Spring Security中自定义过滤器与JWT认证过滤器的执行顺序控制

@Component // 确保Spring能够发现并管理此过滤器
public class TenantFilter extends OncePerRequestFilter {
    private static final Logger logger = LoggerFactory.getLogger(TenantFilter.class);
    private static final String TENANT_HEADER = "X-Tenant";

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String tenantId = request.getHeader(TENANT_HEADER);
        if (tenantId != null && !tenantId.isEmpty()) {
            // 示例：根据租户ID设置连接字符串或租户上下文
            String dbConnectionString = "jdbc:mysql://localhost:3306/" + tenantId + "?useSSL=false";
            ConnectionStorage.setConnection(dbConnectionString); // 假设ConnectionStorage是一个线程局部变量
            logger.info("TenantFilter: Set connection for tenant: {}", tenantId);
        } else {
            logger.warn("TenantFilter: No X-Tenant header found.");
        }
        try {
            filterChain.doFilter(request, response);
        } finally {
            ConnectionStorage.clear(); // 清理租户上下文
            logger.info("TenantFilter: Cleared connection.");
        }
    }
}

// JwtAuthenticationFilter (用于处理 /api/user/login 并生成JWT)
public class JwtAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    // ... 构造器和attemptAuthentication, successfulAuthentication 方法 ...
    // attemptAuthentication 会尝试从数据库加载用户，此时就需要正确的租户连接
}

// JwtAuthorizationFilter (用于验证后续请求的JWT)
public class JwtAuthorizationFilter extends BasicAuthenticationFilter {
    // ... 构造器和doFilterInternal, getAuthentication 方法 ...
    // getAuthentication 可能会从数据库加载用户，此时也需要正确的租户连接
}

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

// ... 其他导入 ...

@Component
@Order(Ordered.HIGHEST_PRECEDENCE) // 确保此过滤器具有最高的优先级
public class TenantFilter extends OncePerRequestFilter {
    // ... 过滤器实现 ...
}

// TenantFilter.java (不带@Component或@Order)
public class TenantFilter extends OncePerRequestFilter {
    // ... 过滤器实现 ...
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    // 假设你有自定义的UserDetailsService和PasswordEncoder
    // @Autowired
    // private UserDetailsService userDetailsService;
    // @Autowired
    // private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 实例化你的自定义过滤器
        TenantFilter tenantFilter = new TenantFilter(); // 如果TenantFilter有依赖，需要通过构造器注入或Spring上下文获取

        // JwtAuthenticationFilter需要AuthenticationManager
        // JwtAuthenticationFilter jwtAuthenticationFilter = new JwtAuthenticationFilter(authenticationManagerBean());
        // jwtAuthenticationFilter.setFilterProcessesUrl("/api/user/login"); // 设置登录URL

        // JwtAuthorizationFilter也需要AuthenticationManager
        // JwtAuthorizationFilter jwtAuthorizationFilter = new JwtAuthorizationFilter(authenticationManagerBean());

        http.csrf().disable() // 禁用CSRF
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) // 无状态会话
            .and()
            .authorizeRequests()
                .antMatchers("/api/user/login").permitAll() // 允许登录接口访问
                .anyRequest().authenticated() // 其他所有请求都需要认证
            .and()
            // 关键步骤：在Spring Security的任何过滤器之前添加TenantFilter
            // UsernamePasswordAuthenticationFilter 是 Spring Security 认证流程的早期过滤器
            // BasicAuthenticationFilter 也是认证/授权流程的早期过滤器
            // 你可以选择一个合适的内置过滤器作为锚点
            .addFilterBefore(tenantFilter, UsernamePasswordAuthenticationFilter.class)
            // .addFilterBefore(tenantFilter, BasicAuthenticationFilter.class) // 也可以选择在BasicAuthenticationFilter之前

            // 添加你的JWT认证过滤器 (如果需要自定义)
            // .addFilter(jwtAuthenticationFilter) // 如果是自定义的UsernamePasswordAuthenticationFilter，直接addFilter即可
            // .addFilterBefore(jwtAuthorizationFilter, UsernamePasswordAuthenticationFilter.class); // JwtAuthorizationFilter通常在认证之后，但需要在其他安全检查之前
            ;

        // 推荐：使用Spring Security内置的JWT/OAuth2支持，而不是自定义实现
        // 如果使用Spring Security的OAuth2资源服务器，配置会更简洁
        // http.oauth2ResourceServer().jwt();
    }

    // Spring Security 5.7+ 推荐通过SecurityFilterChain Bean来配置
    /*
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        TenantFilter tenantFilter = new TenantFilter(); // 实例化
        // ... 其他配置 ...
        http.addFilterBefore(tenantFilter, UsernamePasswordAuthenticationFilter.class);
        // ...
        return http.build();
    }
    */

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    // 配置UserDetailsService和PasswordEncoder
    // @Override
    // protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    //     auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder);
    // }
}