Security Filter 기능

public abstract class OncePerRequestFilter extends GenericFilterBean 
  
public abstract class GenericFilterBean implements Filter

public interface Filter {
  public default void init(FilterConfig filterConfig) throws ServletException {}
  
  public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException;
  
  public default void destroy() {}
}

// spring security v5.7.2
final class FilterOrderRegistration {

	private static final int INITIAL_ORDER = 100;

	private static final int ORDER_STEP = 100;

	private final Map<String, Integer> filterToOrder = new HashMap<>();

	FilterOrderRegistration() {
		Step order = new Step(INITIAL_ORDER, ORDER_STEP);
		put(DisableEncodeUrlFilter.class, order.next());
		put(ForceEagerSessionCreationFilter.class, order.next());
		put(ChannelProcessingFilter.class, order.next());
		order.next(); // gh-8105
    ...
  }

public class SecurityContextPersistenceFilter extends GenericFilterBean {

  private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
			throws IOException, ServletException {
    
    ...
    // security context 불러오기
    SecurityContext contextBeforeChainExecution = this.repo.loadContext(holder);
		try {
      // security context holder에 security context 넣어주기
			SecurityContextHolder.setContext(contextBeforeChainExecution);
			if (contextBeforeChainExecution.getAuthentication() == null) {
				logger.debug("Set SecurityContextHolder to empty SecurityContext");
			}
			else {
				if (this.logger.isDebugEnabled()) {
					this.logger.debug(LogMessage.format("Set SecurityContextHolder to %s", contextBeforeChainExecution));
				}
			}
			chain.doFilter(holder.getRequest(), holder.getResponse()); // 다음 필터 실행
		}      ...
  
}

// UsernamePasswordAuthenticationFilter
public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
  
  public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
			throws AuthenticationException {
    ...
      
    // this.getAuthenticationManager() -> ProviderManager
    return this.getAuthenticationManager().authenticate(authRequest);
  }

}

// ProviderManager
public class ProviderManager implements AuthenticationManager, MessageSourceAware, InitializingBean {
  
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    ...
    try {
      	// provider -> AbstractUserDetailsAuthenticationProvider
				result = provider.authenticate(authentication);
				if (result != null) {
					copyDetails(authentication, result);
					break;
				}
			}  
    ...
    
  } 
}

// AbstractUserDetailsAuthenticationProvider
public abstract class AbstractUserDetailsAuthenticationProvider
		implements AuthenticationProvider, InitializingBean, MessageSourceAware {
  
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    ...
    try {
      	// retrieveUser -> DaoAuthenticationProvider
				user = retrieveUser(username, (UsernamePasswordAuthenticationToken) authentication);
			}
    ...
  }  
}

// DaoAuthenticationProvider
public class DaoAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
  
  protected final UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
    prepareTimingAttackProtection();
		try {
      // this.getUserDetailsService() -> UserDetailsService
			UserDetails loadedUser = this.getUserDetailsService().loadUserByUsername(username);
      ...
    }
  }  
}