概述

AbstractAuthenticationTargetUrlRequestHandler是Spring Security Web提供的一个抽象类，它主要实现了这样一种策略 :
认证动作成功时使用一个跳转策略跳转到指定的URL。

该策略实现对应的具体实现方法是 :

    // AbstractAuthenticationTargetUrlRequestHandler 代码片段protected void handle(HttpServletRequest request, HttpServletResponse response,Authentication authentication) throws IOException, ServletException {// 计算跳转目标URL : targetUrlString targetUrl = determineTargetUrl(request, response);if (response.isCommitted()) {// 如果响应对象已经提交，则什么都不做，输出debug日志后直接返回logger.debug("Response has already been committed. Unable to redirect to "+ targetUrl);return;}// 使用指定的跳转策略跳转到目标url :  targetUrlredirectStrategy.sendRedirect(request, response, targetUrl);}

Spring Security Web 基于AbstractAuthenticationTargetUrlRequestHandler有两个实现子类 :

SimpleUrlAuthenticationSuccessHandler – 登录成功时跳转到指定URL

参考UsernamePasswordAuthenticationFilter对SavedRequestAwareAuthenticationSuccessHandler的使用,
SavedRequestAwareAuthenticationSuccessHandler是SimpleUrlAuthenticationSuccessHandler的子类。
SimpleUrlLogoutSuccessHandler – 退出成功时跳转到指定URL

参考LogoutFilter对LogoutSuccessHandler的使用。

源代码

源代码版本 : Spring Security Web 5.1.4 RELEASE

package org.springframework.security.web.authentication;// 省略 import 行public abstract class AbstractAuthenticationTargetUrlRequestHandler {protected final Log logger = LogFactory.getLog(this.getClass());// 如果通过请求参数指定跳转目标URL，使用此属性指定相应的参数名称，可以设置，// 缺省值为 null， 表示不分析请求参数中指定的跳转目标URLprivate String targetUrlParameter = null;// 缺省跳转目标 URL，可以设置,// 缺省值一般使用 /private String defaultTargetUrl = "/";// 是否总是使用缺省跳转目标 URL，也就是属性 defaultTargetUrl ，可以设置,// 缺省值一般使用 falseprivate boolean alwaysUseDefaultTargetUrl = false;// 是否使用头部 Referer ，可以设置,// 缺省值一般使用 falseprivate boolean useReferer = false;// 跳转策略，可以设置,, // 缺省使用 DefaultRedirectStrategyprivate RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();protected AbstractAuthenticationTargetUrlRequestHandler() {}/*** Invokes the configured {@code RedirectStrategy} with the URL returned by the* {@code determineTargetUrl} method.* <p>* The redirect will not be performed if the response has already been committed.*/protected void handle(HttpServletRequest request, HttpServletResponse response,Authentication authentication) throws IOException, ServletException {// 计算跳转目标URL : targetUrl     String targetUrl = determineTargetUrl(request, response);if (response.isCommitted()) {// 如果响应对象已经提交，则什么都不做，输出debug日志后直接返回logger.debug("Response has already been committed. Unable to redirect to "+ targetUrl);return;}// 使用指定的跳转策略跳转到目标url :  targetUrl redirectStrategy.sendRedirect(request, response, targetUrl);}/*** Builds the target URL according to the logic defined in the main class Javadoc.*/protected String determineTargetUrl(HttpServletRequest request,HttpServletResponse response) {// 如果被设置要求总是使用缺省跳转目标url，则返回缺省跳转目标url : defaultTargetUrlif (isAlwaysUseDefaultTargetUrl()) {return defaultTargetUrl;}// Check for the parameter and use that if availableString targetUrl = null;// 如果属性  targetUrlParameter 不为 null， 说明被设置成需要从请求参数中分析跳转目标urlif (targetUrlParameter != null) {targetUrl = request.getParameter(targetUrlParameter);if (StringUtils.hasText(targetUrl)) {// 如果从请求参数中分析得到跳转目标url，返回该url  logger.debug("Found targetUrlParameter in request: " + targetUrl);return targetUrl;}}// 如果被设置为要使用请求头部 Referer 模式，并且目标 url 尚未分析得到，// 则尝试从请求头部 Referer 获取跳转目标urlif (useReferer && !StringUtils.hasLength(targetUrl)) {targetUrl = request.getHeader("Referer");logger.debug("Using Referer header: " + targetUrl);}// 如果经过以上各种分析逻辑，仍未确定跳转目标url，则跳转目标url使用缺省跳转url，// 也就是 defaultTargetUrlif (!StringUtils.hasText(targetUrl)) {targetUrl = defaultTargetUrl;logger.debug("Using default Url: " + targetUrl);}return targetUrl;}/*** Supplies the default target Url that will be used if no saved request is found or* the {@code alwaysUseDefaultTargetUrl} property is set to true. If not set, defaults* to {@code /}.** @return the defaultTargetUrl property*/protected final String getDefaultTargetUrl() {return defaultTargetUrl;}/*** Supplies the default target Url that will be used if no saved request is found in* the session, or the {@code alwaysUseDefaultTargetUrl} property is set to true. If* not set, defaults to {@code /}. It will be treated as relative to the web-app's* context path, and should include the leading <code>/</code>. Alternatively,* inclusion of a scheme name (such as "http://" or "https://") as the prefix will* denote a fully-qualified URL and this is also supported.** @param defaultTargetUrl*/public void setDefaultTargetUrl(String defaultTargetUrl) {Assert.isTrue(UrlUtils.isValidRedirectUrl(defaultTargetUrl),"defaultTarget must start with '/' or with 'http(s)'");this.defaultTargetUrl = defaultTargetUrl;}/*** If <code>true</code>, will always redirect to the value of {@code defaultTargetUrl}* (defaults to <code>false</code>).*/public void setAlwaysUseDefaultTargetUrl(boolean alwaysUseDefaultTargetUrl) {this.alwaysUseDefaultTargetUrl = alwaysUseDefaultTargetUrl;}protected boolean isAlwaysUseDefaultTargetUrl() {return alwaysUseDefaultTargetUrl;}/*** If this property is set, the current request will be checked for this a parameter* with this name and the value used as the target URL if present.** @param targetUrlParameter the name of the parameter containing the encoded target* URL. Defaults to null.*/public void setTargetUrlParameter(String targetUrlParameter) {if (targetUrlParameter != null) {Assert.hasText(targetUrlParameter, "targetUrlParameter cannot be empty");}this.targetUrlParameter = targetUrlParameter;}protected String getTargetUrlParameter() {return targetUrlParameter;}/*** Allows overriding of the behaviour when redirecting to a target URL.*/public void setRedirectStrategy(RedirectStrategy redirectStrategy) {this.redirectStrategy = redirectStrategy;}protected RedirectStrategy getRedirectStrategy() {return redirectStrategy;}/*** If set to {@code true} the {@code Referer} header will be used (if available).* Defaults to {@code false}.*/public void setUseReferer(boolean useReferer) {this.useReferer = useReferer;}}

Spring Security Web : AbstractAuthenticationTargetUrlRequestHandler相关推荐

Spring Security Web : FirewalledResponse 经过防火墙加强安全的响应
概述功能介绍 FirewalledResponse是Spring Security Web提供的一个HttpServletResponse实现,是一个带有防火墙增强安全能力的HttpServletR ...
Spring Security Web : DefaultWebSecurityExpressionHandler 缺省Web安全表达式处理器
概述 DefaultWebSecurityExpressionHandler是Spring Security Web用于Web安全表达式处理器(handler).它会基于一组缺省配置,和当时的环境,对 ...
在15分钟内使用Spring Boot和Spring Security构建一个Web应用程序
"我喜欢编写身份验证和授权代码." 〜从来没有Java开发人员. 厌倦了一次又一次地建立相同的登录屏幕? 尝试使用Okta API进行托管身份验证,授权和多因素身份验证. 开发人员 ...
Spring Security 实战：Spring Boot 下的自动配置
点击上方蓝色"程序猿DD",选择"设为星标" 回复"资源"获取独家整理的学习资料! 来源 | 公众号「码农小胖哥」 1. 前言我们在前几篇 ...
用Spring Security实现后台登录及权限认证功能
测试权限登录http://localhost:8080/ 在这里插入图片描述点击会员中心,尝试访问受限的页面http://localhost:8080/home,由于未登录,结果被强制跳转到登录页 ...
使用Spring Security在Spring Boot中进行缓存
在这篇文章中,我想分享一下O&B的一个团队的经验教训. 他们正在使用带有Spring Security的Spring Boot. 默认情况下,Spring Security保护的所有内容都将通 ...
Spring Security与Maven教程
1.简介在这篇文章中,我们将演示如何针对非常特定的用例将Maven依赖项用于Spring Security. 我们使用的所有库的最新版本都可以在Maven Central上找到. 在项目中,了解Ma ...
Spring Security 示例教程
Spring Security 示例教程 Spring Security提供了在Web应用程序中执行身份验证和授权的方法.我们可以在任何基于servlet的Web应用程序中使用spring secur ...
Spring Security 教程
Spring Security 教程在这篇文章中,我们将讨论Spring框架 "安全性"模块基础知识.我们将在即将发布的帖子中开发一些简单而先进的示例. 现在,开发安全应用程序是 ...

Spring Security Web : AbstractAuthenticationTargetUrlRequestHandler

概述

源代码

Spring Security Web : AbstractAuthenticationTargetUrlRequestHandler相关推荐

最新文章

热门文章