Spring Security Oauth2 Token 提取流程源码分析

问题

Spring Security Oauth2 请求 提取 Token 方式

  • 请求头携带token
  • url参数携带token
  • 请求form表单

源码

spring-security-Oauth2 版本: 2.3.4.RELEASE

配置

  • 访问受保护的资源需要携带token访问，所以资源服务器都会写一个相应的安全配置类
  • 配置适配器类都是继承 ResourceServerConfigurerAdapter，配合使用@EnableResourceServer启用相应资源服务器配置，内部关联了ResourceServerSecurityConfigurer和HttpSecurity

资源安全配置

@Override
    public void configure(ResourceServerSecurityConfigurer resources) {
       // 配置代码 省略
    }

Http安全相关

配置权限地址拦截这些都是使用这个方法参数进行相应的配置)，相应代码如下:

@Override
    public void configure(HttpSecurity http) throws Exception {
        // 配置代码 省略
    }

关键代码分析

ResourceServerSecurityConfigurer 源码分析

  • ResourceServerSecurityConfigurer是一个配置器，
    关键地方是看他挂载了那些过滤器
  • 方法签名为org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer.configure注册了OAuth2AuthenticationProcessingFilter正是核心的关键，注册在AbstractPreAuthenticatedProcessingFilter之前，详细代码和部分注释如下：
@Override
	public void configure(HttpSecurity http) throws Exception {
		AuthenticationManager oauthAuthenticationManager = oauthAuthenticationManager(http);
		// 初始化过滤器
		resourcesServerFilter = new OAuth2AuthenticationProcessingFilter();
		resourcesServerFilter.setAuthenticationEntryPoint(authenticationEntryPoint);
		resourcesServerFilter.setAuthenticationManager(oauthAuthenticationManager);
		if (eventPublisher != null) {
			resourcesServerFilter.setAuthenticationEventPublisher(eventPublisher);
		}
		// 配置 token 提取实现类
		if (tokenExtractor != null) {
			resourcesServerFilter.setTokenExtractor(tokenExtractor);
		}
		if (authenticationDetailsSource != null) {
			resourcesServerFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
		}
		resourcesServerFilter = postProcess(resourcesServerFilter);
		// 设置无状态
		resourcesServerFilter.setStateless(stateless);

		http
			.authorizeRequests().expressionHandler(expressionHandler)
		.and()
                // 在AbstractPreAuthenticatedProcessingFilter之前插入resourcesServerFilter过滤器
			.addFilterBefore(resourcesServerFilter, AbstractPreAuthenticatedProcessingFilter.class)
			.exceptionHandling()
                    // 配置访问拒绝处理器
				.accessDeniedHandler(accessDeniedHandler)
				.authenticationEntryPoint(authenticationEntryPoint);
	}

OAuth2AuthenticationProcessingFilter 源码分析

  • OAuth2AuthenticationProcessingFilter是一个普通实现javax.servlet.Filter和org.springframework.beans.factory.InitializingBean接口的Bean;
  • 既然是过滤器，核心方法当然是org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter.doFilter 详细代码如下：
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
			ServletException {
                // 获取日志是否开启 debug 模式
		final boolean debug = logger.isDebugEnabled();
		final HttpServletRequest request = (HttpServletRequest) req;
		final HttpServletResponse response = (HttpServletResponse) res;
		try {
		        // 关键代码，提取token返回认证信息
			Authentication authentication = tokenExtractor.extract(request);
                        // 省略代码...
		}
		catch (OAuth2Exception failed) {

		         // 省略代码...
			return;
		}
		chain.doFilter(request, response);
	}
  • 追溯源码org/springframework/security/oauth/spring-security-oauth2/2.3.4.RELEASE/spring-security-oauth2-2.3.4.RELEASE-sources.jar!/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationProcessingFilter.java:64
  • 发现TokenExtractor接口实现类是org.springframework.security.oauth2.provider.authentication.BearerTokenExtractor
  • BearerTokenExtractor详细源码里面先后调用了几个方法，从extract->extractToken方法，extractToken方法是关键代码,详细代码如下:
protected String extractToken(HttpServletRequest request) {
        // 提取请求头参数
        String token = this.extractHeaderToken(request);
        if (token == null) {
            logger.debug("Token not found in headers. Trying request parameters.");
            // 直接获取请求参数
            token = request.getParameter("access_token");
            if (token == null) {
                logger.debug("Token not found in request parameters.  Not an OAuth2 request.");
            } else {
                // 如果两种方式都获取不到，直接设置一个认证请求头，不带 token
                request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_TYPE, "Bearer");
            }
        }

        return token;
    }

    protected String extractHeaderToken(HttpServletRequest request) {
        // 获取请求头为 Authorization 的信息 
        Enumeration headers = request.getHeaders("Authorization");

        String value;
        do {
            if (!headers.hasMoreElements()) {
                return null;
            }

            value = (String)headers.nextElement();
        } while(!value.toLowerCase().startsWith("Bearer".toLowerCase()));
        // 如果存在,提取Bear后部分实际token值
        String authHeaderValue = value.substring("Bearer".length()).trim();
        // 重新设置 request 属性
        request.setAttribute(OAuth2AuthenticationDetails.ACCESS_TOKEN_TYPE, value.substring(0, "Bearer".length()).trim());
        int commaIndex = authHeaderValue.indexOf(44);
        if (commaIndex > 0) {
            authHeaderValue = authHeaderValue.substring(0, commaIndex);
        }

        return authHeaderValue;
    }

从上面代码分析得到：
extractToken方法是提取token，返回相应的认证信息
extractHeaderToken是从请求头获取相应 token，extractHeaderToken无法从请求头相应参数获取 token 时候，request.getParameter("access_token");这段代码会获取请求参数。

结论

整个流程下来，是通过OAuth2AuthenticationProcessingFilter提取请求头参数，获取不到再去获取请求参数。