为什么 Spring 调用一个额外的过滤器链以及一个原始的过滤器链？

Question

在我的日志中，我发现 Spring 在授权我的请求时调用了两个单独的过滤器链。所以我的问题是，为什么 Spring 调用 additional 过滤器链以及 original 过滤器链。因为这种行为会导致我的应用程序在处理请求时对用户进行两次身份验证。特别是它不必要地再次调用我的 AuthenticationFilter。

在这里你可以看到日志：

27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/api/account/@me'; against '/api/account/**'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 1 of 10 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 2 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 3 of 10 in additional filter chain; firing Filter: 'HeaderWriterFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 4 of 10 in additional filter chain; firing Filter: 'TokenAuthenticationFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] d.t.o.a.a.TokenAuthenticationFilter      : Request is to process authentication
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.authentication.ProviderManager     : Authentication attempt using dev.teamnight.oauth2.authserver.authentication.ApplicationAuthenticationProvider
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.authentication.ProviderManager     : Authentication attempt using dev.teamnight.oauth2.authserver.authentication.BearerAuthenticationProvider
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] d.t.o.a.a.TokenAuthenticationFilter      : Authentication success. Updating SecurityContextHolder to contain: dev.teamnight.oauth2.authserver.authentication.TokenAuthenticationToken@aeed7374: Principal: dev.teamnight.oauth2.authserver.authentication.OAuth2Principal@46a2793d; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 5 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 6 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 7 of 10 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.a.AnonymousAuthenticationFilter  : SecurityContextHolder not populated with anonymous token, as it already contained: 'dev.teamnight.oauth2.authserver.authentication.TokenAuthenticationToken@aeed7374: Principal: dev.teamnight.oauth2.authserver.authentication.OAuth2Principal@46a2793d; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] s.CompositeSessionAuthenticationStrategy : Delegating to org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy@5f8a02cf
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request '/api/account/@me' matched by universal pattern '/**'
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /api/account/@me; Attributes: [hasAnyAuthority('READ_ALL','BEARER_ACCESS')]
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: dev.teamnight.oauth2.authserver.authentication.TokenAuthenticationToken@aeed7374: Principal: dev.teamnight.oauth2.authserver.authentication.OAuth2Principal@46a2793d; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.a.h.RoleHierarchyImpl              : getReachableGrantedAuthorities() - From the roles [SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS] one can reach [SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS] in zero or more steps.
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@2830c7a3, returned: 1
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.a.i.FilterSecurityInterceptor    : Authorization successful
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.a.i.FilterSecurityInterceptor    : RunAsManager did not change Authentication object
<< Additional Filter Chain Ends >> 27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /api/account/@me reached end of additional filter chain; proceeding with original chain
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] d.t.o.a.a.TokenAuthenticationFilter      : Request is to process authentication
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.authentication.ProviderManager     : Authentication attempt using dev.teamnight.oauth2.authserver.authentication.ApplicationAuthenticationProvider
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.authentication.ProviderManager     : Authentication attempt using dev.teamnight.oauth2.authserver.authentication.BearerAuthenticationProvider
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] d.t.o.a.a.TokenAuthenticationFilter      : Authentication success. Updating SecurityContextHolder to contain: dev.teamnight.oauth2.authserver.authentication.TokenAuthenticationToken@c97cfb62: Principal: dev.teamnight.oauth2.authserver.authentication.OAuth2Principal@571022e9; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.a.i.a.MethodSecurityInterceptor    : Secure object: ReflectiveMethodInvocation: public dev.teamnight.oauth2.authserver.entities.json.AccountDTO dev.teamnight.oauth2.authserver.controllers.ApiController.getBearedAccount(javax.servlet.http.HttpServletRequest); target is of class [dev.teamnight.oauth2.authserver.controllers.ApiController]; Attributes: [[authorize: 'hasAuthority('BEARER_ACCESS')', filter: 'null', filterTarget: 'null']]
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.a.i.a.MethodSecurityInterceptor    : Previously Authenticated: dev.teamnight.oauth2.authserver.authentication.TokenAuthenticationToken@c97cfb62: Principal: dev.teamnight.oauth2.authserver.authentication.OAuth2Principal@571022e9; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.a.h.RoleHierarchyImpl              : getReachableGrantedAuthorities() - From the roles [SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS] one can reach [SCOPE_account.email, BEARER_ACCOUNT_1, SCOPE_account.basic, BEARER_ACCESS] in zero or more steps.
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter@35948508, returned: 1
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.a.i.a.MethodSecurityInterceptor    : Authorization successful
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.a.i.a.MethodSecurityInterceptor    : RunAsManager did not change Authentication object
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@37c5e3bd
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] o.s.s.w.a.ExceptionTranslationFilter     : Chain processed normally
27-01-2021 DEBUG 10784 --- [nio-8080-exec-3] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed

这是我的网络安全配置：

        @Bean
        @Qualifier("accountApiAuthenticationFilter")
        public TokenAuthenticationFilter accountApiAuthenticationFilter(TokenAuthenticationFailureHandler failureHandler,
                TokenAuthenticationSuccessHandler successHandler) throws Exception {
            TokenAuthenticationFilter filter = new TokenAuthenticationFilter();
            filter.setAuthenticationManager(authenticationManagerBean());
            filter.setAuthenticationFailureHandler(failureHandler);
            filter.setAuthenticationSuccessHandler(successHandler);
            filter.setAllowedTokenTypes(TokenType.APPLICATION, TokenType.BEARER);
            return filter;
        }
        
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.antMatcher("/api/account/**")
                .addFilterBefore(accountApiAuthenticationFilter(null, null), UsernamePasswordAuthenticationFilter.class)
                .authorizeRequests()
                .antMatchers("**").hasAnyAuthority("READ_ALL", "BEARER_ACCESS")
                .anyRequest().authenticated()
                .and()
                .authenticationProvider(this.appProvider)
                .authenticationProvider(this.bearerProvider)
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(new TokenAuthenticationEntryPoint())
                .and()
                .cors().disable()
                .formLogin().disable()
                .csrf().disable()
                .logout().disable();
        }

Answer 1

默认情况下，Spring Boot 将在常规 FilterChain 中注册所有 javax.servlet.Filter 实例。您可以通过添加 FilterRegistrationBean（来自 Spring Boot）来禁用此注册来影响这一点。