« back

[Spring Security] Form Login

spring_security

DefaultLoginPageGeneratingFilter #

UsernamePasswordAuthenticationFilter #

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
        throws AuthenticationException {
    if (this.postOnly && !request.getMethod().equals("POST")) {
        throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
    }
    String username = obtainUsername(request);
    username = (username != null) ? username : "";
    username = username.trim();

    String password = obtainPassword(request);
    password = (password != null) ? password : "";

    UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password); // token을 먼저 만들고
    // Allow subclasses to set the "details" property
    setDetails(request, authRequest); // detail 정보가 필요할수있기때문에 set details를 하고
    return this.getAuthenticationManager().authenticate(authRequest); // auth manager에게 처리해달라고 위임함
}

DefaultLogoutPageGeneratingFilter #

LogoutFilter #

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    if (requiresLogout(request, response)) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication(); // SecurityContextHolder가 auth를 가져다가
        if (this.logger.isDebugEnabled()) {
            this.logger.debug(LogMessage.format("Logging out [%s]", auth));
        }
        this.handler.logout(request, response, auth); // 핸들러에게 넘겨서 로그아웃 처리
        this.logoutSuccessHandler.onLogoutSuccess(request, response, auth); // 처리가 되면 success 처리
        return;
    }
    chain.doFilter(request, response);
}