在上一篇博客Spring Security原理学习--用户名和密码认证(三)中我们已经了解到Spring Security关于用户名和密码在UsernamePasswordAuthenticationFilter中的认证处理逻辑，接下来我们看看权限的校验处理。

      Spring Security权限角色的校验处理是在FilterSecurityInterceptor过滤器中进行处理的，在invoke方法中，调用父类的beforeInvocation方法对请求进行权限角色校验。

public void doFilter(ServletRequest request, ServletResponse response,
      FilterChain chain) throws IOException, ServletException {
    FilterInvocation fi = new FilterInvocation(request, response, chain);
    invoke(fi);
  }

在invoke方法中会调用父类AbstractSecurityInterceptor的beforeInvocation对Authentication对象进行身份校验。

public void invoke(FilterInvocation fi) throws IOException, ServletException {
    if ((fi.getRequest() != null)
        && (fi.getRequest().getAttribute(FILTER_APPLIED) != null)
        && observeOncePerRequest) {
      // filter already applied to this request and user wants us to observe
      // once-per-request handling, so don't re-do security checking
      fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
    }
    else {
      // first time this request being called, so perform security checking
      if (fi.getRequest() != null) {
        fi.getRequest().setAttribute(FILTER_APPLIED, Boolean.TRUE);
      }
      //调用父类的beforeInvocation进行身份校验
      InterceptorStatusToken token = super.beforeInvocation(fi);

      try {
        fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
      }
      finally {
        super.finallyInvocation(token);
      }

      super.afterInvocation(token, null);
    }
  }

在beforeInvocation中叫调用接口AccessDecisionManager的实现类，校验角色。

protected InterceptorStatusToken beforeInvocation(Object object) {
    
    //省略部分代码
    
    //获取当前线程的Authentication对象
    Authentication authenticated = authenticateIfRequired();

    // Attempt authorization
    try {
      //权限角色校验
      this.accessDecisionManager.decide(authenticated, object, attributes);
    }
    //校验失败抛出异常
    catch (AccessDeniedException accessDeniedException) {
      publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated,
          accessDeniedException));

      throw accessDeniedException;
    }

    //省略部分代码
  }

最终调用子类AffirmativeBased的decide方法，在decide方法中会获取AccessDecisionVoter对权限进行投票处理，获取投票结果，当投票结果是1时则表示有权限，否则等于-1表示没有权限，拒绝。

public void decide(Authentication authentication, Object object,
      Collection<ConfigAttribute> configAttributes) throws AccessDeniedException {
    int deny = 0;

    for (AccessDecisionVoter voter : getDecisionVoters()) {
            //投票获取结果
      int result = voter.vote(authentication, object, configAttributes);

      if (logger.isDebugEnabled()) {
        logger.debug("Voter: " + voter + ", returned: " + result);
      }
            //当有权限时直接返回
      switch (result) {
      case AccessDecisionVoter.ACCESS_GRANTED:
        return;
            //否则拒绝
      case AccessDecisionVoter.ACCESS_DENIED:
        deny++;

        break;

      default:
        break;
      }
    }
        //
    if (deny > 0) {
      throw new AccessDeniedException(messages.getMessage(
          "AbstractAccessDecisionManager.accessDenied", "Access is denied"));
    }

    // To get this far, every AccessDecisionVoter abstained
    checkAllowIfAllAbstainDecisions();
  }

在实现类WebExpressionVoter会根据authentication结果进行校验判断，根据Authentication对象创建接口SecurityExpressionOperations的实现类SecurityExpressionRoot

（1）当请求url被配置为permitAll，则直接返回true，校验通过

（2）其他需要登录请求url会调用isAuthenticated方法，最终调用AuthenticationTrustResolver的AuthenticationTrustResolverImpl的方法进行判断

public abstract class SecurityExpressionRoot implements SecurityExpressionOperations {
  protected final Authentication authentication;
  private AuthenticationTrustResolver trustResolver;
  private RoleHierarchy roleHierarchy;
  private Set<String> roles;
  private String defaultRolePrefix = "ROLE_";

  /** Allows "permitAll" expression */
  public final boolean permitAll = true;

  /** Allows "denyAll" expression */
  public final boolean denyAll = false;
  private PermissionEvaluator permissionEvaluator;
  public final String read = "read";
  public final String write = "write";
  public final String create = "create";
  public final String delete = "delete";
  public final String admin = "administration";

  /**
   * Creates a new instance
   * @param authentication the {@link Authentication} to use. Cannot be null.
   */
  public SecurityExpressionRoot(Authentication authentication) {
    if (authentication == null) {
      throw new IllegalArgumentException("Authentication object cannot be null");
    }
    this.authentication = authentication;
  }

  public final boolean hasAuthority(String authority) {
    return hasAnyAuthority(authority);
  }

  public final boolean hasAnyAuthority(String... authorities) {
    return hasAnyAuthorityName(null, authorities);
  }

  public final boolean hasRole(String role) {
    return hasAnyRole(role);
  }

  public final boolean hasAnyRole(String... roles) {
    return hasAnyAuthorityName(defaultRolePrefix, roles);
  }

  private boolean hasAnyAuthorityName(String prefix, String... roles) {
    Set<String> roleSet = getAuthoritySet();

    for (String role : roles) {
      String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
      if (roleSet.contains(defaultedRole)) {
        return true;
      }
    }

    return false;
  }

  public final Authentication getAuthentication() {
    return authentication;
  }

  public final boolean permitAll() {
    return true;
  }

  public final boolean denyAll() {
    return false;
  }

  public final boolean isAnonymous() {
    return trustResolver.isAnonymous(authentication);
  }

  public final boolean isAuthenticated() {
    return !isAnonymous();
  }

  public final boolean isRememberMe() {
    return trustResolver.isRememberMe(authentication);
  }

  public final boolean isFullyAuthenticated() {
    return !trustResolver.isAnonymous(authentication)
        && !trustResolver.isRememberMe(authentication);
  }

  /**
   * Convenience method to access {@link Authentication#getPrincipal()} from
   * {@link #getAuthentication()}
   * @return
   */
  public Object getPrincipal() {
    return authentication.getPrincipal();
  }

  public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
    this.trustResolver = trustResolver;
  }

  public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
    this.roleHierarchy = roleHierarchy;
  }

  /**
   * <p>
   * Sets the default prefix to be added to {@link #hasAnyRole(String...)} or
   * {@link #hasRole(String)}. For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN")
   * is passed in, then the role ROLE_ADMIN will be used when the defaultRolePrefix is
   * "ROLE_" (default).
   * </p>
   *
   * <p>
   * If null or empty, then no default role prefix is used.
   * </p>
   *
   * @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
   */
  public void setDefaultRolePrefix(String defaultRolePrefix) {
    this.defaultRolePrefix = defaultRolePrefix;
  }

  private Set<String> getAuthoritySet() {
    if (roles == null) {
      roles = new HashSet<String>();
      Collection<? extends GrantedAuthority> userAuthorities = authentication
          .getAuthorities();

      if (roleHierarchy != null) {
        userAuthorities = roleHierarchy
            .getReachableGrantedAuthorities(userAuthorities);
      }

      roles = AuthorityUtils.authorityListToSet(userAuthorities);
    }

    return roles;
  }

  public boolean hasPermission(Object target, Object permission) {
    return permissionEvaluator.hasPermission(authentication, target, permission);
  }

  public boolean hasPermission(Object targetId, String targetType, Object permission) {
    return permissionEvaluator.hasPermission(authentication, (Serializable) targetId,
        targetType, permission);
  }

  public void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
    this.permissionEvaluator = permissionEvaluator;
  }

  /**
   * Prefixes role with defaultRolePrefix if defaultRolePrefix is non-null and if role
   * does not already start with defaultRolePrefix.
   *
   * @param defaultRolePrefix
   * @param role
   * @return
   */
  private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
    if (role == null) {
      return role;
    }
    if (defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
      return role;
    }
    if (role.startsWith(defaultRolePrefix)) {
      return role;
    }
    return defaultRolePrefix + role;
  }
}

在AuthenticationTrustResolverImpl方法isAnonymous中就是判断传递过来的Authentication对象是不是AnonymousAuthenticationToken，如果是AnonymousAuthenticationToken则表示没有登录，因为登录之后生成的对象是UsernamePasswordAuthenticationToken或其他Authentication对象，这也是Spring Security设计的最精华也是最难以理解也是最简单的方式。

private Class<? extends Authentication> anonymousClass = AnonymousAuthenticationToken.class;

  public boolean isAnonymous(Authentication authentication) {
    if ((anonymousClass == null) || (authentication == null)) {
      return false;
    }

    return anonymousClass.isAssignableFrom(authentication.getClass());
  }

总结：Spring Security对url的权限判断有两种方式，一种是请求是permitAll的则直接返回校验通过，另外一个是判断Authentication是不是AnonymousAuthenticationToken，因为正常登录等产生的不是这个对象，如果不是这个类型的对象则表示登录成功了。