最近在写后台过程中，需要用到springsecurity安全框架来完成登录及权限认证，因为是前后端分离所以需要捕捉异常，如未登录、登录失败、登录超时、缺少权限等信息，所以自定义返回数据。
这些异常在springsecurity中统一由ExceptionTranslationFilter过滤器进行捕捉，所以我们就来分析一下此过滤器源码达到我们要求。

源码解析

1.我们首先看他的构造方法 在全参构造中 我们看到 分别导入
AuthenticationEntryPoint,accessDeniedHandler,authenticationTrustResolver 我们主要看前两者个，这两者是异常捕捉的重点。
AuthenticationEntryPoint：顾名思义身份验证入口，主要用来判断你的身份，凡是在身份认证过程中发生的错误
accessDeniedHandler：访问拒绝处理 就是你要访问某个资源，但是当你没有访问权限时，就会抛出异常，在此类中进行处理。
authenticationTrustResolver ：用以判断SecurityContextHolder中所存储信息 判断上下文中有无用户信息来抛出异常

private AccessDeniedHandler accessDeniedHandler;//AuthenticationEntryPoint 登录认证异常处理private AuthenticationEntryPoint authenticationEntryPoint;//用以判断SecurityContextHolder中所存储信息private AuthenticationTrustResolver authenticationTrustResolver;private ThrowableAnalyzer throwableAnalyzer;private RequestCache requestCache;private final MessageSourceAccessor messages;public ExceptionTranslationFilter(AuthenticationEntryPoint authenticationEntryPoint) {this(authenticationEntryPoint, new HttpSessionRequestCache());}public ExceptionTranslationFilter(AuthenticationEntryPoint authenticationEntryPoint, RequestCache requestCache) {this.accessDeniedHandler = new AccessDeniedHandlerImpl();this.authenticationTrustResolver = new AuthenticationTrustResolverImpl();this.throwableAnalyzer = new ExceptionTranslationFilter.DefaultThrowableAnalyzer();this.requestCache = new HttpSessionRequestCache();this.messages = SpringSecurityMessageSource.getAccessor();Assert.notNull(authenticationEntryPoint, "authenticationEntryPoint cannot be null");Assert.notNull(requestCache, "requestCache cannot be null");this.authenticationEntryPoint = authenticationEntryPoint;this.requestCache = requestCache;}

在过滤器中最主要是dofilter方法

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest)req;HttpServletResponse response = (HttpServletResponse)res;try {//捕捉过滤器链中的异常chain.doFilter(request, response);this.logger.debug("Chain processed normally");} catch (IOException var9) {throw var9;} catch (Exception var10) {//Throwable是exception的父类  获取异常Throwable[] causeChain = this.throwableAnalyzer.determineCauseChain(var10);//判断异常的类型 是否为AuthenticationException RuntimeException ase = (AuthenticationException)this.throwableAnalyzer.getFirstThrowableOfType(AuthenticationException.class, causeChain);//如果不是AuthenticationException异常 再去判断是否为AccessDeniedExceptionif (ase == null) {ase = (AccessDeniedException)this.throwableAnalyzer.getFirstThrowableOfType(AccessDeniedException.class, causeChain);}//如果两者都不是 判断是否为其他类型异常 并将其抛出 因为此过滤器只处理AuthenticationException和AccessDeniedException异常if (ase == null) {if (var10 instanceof ServletException) {throw (ServletException)var10;}if (var10 instanceof RuntimeException) {throw (RuntimeException)var10;}throw new RuntimeException(var10);}if (response.isCommitted()) {throw new ServletException("Unable to handle the Spring Security Exception because the response is already committed.", var10);}//最后去处理这两种异常this.handleSpringSecurityException(request, response, chain, (RuntimeException)ase);}}

在dofilter中调用handleSpringSecurityException方法 去处理异常

我们可以看到 此方法中对 这两种异常采用两种方式处理

如果抛出的异常是AuthenticationException，则执行方法sendStartAuthentication
如果抛出的异常是AccessDeniedException，且从SecurityContextHolder.getContext().getAuthentication()得到的是AnonymousAuthenticationToken和RememberMeAuthenticationToken，那么执行sendStartAuthentication
如果上面的第二点不满足，则执行accessDeniedHandler的handle方法

private void handleSpringSecurityException(HttpServletRequest request, HttpServletResponse response, FilterChain chain, RuntimeException exception) throws IOException, ServletException {
//异常属于AuthenticationExceptionif (exception instanceof AuthenticationException) {this.logger.debug("Authentication exception occurred; redirecting to authentication entry point", exception);this.sendStartAuthentication(request, response, chain, (AuthenticationException)exception);} else if (exception instanceof AccessDeniedException) {//异常属于AccessDeniedExceptionAuthentication authentication = SecurityContextHolder.getContext().getAuthentication();//判断authentication 是不是AnonymousAuthenticationToken和RememberMeAuthenticationToken类型if (!this.authenticationTrustResolver.isAnonymous(authentication) && !this.authenticationTrustResolver.isRememberMe(authentication)) {//如果不是 执行accessDeniedHandler.handle 是权限的问题this.logger.debug("Access is denied (user is not anonymous); delegating to AccessDeniedHandler", exception);//可以通过继承accessDeniedHandler 来实现handle方法 达到返回权限不足信息this.accessDeniedHandler.handle(request, response, (AccessDeniedException)exception);} else {//如果是则执行sendStartAuthentication 是登录认证的问题this.logger.debug("Access is denied (user is " + (this.authenticationTrustResolver.isAnonymous(authentication) ? "anonymous" : "not fully authenticated") + "); redirecting to authentication entry point", exception);this.sendStartAuthentication(request, response, chain, new InsufficientAuthenticationException(this.messages.getMessage("ExceptionTranslationFilter.insufficientAuthentication", "Full authentication is required to access this resource")));}}}

sendStartAuthentication方法 登录认证问题的解决

  protected void sendStartAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, AuthenticationException reason) throws ServletException, IOException {SecurityContextHolder.getContext().setAuthentication((Authentication)null);this.requestCache.saveRequest(request, response);this.logger.debug("Calling Authentication entry point.");//调用authenticationEntryPoint子类的commence方法  我们自定义authenticationEntryPoint的子类this.authenticationEntryPoint.commence(request, response, reason);}

我们自定义authenticationEntryPoint

public class MyAuthenticationEntryPoint implements AuthenticationEntryPoint {@Overridepublic void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException {//返回json形式的错误信息httpServletResponse.setCharacterEncoding("UTF-8");httpServletResponse.setContentType("application/json");Object principal = null;SecurityContext context = SecurityContextHolder.getContext();//获取认证信息Authentication authentication = context.getAuthentication();if (authentication == null) {httpServletResponse.getWriter().println("{\"state\":201,\"msg\":\"未登录\"}");} else {//Principal: 重要的 --- UserDetails(用户详情)principal = authentication.getPrincipal();if ("anonymousUser".equals(principal.toString())) {if (httpServletRequest.getCookies() != null) {httpServletResponse.getWriter().println("{\"state\":202,\"msg\":\"登录超时\"}");}httpServletResponse.getWriter().println("{\"state\":201,\"msg\":\"未登录\"}");}}httpServletResponse.getWriter().flush();}}

我们自定义AccessDeniedHandler 返回

用来返回权限不足的信息

public class MyAccessDeineHandler implements AccessDeniedHandler {@Overridepublic void handle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AccessDeniedException e) throws IOException, ServletException {httpServletResponse.setCharacterEncoding("utf-8");httpServletResponse.setContentType("text/javascript;charset=utf-8");httpServletResponse.getWriter().print("{\"state\":203,\"msg\":\"没有权限访问\"}");}
}