Spring Security：REST API 需要哪个过滤器答案

【问题标题】：Spring Security: which filter is necessary for a REST APISpring Security：REST API 需要哪个过滤器
【发布时间】：2015-07-25 15:09:43
【问题描述】：

我只需要在我的项目中使用 Spring Security Basic HTML Authentication Filter 来保护 REST API。

由于我是 Spring Security 的新手，我想知道其余过滤器链不需要哪个过滤器。我做了一些研究，说securityContextPersistenceFilter 是在任何身份验证过滤器前面设置的必要条件，那么其他的呢？

securityContextPersistenceFilter //It should be needed..
logoutFilter, // I'm not so sure about this..
authenticationProcessingFilter, // I guess it should not be necessary, because user will just use header to hold the credential
concurrentSessionFilter, // I guess no
basicAuthenticationFilter, // Should be needed
securityContextHolderAwareRequestFilter, //It's required because the need to judge the ROLE of the user
rememberMeAuthenticationFilter, // I guess no
anonymousAuthenticationFilter, // I'm not so sure
exceptionTranslationFilter, // Should be needed
filterInvocationInterceptor // I'm not so sure

我对列表中的所有内容都正确吗？

【问题讨论】：

标签： spring grails spring-security

【解决方案1】：

我认为你只需要：

securityContextPersistenceFilter // It should be needed..
basicAuthenticationFilter, // Should be needed
securityContextHolderAwareRequestFilter, // for internal stuff also
anonymousAuthenticationFilter, // for default/non-logged in user
exceptionTranslationFilter, // catches security exceptions
filterInvocationInterceptor // defines which url are accessible, etc

也有很好的描述：http://docs.spring.io/spring-security/site/docs/3.0.x/reference/security-filter-chain.html#d0e2952

【讨论】：