RememberMeServices

RememberMeServices
记住我的服务的接口
可以重写实现自己的记住我

public interface RememberMeServices {
//建议 org. springframework. security. authentication. RememberMeAuthenticationToken 在大多数情况下使用它，因为它具有相应的身份验证提供程序。Authentication autoLogin(HttpServletRequest request, HttpServletResponse response);void loginFail(HttpServletRequest request, HttpServletResponse response);void loginSuccess(HttpServletRequest request, HttpServletResponse response,Authentication successfulAuthentication);
}

AbstractRememberMeServices
记住我基类

public abstract class AbstractRememberMeServicesimplements RememberMeServices, InitializingBean, LogoutHandler, MessageSourceAware {
}

1. 从请求内获取cookie
2. 判断cookie长度是否为0，为0删除cookie
3. cookie解码
4. 执行autoLoginCookie，返回用户详细信息
5. 检查cookie判断是否被禁用
6. 创建从 autoLogin 方法返回的最终 Authentication 对象。

在请求中找到 Spring Security 记住我 cookie 并返回其值。


当MaxAge为0时候表示删除cookie

解码 cookie 并使用 “：” 分隔符将其拆分为一组令牌字符串。

由子类实现,整个autoLogin是一个模板方法

返回的最终 Authentication 对象

TokenBasedRememberMeServices
校验过期时间->生成签名并与cookieTokens中进行比较

PersistentTokenBasedRememberMeServices
默认实现InMemory,还提供了JDBC

RememberMeAuthenticationFilter

来看看RememberMe的引用
之前也提到过GenericFilterBean，他是Filte的简单基本实现，不处理这个过滤器仅执行一次

public class RememberMeAuthenticationFilter extends GenericFilterBean implements ApplicationEventPublisherAware {
// 成功处理器private AuthenticationSuccessHandler successHandler;
// 授权管理器private AuthenticationManager authenticationManager;
// 上文提到的记住我服务	private RememberMeServices rememberMeServices;
// 策略类private SecurityContextRepository securityContextRepository = new NullSecurityContextRepository();
}

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)throws IOException, ServletException {// 不为null,说明已经认证过了if (SecurityContextHolder.getContext().getAuthentication() != null) {this.logger.debug(LogMessage.of(() -> "SecurityContextHolder not populated with remember-me token, as it already contained: '"+ SecurityContextHolder.getContext().getAuthentication() + "'"));chain.doFilter(request, response);return;}Authentication rememberMeAuth = this.rememberMeServices.autoLogin(request, response);if (rememberMeAuth != null) {// Attempt authenticaton via AuthenticationManagertry {// 授权、认证rememberMeAuth = this.authenticationManager.authenticate(rememberMeAuth);// Store to SecurityContextHolder// 重新设置上下文SecurityContext context = SecurityContextHolder.createEmptyContext();context.setAuthentication(rememberMeAuth);// 之前也提及过，默认是threadLoacl	SecurityContextHolder.setContext(context);	onSuccessfulAuthentication(request, response, rememberMeAuth);this.logger.debug(LogMessage.of(() -> "SecurityContextHolder populated with remember-me token: '"+ SecurityContextHolder.getContext().getAuthentication() + "'"));// 保存securityContextthis.securityContextRepository.saveContext(context, request, response);if (this.eventPublisher != null) {this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(SecurityContextHolder.getContext().getAuthentication(), this.getClass()));}if (this.successHandler != null) {this.successHandler.onAuthenticationSuccess(request, response, rememberMeAuth);return;}}catch (AuthenticationException ex) {this.logger.debug(LogMessage.format("SecurityContextHolder not populated with remember-me token, as AuthenticationManager "+ "rejected Authentication returned by RememberMeServices: '%s'; "+ "invalidating remember-me token", rememberMeAuth),ex);this.rememberMeServices.loginFail(request, response);onUnsuccessfulAuthentication(request, response, ex);}}chain.doFilter(request, response);}

RememberMeAuthenticationToken

指示类可以处理特定的 Authentication 实现,策略模式

public interface AuthenticationProvider {
Authentication authenticate(Authentication authentication) throws AuthenticationException;
boolean supports(Class<?> authentication);
}

RememberMeAuthenticationProvider

RememberMeConfigurer

配置记住我过滤器，核心方法init和configure

这一步可以设置自己的RememberMeService

 .and().rememberMe().rememberMeServices(rememberMeServices()) // 设置自动登录时使用rememberServic