Spring Security深度解析：构建企业级安全框架

Spring Security深度解析：构建企业级安全框架

本文将深入探讨Spring Security安全框架的核心原理、架构设计和实际应用，帮助开发者全面掌握企业级应用安全防护技术。

目录

Spring Security概述
核心架构与原理
认证机制详解
授权机制详解
核心组件分析
配置与集成
高级特性应用
安全漏洞防护
性能优化与最佳实践
总结

Spring Security概述

什么是Spring Security？

Spring Security是一个功能强大且高度可定制的身份验证和访问控制框架。它是保护Spring应用程序的事实标准，提供了全面的安全解决方案，包括认证、授权、攻击防护等功能。

核心特性

// 基本安全配置示例
@Configuration
@EnableWebSecurity
public class SecurityConfig {
            
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/logout")
                .logoutSuccessUrl("/")
                .permitAll()
            );
        
        return http.build();
    }
}

发展历程

Spring Security 1.x：基于Acegi Security，XML配置为主
Spring Security 2.x：引入命名空间配置
Spring Security 3.x：注解支持，表达式语言
Spring Security 4.x：Java配置优化
Spring Security 5.x：OAuth2、WebFlux支持
Spring Security 6.x：Lambda配置，移除WebSecurityConfigurerAdapter

核心架构与原理

1. 安全架构总览

/**
 * Spring Security核心架构组件
 */
public class SecurityArchitecture {
            
    
    // 1. SecurityContext - 安全上下文
    SecurityContext context = SecurityContextHolder.getContext();
    Authentication authentication = context.getAuthentication();
    
    // 2. AuthenticationManager - 认证管理器
    @Autowired
    private AuthenticationManager authenticationManager;
    
    // 3. AccessDecisionManager - 访问决策管理器
    @Autowired
    private AccessDecisionManager accessDecisionManager;
    
    // 4. SecurityFilterChain - 安全过滤器链
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        return http
            .addFilterBefore(customFilter(), UsernamePasswordAuthenticationFilter.class)
            .build();
    }
}

2. 过滤器链机制

@Component
public class SecurityFilterChainAnalyzer {
            
    
    /**
     * Spring Security默认过滤器链顺序
     */
    public void analyzeFilterChain() {
            
        List<String> filterOrder = Arrays.asList(
            "SecurityContextPersistenceFilter",     // 安全上下文持久化
            "LogoutFilter",                         // 登出处理
            "UsernamePasswordAuthenticationFilter", // 用户名密码认证
            "DefaultLoginPageGeneratingFilter",     // 默认登录页生成
            "BasicAuthenticationFilter",            // Basic认证
            "RequestCacheAwareFilter",             // 请求缓存
            "SecurityContextHolderAwareRequestFilter", // 安全上下文请求包装
            "AnonymousAuthenticationFilter",        // 匿名认证
            "SessionManagementFilter",             // 会话管理
            "ExceptionTranslationFilter",          // 异常转换
            "FilterSecurityInterceptor"            // 权限校验
        );
        
        filterOrder.forEach(filter -> 
            System.out.println("Filter: " + filter));
    }
}

3. 自定义过滤器

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
            
    
    @Autowired
    private JwtTokenProvider tokenProvider;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                  HttpServletResponse response, 
                                  FilterChain filterChain) throws ServletException, IOException {
            
        
        String token = extractToken(request);
        
        if (token != null && tokenProvider.validateToken(token)) {
            
            // 1. 验证Token
            String username = tokenProvider.getUsernameFromToken(token);
            
            // 2. 创建认证对象
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            UsernamePasswordAuthenticationToken authentication = 
                new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
            
            // 3. 设置认证信息到安全上下文
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
        
        filterChain.doFilter(request, response);
    }
    
    private String extractToken(HttpServletRequest request) {
            
        String bearerToken = request.getHeader("Authorization");
        if (StringUtils.hasText(bearerToken) && bearerToken.startsWith("Bearer ")) {
            
            return bearerToken.substring(7);
        }
        return null;
    }
}

认证机制详解

1. 内存认证

@Configuration
public class InMemoryAuthConfig {
            
    
    @Bean
    public UserDetailsService userDetailsService() {
            
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder().encode("admin123"))
            .roles("ADMIN", "USER")
            .build();
            
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder().encode("user123"))
            .roles("USER")
            .build();
            
        return new InMemoryUserDetailsManager(admin, user);
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
            
        return new BCryptPasswordEncoder();
    }
}

2. 数据库认证

@Service
public class CustomUserDetailsService implements UserDetailsService {
            
    
    @Autowired
    private UserRepository userRepository;
    
    @Override
    @Transactional(readOnly = true)
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));
        
        return UserPrincipal.create(user);
    }
}

@Entity
@Table(name = "users")
public class User {
            
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(unique = true)
    private String username;
    
    private String password;
    
    private String email;
    
    private Boolean enabled = true;
    
    private Boolean accountNonExpired = true;
    
    private Boolean accountNonLocked = true;
    
    private Boolean credentialsNonExpired = true;
    
    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
    
    // getters and setters
}

public class UserPrincipal implements UserDetails {
            
    private Long id;
    private String username;
    private String password;
    private String email;
    private Collection<? extends GrantedAuthority> authorities;
    
    public static UserPrincipal create(User user) {
            
        List<GrantedAuthority> authorities = user.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority("ROLE_" + role.getName()))
            .collect(Collectors.toList());
            
        return new UserPrincipal(
            user.getId(),
            user.getUsername(),
            user.getPassword(),
            user.getEmail(),
            authorities
        );
    }
    
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
            
        return authorities;
    }
    
    @Override
    public boolean isAccountNonExpired() {
            
        return true;
    }
    
    @Override
    public boolean isAccountNonLocked() {
            
        return true;
    }
    
    @Override
    public boolean isCredentialsNonExpired() {
            
        return true;
    }
    
    @Override
    public boolean isEnabled() {
            
        return true;
    }
    
    // 其他方法实现...
}

3. JWT认证实现

@Component
public class JwtTokenProvider {
            
    
    private static final String JWT_SECRET = "mySecretKey";
    private static final int JWT_EXPIRATION = 604800000; // 7天
    
    public String generateToken(Authentication authentication) {
            
        UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();
        Date expiryDate = new Date(System.currentTimeMillis() + JWT_EXPIRATION);
        
        return Jwts.builder()
                .setSubject(userPrincipal.getUsername())
                .setIssuedAt(new Date())
                .setExpiration(expiryDate)
                .signWith(SignatureAlgorithm.HS512, JWT_SECRET)
                .compact();
    }
    
    public String getUsernameFromToken(String token) {
            
        Claims claims = Jwts.parser()
                .setSigningKey(JWT_SECRET)
                .parseClaimsJws(token)
                .getBody();
        return claims.getSubject();
    }
    
    public boolean validateToken(String token) {
            
        try {
            
            Jwts.parser().setSigningKey(JWT_SECRET).parseClaimsJws(token);
            return true;
        } catch (JwtException | IllegalArgumentException e) {
            
            return false;
        }
    }
}

@RestController
@RequestMapping("/api/auth")
public class AuthController {
            
    
    @Autowired
    private AuthenticationManager authenticationManager;
    
    @Autowired
    private JwtTokenProvider tokenProvider;
    
    @PostMapping("/login")
    public ResponseEntity<?> authenticateUser(@RequestBody LoginRequest loginRequest) {
            
        Authentication authentication = authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(
                loginRequest.getUsername(),
                loginRequest.getPassword()
            )
        );
        
        String jwt = tokenProvider.generateToken(authentication);
        return ResponseEntity.ok(new JwtAuthenticationResponse(jwt));
    }
}

授权机制详解

1. 基于角色的访问控制(RBAC)

@Configuration
public class RoleBasedAuthorizationConfig {
            
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        http.authorizeHttpRequests(authz -> authz
            // 公开资源
            .requestMatchers("/", "/home", "/about").permitAll()
            
            // 基于角色的授权
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
            .requestMatchers("/manager/**").hasRole("MANAGER")
            
            // 基于权限的授权
            .requestMatchers("/api/users/create").hasAuthority("USER_CREATE")
            .requestMatchers("/api/users/delete").hasAuthority("USER_DELETE")
            
            // 复合条件授权
            .requestMatchers("/api/reports/**").hasRole("MANAGER")
                .and().hasAuthority("REPORT_VIEW")
            
            // 其他请求需要认证
            .anyRequest().authenticated()
        );
        
        return http.build();
    }
}

2. 方法级别安全

@Configuration
@EnableGlobalMethodSecurity(
    prePostEnabled = true,      // 启用@PreAuthorize和@PostAuthorize
    securedEnabled = true,      // 启用@Secured
    jsr250Enabled = true        // 启用@RolesAllowed
)
public class MethodSecurityConfig {
            
    
    @Bean
    public MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
            
        DefaultMethodSecurityExpressionHandler expressionHandler = 
            new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(new CustomPermissionEvaluator());
        return expressionHandler;
    }
}

@Service
public class UserService {
            
    
    // 基于角色的方法授权
    @Secured("ROLE_ADMIN")
    public void deleteUser(Long userId) {
            
        // 删除用户逻辑
    }
    
    // 基于表达式的授权
    @PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
    public User updateUser(Long userId, User user) {
            
        // 更新用户逻辑
        return userRepository.save(user);
    }
    
    // 基于返回值的授权
    @PostAuthorize("returnObject.username == authentication.principal.username or hasRole('ADMIN')")
    public User getUserById(Long userId) {
            
        return userRepository.findById(userId).orElse(null);
    }
    
    // 过滤集合结果
    @PostFilter("filterObject.isPublic or filterObject.owner == authentication.principal.username")
    public List<Document> getDocuments() {
            
        return documentRepository.findAll();
    }
    
    // 过滤方法参数
    @PreFilter("filterObject.owner == authentication.principal.username")
    public void updateDocuments(List<Document> documents) {
            
        documents.forEach(doc -> documentRepository.save(doc));
    }
}

3. 自定义权限评估器

@Component
public class CustomPermissionEvaluator implements PermissionEvaluator {
            
    
    @Autowired
    private PermissionService permissionService;
    
    @Override
    public boolean hasPermission(Authentication authentication, 
                               Object targetDomainObject, 
                               Object permission) {
            
        if (authentication == null || targetDomainObject == null || permission == null) {
            
            return false;
        }
        
        String username = authentication.getName();
        String targetType = targetDomainObject.getClass().getSimpleName();
        String permissionName = permission.toString();
        
        return permissionService.hasPermission(username, targetType, permissionName);
    }
    
    @Override
    public boolean hasPermission(Authentication authentication, 
                               Serializable targetId, 
                               String targetType, 
                               Object permission) {
            
        if (authentication == null || targetType == null || permission == null) {
            
            return false;
        }
        
        String username = authentication.getName();
        String permissionName = permission.toString();
        
        return permissionService.hasPermission(username, targetType, targetId, permissionName);
    }
}

// 使用自定义权限评估器
@RestController
public class DocumentController {
            
    
    @PreAuthorize("hasPermission(#document, 'READ')")
    @GetMapping("/documents/{id}")
    public Document getDocument(@PathVariable Long id) {
            
        return documentService.findById(id);
    }
    
    @PreAuthorize("hasPermission(#id, 'Document', 'WRITE')")
    @PutMapping("/documents/{id}")
    public Document updateDocument(@PathVariable Long id, @RequestBody Document document) {
            
        return documentService.update(id, document);
    }
}

核心组件分析

1. 认证管理器

@Configuration
public class AuthenticationManagerConfig {
            
    
    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration authConfig) throws Exception {
            
        return authConfig.getAuthenticationManager();
    }
    
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
            
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService());
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }
    
    // 自定义认证提供者
    @Component
    public class CustomAuthenticationProvider implements AuthenticationProvider {
            
        
        @Autowired
        private UserDetailsService userDetailsService;
        
        @Autowired
        private PasswordEncoder passwordEncoder;
        
        @Override
        public Authentication authenticate(Authentication authentication) 
                throws AuthenticationException {
            
            
            String username = authentication.getName();
            String password = authentication.getCredentials().toString();
            
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            
            if (passwordEncoder.matches(password, userDetails.getPassword())) {
            
                return new UsernamePasswordAuthenticationToken(
                    userDetails, password, userDetails.getAuthorities());
            } else {
            
                throw new BadCredentialsException("认证失败");
            }
        }
        
        @Override
        public boolean supports(Class<?> authentication) {
            
            return authentication.equals(UsernamePasswordAuthenticationToken.class);
        }
    }
}

2. 会话管理

@Configuration
public class SessionManagementConfig {
            
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        http.sessionManagement(session -> session
            // 会话创建策略
            .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            
            // 最大并发会话数
            .maximumSessions(1)
            .maxSessionsPreventsLogin(false) // 新登录踢掉旧会话
            .sessionRegistry(sessionRegistry())
            
            // 会话固定攻击防护
            .and()
            .sessionFixation().migrateSession()
            
            // 无效会话URL
            .invalidSessionUrl("/login?expired")
        );
        
        return http.build();
    }
    
    @Bean
    public SessionRegistry sessionRegistry() {
            
        return new SessionRegistryImpl();
    }
    
    @Bean
    public HttpSessionEventPublisher httpSessionEventPublisher() {
            
        return new HttpSessionEventPublisher();
    }
}

@Component
public class SessionManagementService {
            
    
    @Autowired
    private SessionRegistry sessionRegistry;
    
    public void expireUserSessions(String username) {
            
        List<SessionInformation> sessions = sessionRegistry.getAllSessions(username, false);
        sessions.forEach(SessionInformation::expireNow);
    }
    
    public List<String> getActiveUsers() {
            
        return sessionRegistry.getAllPrincipals().stream()
            .map(Object::toString)
            .collect(Collectors.toList());
    }
}

3. 密码编码器

@Configuration
public class PasswordConfig {
            
    
    @Bean
    public PasswordEncoder passwordEncoder() {
            
        // 使用BCrypt编码器（推荐）
        return new BCryptPasswordEncoder(12); // 强度级别
    }
    
    // 多种密码编码器支持
    @Bean
    public PasswordEncoder delegatingPasswordEncoder() {
            
        String encodingId = "bcrypt";
        Map<String, PasswordEncoder> encoders = new HashMap<>();
        encoders.put(encodingId, new BCryptPasswordEncoder());
        encoders.put("noop", NoOpPasswordEncoder.getInstance());
        encoders.put("pbkdf2", new Pbkdf2PasswordEncoder());
        encoders.put("scrypt", new SCryptPasswordEncoder());
        encoders.put("argon2", new Argon2PasswordEncoder());
        
        DelegatingPasswordEncoder passwordEncoder = 
            new DelegatingPasswordEncoder(encodingId, encoders);
        passwordEncoder.setDefaultPasswordEncoderForMatches(new BCryptPasswordEncoder());
        
        return passwordEncoder;
    }
}

@Service
public class PasswordService {
            
    
    @Autowired
    private PasswordEncoder passwordEncoder;
    
    public String encodePassword(String rawPassword) {
            
        return passwordEncoder.encode(rawPassword);
    }
    
    public boolean matches(String rawPassword, String encodedPassword) {
            
        return passwordEncoder.matches(rawPassword, encodedPassword);
    }
    
    public boolean upgradeEncoding(String encodedPassword) {
            
        return passwordEncoder.upgradeEncoding(encodedPassword);
    }
}

配置与集成

1. OAuth2集成

@Configuration
@EnableOAuth2Client
public class OAuth2Config {
            
    
    @Bean
    public SecurityFilterChain oauth2FilterChain(HttpSecurity http) throws Exception {
            
        http
            .oauth2Login(oauth2 -> oauth2
                .loginPage("/oauth2/authorization/google")
                .userInfoEndpoint(userInfo -> userInfo
                    .userService(oauth2UserService())
                )
                .successHandler(oauth2AuthenticationSuccessHandler())
                .failureHandler(oauth2AuthenticationFailureHandler())
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .jwtAuthenticationConverter(jwtAuthenticationConverter())
                )
            );
        
        return http.build();
    }
    
    @Bean
    public OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
            
        return new CustomOAuth2UserService();
    }
}

@Service
public class CustomOAuth2UserService implements OAuth2UserService<OAuth2UserRequest, OAuth2User> {
            
    
    private final OAuth2UserService<OAuth2UserRequest, OAuth2User> delegate = 
        new DefaultOAuth2UserService();
    
    @Autowired
    private UserRepository userRepository;
    
    @Override
    public OAuth2User loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
            
        OAuth2User oauth2User = delegate.loadUser(userRequest);
        
        String registrationId = userRequest.getClientRegistration().getRegistrationId();
        String email = oauth2User.getAttribute("email");
        String name = oauth2User.getAttribute("name");
        
        User user = userRepository.findByEmail(email)
            .orElseGet(() -> createNewUser(email, name, registrationId));
        
        return UserPrincipal.create(user, oauth2User.getAttributes());
    }
    
    private User createNewUser(String email, String name, String provider) {
            
        User user = new User();
        user.setEmail(email);
        user.setName(name);
        user.setProvider(AuthProvider.valueOf(provider.toUpperCase()));
        user.setEnabled(true);
        
        return userRepository.save(user);
    }
}

2. CORS配置

@Configuration
public class CorsConfig {
            
    
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
            
        CorsConfiguration configuration = new CorsConfiguration();
        
        // 允许的源
        configuration.setAllowedOriginPatterns(Arrays.asList(
            "http://localhost:3000",
            "https://*.mydomain.com"
        ));
        
        // 允许的HTTP方法
        configuration.setAllowedMethods(Arrays.asList(
            "GET", "POST", "PUT", "DELETE", "OPTIONS"
        ));
        
        // 允许的头部
        configuration.setAllowedHeaders(Arrays.asList(
            "Authorization", "Content-Type", "X-Requested-With"
        ));
        
        // 允许凭证
        configuration.setAllowCredentials(true);
        
        // 预检请求缓存时间
        configuration.setMaxAge(3600L);
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        
        return source;
    }
}

3. 记住我功能

@Configuration
public class RememberMeConfig {
            
    
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Autowired
    private DataSource dataSource;
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        http.rememberMe(remember -> remember
            .key("mySecretKey")
            .tokenRepository(persistentTokenRepository())
            .userDetailsService(userDetailsService)
            .tokenValiditySeconds(86400) // 24小时
            .rememberMeParameter("remember-me")
            .rememberMeCookieName("remember-me")
        );
        
        return http.build();
    }
    
    @Bean
    public PersistentTokenRepository persistentTokenRepository() {
            
        JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
        tokenRepository.setDataSource(dataSource);
        // tokenRepository.setCreateTableOnStartup(true); // 首次运行时创建表
        return tokenRepository;
    }
}

高级特性应用

1. 动态权限控制

@Component
public class DynamicSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
            
    
    @Autowired
    private ResourceService resourceService;
    
    @Override
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
            
        FilterInvocation fi = (FilterInvocation) object;
        String url = fi.getRequestUrl();
        String method = fi.getRequest().getMethod();
        
        List<String> permissions = resourceService.getPermissionsByUrlAndMethod(url, method);
        
        if (permissions.isEmpty()) {
            
            return SecurityConfig.createList("ROLE_LOGIN");
        }
        
        return SecurityConfig.createList(permissions.toArray(new String[0]));
    }
    
    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
            
        return null;
    }
    
    @Override
    public boolean supports(Class<?> clazz) {
            
        return FilterInvocation.class.isAssignableFrom(clazz);
    }
}

@Component
public class DynamicAccessDecisionManager implements AccessDecisionManager {
            
    
    @Override
    public void decide(Authentication authentication, Object object, 
                      Collection<ConfigAttribute> configAttributes) 
                      throws AccessDeniedException, InsufficientAuthenticationException {
            
        
        if (configAttributes == null || configAttributes.isEmpty()) {
            
            return;
        }
        
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        
        for (ConfigAttribute attribute : configAttributes) {
            
            if (hasAuthority(authorities, attribute.getAttribute())) {
            
                return;
            }
        }
        
        throw new AccessDeniedException("访问被拒绝");
    }
    
    private boolean hasAuthority(Collection<? extends GrantedAuthority> authorities, String authority) {
            
        return authorities.stream()
            .anyMatch(auth -> auth.getAuthority().equals(authority));
    }
    
    @Override
    public boolean supports(ConfigAttribute attribute) {
            
        return true;
    }
    
    @Override
    public boolean supports(Class<?> clazz) {
            
        return true;
    }
}

2. 多租户安全

@Component
public class TenantSecurityContext {
            
    
    private static final ThreadLocal<String> TENANT_CONTEXT = new ThreadLocal<>();
    
    public static void setTenantId(String tenantId) {
            
        TENANT_CONTEXT.set(tenantId);
    }
    
    public static String getTenantId() {
            
        return TENANT_CONTEXT.get();
    }
    
    public static void clear() {
            
        TENANT_CONTEXT.remove();
    }
}

@Component
public class TenantFilter implements Filter {
            
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
            
        
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String tenantId = extractTenantId(httpRequest);
        
        try {
            
            TenantSecurityContext.setTenantId(tenantId);
            chain.doFilter(request, response);
        } finally {
            
            TenantSecurityContext.clear();
        }
    }
    
    private String extractTenantId(HttpServletRequest request) {
            
        // 从Header中提取
        String tenantId = request.getHeader("X-Tenant-ID");
        if (tenantId != null) {
            
            return tenantId;
        }
        
        // 从子域名中提取
        String serverName = request.getServerName();
        if (serverName.contains(".")) {
            
            return serverName.split("\.")[0];
        }
        
        return "default";
    }
}

@Service
public class TenantAwareUserDetailsService implements UserDetailsService {
            
    
    @Autowired
    private UserRepository userRepository;
    
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            
        String tenantId = TenantSecurityContext.getTenantId();
        
        User user = userRepository.findByUsernameAndTenantId(username, tenantId)
            .orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));
        
        return UserPrincipal.create(user);
    }
}

安全漏洞防护

1. CSRF防护

@Configuration
public class CsrfConfig {
            
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        http.csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .ignoringRequestMatchers("/api/public/**")
            .requireCsrfProtectionMatcher(new CsrfRequestMatcher())
        );
        
        return http.build();
    }
    
    private static class CsrfRequestMatcher implements RequestMatcher {
            
        @Override
        public boolean matches(HttpServletRequest request) {
            
            String method = request.getMethod();
            return !Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS").contains(method);
        }
    }
}

@RestController
public class CsrfController {
            
    
    @GetMapping("/api/csrf")
    public CsrfToken csrf(CsrfToken token) {
            
        return token;
    }
}

2. XSS防护

@Component
public class XssFilter implements Filter {
            
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
            
        
        XssHttpServletRequestWrapper wrappedRequest = 
            new XssHttpServletRequestWrapper((HttpServletRequest) request);
        
        chain.doFilter(wrappedRequest, response);
    }
}

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
            
    
    public XssHttpServletRequestWrapper(HttpServletRequest request) {
            
        super(request);
    }
    
    @Override
    public String getParameter(String parameter) {
            
        return cleanXSS(super.getParameter(parameter));
    }
    
    @Override
    public String[] getParameterValues(String parameter) {
            
        String[] values = super.getParameterValues(parameter);
        if (values == null) {
            
            return null;
        }
        
        String[] cleanValues = new String[values.length];
        for (int i = 0; i < values.length; i++) {
            
            cleanValues[i] = cleanXSS(values[i]);
        }
        return cleanValues;
    }
    
    private String cleanXSS(String value) {
            
        if (value == null) {
            
            return null;
        }
        
        // 移除脚本标签
        value = value.replaceAll("(?i)<script[^>]*>.*?</script>", "");
        value = value.replaceAll("(?i)<.*?javascript:.*?>.*?</.*?>", "");
        value = value.replaceAll("(?i)<.*?\s+on\w+\s*=.*?>.*?</.*?>", "");
        
        return value;
    }
}

3. SQL注入防护

@Repository
public class SecureUserRepository {
            
    
    @Autowired
    private JdbcTemplate jdbcTemplate;
    
    // ✅ 使用参数化查询（推荐）
    public List<User> findUsersByRole(String role) {
            
        String sql = "SELECT * FROM users WHERE role = ?";
        return jdbcTemplate.query(sql, new Object[]{
            role}, new UserRowMapper());
    }
    
    // ❌ 字符串拼接（易受SQL注入攻击）
    public List<User> findUsersByRoleUnsafe(String role) {
            
        String sql = "SELECT * FROM users WHERE role = '" + role + "'";
        return jdbcTemplate.query(sql, new UserRowMapper());
    }
    
    // ✅ 使用JPA命名参数
    @Query("SELECT u FROM User u WHERE u.email = :email AND u.status = :status")
    List<User> findByEmailAndStatus(@Param("email") String email, 
                                   @Param("status") String status);
    
    // ✅ 输入验证
    public User findUserById(String userId) {
            
        if (!isValidUserId(userId)) {
            
            throw new IllegalArgumentException("无效的用户ID格式");
        }
        
        String sql = "SELECT * FROM users WHERE id = ?";
        return jdbcTemplate.queryForObject(sql, new Object[]{
            userId}, new UserRowMapper());
    }
    
    private boolean isValidUserId(String userId) {
            
        return userId != null && userId.matches("\d+");
    }
}

性能优化与最佳实践

1. 缓存优化

@Configuration
@EnableCaching
public class SecurityCacheConfig {
            
    
    @Bean
    public CacheManager cacheManager() {
            
        CaffeineCacheManager cacheManager = new CaffeineCacheManager();
        cacheManager.setCaffeine(Caffeine.newBuilder()
            .maximumSize(1000)
            .expireAfterWrite(Duration.ofMinutes(30))
            .recordStats());
        return cacheManager;
    }
}

@Service
public class CachedUserDetailsService implements UserDetailsService {
            
    
    @Autowired
    private UserRepository userRepository;
    
    @Override
    @Cacheable(value = "userDetails", key = "#username")
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));
        
        return UserPrincipal.create(user);
    }
    
    @CacheEvict(value = "userDetails", key = "#username")
    public void evictUserCache(String username) {
            
        // 清除用户缓存
    }
}

2. 最佳实践总结

密码安全

@Service
public class PasswordPolicyService {
            
    
    // 密码复杂度验证
    public boolean isValidPassword(String password) {
            
        if (password == null || password.length() < 8) {
            
            return false;
        }
        
        // 至少包含一个大写字母、小写字母、数字和特殊字符
        String pattern = "^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]";
        return password.matches(pattern);
    }
    
    // 密码历史检查
    @Autowired
    private PasswordHistoryRepository passwordHistoryRepository;
    
    public boolean isPasswordReused(String username, String newPassword) {
            
        List<String> recentPasswords = passwordHistoryRepository
            .findRecentPasswordsByUsername(username, 5); // 检查最近5次密码
            
        return recentPasswords.stream()
            .anyMatch(oldPassword -> passwordEncoder.matches(newPassword, oldPassword));
    }
}

会话安全

@Configuration
public class SessionSecurityConfig {
            
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            
        http
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                .maximumSessions(1)
                .maxSessionsPreventsLogin(false)
                .sessionRegistry(sessionRegistry())
            )
            .sessionFixation().migrateSession()
            .headers(headers -> headers
                .frameOptions().deny()
                .contentTypeOptions()
                .httpStrictTransportSecurity(hstsConfig -> hstsConfig
                    .maxAgeInSeconds(31536000)
                    .includeSubdomains(true)
                )
            );
        
        return http.build();
    }
}

审计日志

@Component
public class SecurityAuditListener {
            
    
    @EventListener
    public void handleAuthenticationSuccess(AuthenticationSuccessEvent event) {
            
        String username = event.getAuthentication().getName();
        String ipAddress = getClientIP();
        
        auditService.logSecurityEvent(
            SecurityEventType.LOGIN_SUCCESS, 
            username, 
            ipAddress, 
            "用户登录成功"
        );
    }
    
    @EventListener
    public void handleAuthenticationFailure(AbstractAuthenticationFailureEvent event) {
            
        String username = event.getAuthentication().getName();
        String ipAddress = getClientIP();
        
        auditService.logSecurityEvent(
            SecurityEventType.LOGIN_FAILURE, 
            username, 
            ipAddress, 
            "用户登录失败: " + event.getException().getMessage()
        );
    }
    
    @EventListener
    public void handleAccessDenied(AuthorizationFailureEvent event) {
            
        String username = event.getAuthentication().getName();
        String resource = event.getSource().toString();
        
        auditService.logSecurityEvent(
            SecurityEventType.ACCESS_DENIED, 
            username, 
            getClientIP(), 
            "访问被拒绝: " + resource
        );
    }
}

总结

Spring Security作为Java生态系统中最重要的安全框架，为企业级应用提供了全面的安全解决方案。

核心要点

架构设计：基于Filter链和代理模式的安全架构
认证机制：支持多种认证方式和自定义扩展
授权控制：灵活的角色和权限管理体系
安全防护：全面的Web安全漏洞防护机制

技术趋势

云原生安全：微服务架构下的分布式安全
OAuth2/JWT：无状态认证和授权标准
零信任安全：基于身份验证的安全模型
AI安全：机器学习在安全检测中的应用

实施建议

安全设计：在架构设计阶段就考虑安全需求
纵深防御：多层次的安全防护策略
持续监控：实时的安全事件监控和响应
定期评估：定期进行安全漏洞扫描和评估

Spring Security不仅是一个技术框架，更是企业级应用安全的最佳实践指南。掌握其核心原理和应用技巧，对于构建安全可靠的应用系统至关重要。