Spring SecurityのFilterChainアーキテクチャ解説 - リクエスト処理の流れを理解する

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import java.io.IOException;

public class SampleFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        // リクエスト前処理
        System.out.println("Before request processing");
        
        // 次のFilterまたはServletに処理を委譲
        chain.doFilter(request, response);
        
        // レスポンス後処理
        System.out.println("After request processing");
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

public class DelegatingFilterProxy implements Filter {
    
    private Filter delegate;
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {
        // Spring BeanとしてのFilterを取得（遅延初期化）
        Filter delegateFilter = getFilterBean("springSecurityFilterChain");
        
        // 実際の処理をSpring Beanに委譲
        delegateFilter.doFilter(request, response, chain);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

@Configuration
@EnableWebSecurity
public class MultiFilterChainConfig {

    @Bean
    @Order(1)
    public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults());
        
        return http.build();
    }

    @Bean
    @Order(2)
    public SecurityFilterChain webFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults());
        
        return http.build();
    }
}

1
2
3
4
5
6
7
8

public interface SecurityFilterChain {
    
    // このチェーンがリクエストにマッチするかを判定
    boolean matches(HttpServletRequest request);
    
    // 適用するFilterのリストを取得
    List<Filter> getFilters();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(Customizer.withDefaults())
        .authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        )
        .formLogin(Customizer.withDefaults())
        .httpBasic(Customizer.withDefaults());
    
    return http.build();
}

1
2
3
4

// SecurityContextHolderからの認証情報取得例
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
String username = authentication.getName();
Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

// UsernamePasswordAuthenticationFilterの設定例
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .formLogin(form -> form
            .loginPage("/custom-login")           // カスタムログインページ
            .loginProcessingUrl("/authenticate")  // 認証処理URL
            .usernameParameter("email")           // ユーザー名パラメータ
            .passwordParameter("passwd")          // パスワードパラメータ
            .defaultSuccessUrl("/dashboard")      // 成功時のリダイレクト先
            .failureUrl("/custom-login?error")    // 失敗時のリダイレクト先
            .permitAll()
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// BasicAuthenticationFilterの設定例
@Bean
public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/api/**")
        .httpBasic(basic -> basic
            .realmName("API Realm")
            .authenticationEntryPoint(customEntryPoint())
        )
        .sessionManagement(session -> session
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            // 特定のパスをCSRF保護から除外
            .ignoringRequestMatchers("/api/webhook/**")
            // カスタムCSRFトークンリポジトリ
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            // カスタムRequestMatcher
            .requireCsrfProtectionMatcher(customMatcher())
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

try {
    filterChain.doFilter(request, response);
} catch (AccessDeniedException | AuthenticationException ex) {
    if (!authenticated || ex instanceof AuthenticationException) {
        // 認証開始（ログインページへリダイレクトなど）
        authenticationEntryPoint.commence(request, response, ex);
    } else {
        // アクセス拒否処理
        accessDeniedHandler.handle(request, response, ex);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(authorize -> authorize
            // パスベースの認可
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .requestMatchers("/api/**").hasAuthority("API_ACCESS")
            // メソッドベースの認可
            .requestMatchers(HttpMethod.DELETE, "/users/**").hasRole("ADMIN")
            // IPアドレスベースの認可
            .requestMatchers("/internal/**").hasIpAddress("192.168.1.0/24")
            // その他はすべて認証必須
            .anyRequest().authenticated()
        );
    
    return http.build();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.web.filter.OncePerRequestFilter;
import java.io.IOException;

public class TenantFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {
        
        String tenantId = request.getHeader("X-Tenant-Id");
        
        if (tenantId == null || tenantId.isEmpty()) {
            throw new AccessDeniedException("Tenant ID is required");
        }
        
        if (!isValidTenant(tenantId)) {
            throw new AccessDeniedException("Invalid Tenant ID");
        }
        
        // テナントコンテキストを設定
        TenantContext.setCurrentTenant(tenantId);
        
        try {
            filterChain.doFilter(request, response);
        } finally {
            // クリーンアップ
            TenantContext.clear();
        }
    }
    
    private boolean isValidTenant(String tenantId) {
        // テナントID検証ロジック
        return tenantId.matches("^[a-zA-Z0-9-]+$");
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults())
            // AnonymousAuthenticationFilterの後にTenantFilterを追加
            .addFilterAfter(new TenantFilter(), AnonymousAuthenticationFilter.class);
        
        return http.build();
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

@Configuration
public class FilterConfig {

    @Bean
    public TenantFilter tenantFilter() {
        return new TenantFilter();
    }
    
    @Bean
    public FilterRegistrationBean<TenantFilter> tenantFilterRegistration(
            TenantFilter tenantFilter) {
        FilterRegistrationBean<TenantFilter> registration = 
            new FilterRegistrationBean<>(tenantFilter);
        registration.setEnabled(false);  // 自動登録を無効化
        return registration;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

@Configuration
@EnableWebSecurity
public class MultiSecurityConfig {

    @Bean
    @Order(1)
    public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            )
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults());
        
        return http.build();
    }

    @Bean
    @Order(2)
    public SecurityFilterChain webSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/", "/home", "/css/**", "/js/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/")
                .permitAll()
            );
        
        return http.build();
    }
}

1
2

logging.level.org.springframework.security=DEBUG
logging.level.org.springframework.security.web.FilterChainProxy=TRACE

1
2
3
4
5
6
7
8
9

TRACE FilterChainProxy : Trying to match request against DefaultSecurityFilterChain 
DEBUG FilterChainProxy : Securing POST /api/users
TRACE FilterChainProxy : Invoking DisableEncodeUrlFilter (1/15)
TRACE FilterChainProxy : Invoking WebAsyncManagerIntegrationFilter (2/15)
TRACE FilterChainProxy : Invoking SecurityContextHolderFilter (3/15)
TRACE FilterChainProxy : Invoking HeaderWriterFilter (4/15)
TRACE FilterChainProxy : Invoking CsrfFilter (5/15)
...
DEBUG AuthorizationFilter : Authorized request

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

DEBUG DefaultSecurityFilterChain : Will secure any request with [
  DisableEncodeUrlFilter,
  WebAsyncManagerIntegrationFilter,
  SecurityContextHolderFilter,
  HeaderWriterFilter,
  CsrfFilter,
  LogoutFilter,
  UsernamePasswordAuthenticationFilter,
  DefaultLoginPageGeneratingFilter,
  DefaultLogoutPageGeneratingFilter,
  BasicAuthenticationFilter,
  RequestCacheAwareFilter,
  SecurityContextHolderAwareRequestFilter,
  AnonymousAuthenticationFilter,
  ExceptionTranslationFilter,
  AuthorizationFilter
]