单片机的Proteus中的单片机发送一帧或一串数据给串口调试助手软件接收区显示出来的串口通信应用

基于STC12C5A60S2系列1T 8051单片机的Proteus中的单片机发送一帧或一串数据给串口调试助手软件接收区显示出来的串口通信应用

基于STC12C5A60S2系列1T 8051单片机的Proteus中的单片机发送一帧或一串数据给串口调试助手软件接收区显示出来的串口通信应用 STC12C5A60S2系列1T 8051单片机管脚图STC12C5A60S2系列1T 8051单片机串口通信介绍STC12C5A60S2系列1T 8051单片机串口通信的结构基于STC12C5A60S2系列…
阅读更多...
动手学深度学习3.6 softmax回归的从零开始实现-笔记练习（PyTorch）

动手学深度学习3.6 softmax回归的从零开始实现-笔记练习（PyTorch）

以下内容为结合李沐老师的课程和教材补充的学习笔记&#xff0c;以及对课后练习的一些思考&#xff0c;自留回顾&#xff0c;也供同学之人交流参考。 本节课程地址&#xff1a;Softmax 回归从零开始实现_哔哩哔哩_bilibili 本节教材地址&#xff1a;3.6. softmax回归的从零开…
阅读更多...
【最大公约数 排序】2344. 使数组可以被整除的最少删除次数

【最大公约数 排序】2344. 使数组可以被整除的最少删除次数

本文涉及知识点 最大公约数 排序 LeetCode2344. 使数组可以被整除的最少删除次数 给你两个正整数数组 nums 和 numsDivide 。你可以从 nums 中删除任意数目的元素。 请你返回使 nums 中 最小 元素可以整除 numsDivide 中所有元素的 最少 删除次数。如果无法得到这样的元素&a…
阅读更多...
讯饶科技 X2Modbus 敏感信息泄露

讯饶科技 X2Modbus 敏感信息泄露

讯饶科技 X2Modbus 敏感信息泄露 文章目录 讯饶科技 X2Modbus 敏感信息泄露漏洞描述影响版本实现原理漏洞复现修复建议 漏洞描述 X2Modbus是一款功能很强大的协议转换网关&#xff0c; 这里的X代表各家不同 的通信协议&#xff0c;2是To的谐音表示转换&#xff0c;Modbus就是最…
阅读更多...
企业家如何拥有良好口才的能力（3篇）

企业家如何拥有良好口才的能力（3篇）

企业家如何拥有良好口才的能力&#xff08;3篇&#xff09; **篇&#xff1a;企业家提升口才能力的基石 一、引言 作为企业家&#xff0c;口才不仅是沟通的工具&#xff0c;更是展现领导魅力和企业形象的窗口。本文将探讨企业家如何拥有良好口才能力的基石。 二、清晰的目标与…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023