源码分析过滤器与拦截器的区别

 

博主最近刚拿到一个微服务的新项目，边研究边分析从框架基础开始慢慢带领大家研究微服务的一些东西，这次给大家分析下Springboot中的过滤器和拦截器的区别。虽然上次分析过过滤器，但是主要是分析的cas流程，所以就没太深入，大家也可以看一下的啊

cas源码分析：https://www.cnblogs.com/guoxiaoyu/p/13280259.html

好的，正题开始：首先讲解一下Springboot中如何进行添加过滤器、进行过滤器过滤请求。添加示例必须来一下

@Configuration
public class WebConfiguration{

@Bean
    public FilterRegistrationBean testFilterByMe(){
        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
        filterRegistrationBean.setFilter(new TestFilterByMe());
        filterRegistrationBean.setOrder(1);
        return filterRegistrationBean;
    }
}

　　我们过滤器为什么要添加到FilterRegistrationBean中，不添加可不可以，为什么用@WebFilter注解也可以呢，用@Component可不可以以的呢？博主今天就通过源码给大家讲解一下这几个问题

　　首先我们的Springboot开始启动后，会进行创建bean和web服务器tomcat，源码附上：

@Override
    protected void onRefresh() {
    //onRefresh方法就是扫描包，解析配置类的过程，原生spring中是一个空方法，这里进行重写用于创建tomcat服务器
        super.onRefresh();
        try {
            //开始创建web服务器tomcat，所以Springboot才可以不依赖web容器，自己就可以启动成功并进行访问
            createWebServer();
        }
        catch (Throwable ex) {
            throw new ApplicationContextException("Unable to start web server", ex);
        }
    }

　　createWebServer()这个方法的源码我就不贴上了，大家可以自己看一下源码，最后就会看到new tomcat（）；并进行启动tomcat。启动容器后当然是开始进行初始化。

private void selfInitialize(ServletContext servletContext) throws ServletException {
        prepareWebApplicationContext(servletContext);
        registerApplicationScope(servletContext);
        WebApplicationContextUtils.registerEnvironmentBeans(getBeanFactory(), servletContext);
        //getServletContextInitializerBeans()这个方法进开始进行解析并添加filter过滤器 了
        for (ServletContextInitializer beans : getServletContextInitializerBeans()) {
            beans.onStartup(servletContext);
        }
    }

　　现在才到了添加过滤器最关键的部分，这个部分已经基本把上面的三个问题的答案告诉大家了，详情源码如下：

//开始添加过滤器
    public ServletContextInitializerBeans(ListableBeanFactory beanFactory,
            Class<? extends ServletContextInitializer>... initializerTypes) {
        this.initializers = new LinkedMultiValueMap<>();
        this.initializerTypes = (initializerTypes.length != 0) ? Arrays.asList(initializerTypes)
                : Collections.singletonList(ServletContextInitializer.class);
        //这里实现的添加形式是通过FilterRegistrationBean类型注册的
        addServletContextInitializerBeans(beanFactory);
        //这里是通过beanfactory中获取filter类型过滤器后添加进来的,这就明白了，只要让spring扫描到，
        //过滤器自己实现了filter接口，你就会给添加到过滤器链
        addAdaptableBeans(beanFactory);
        //都会添加到initializers这一个map中
        List<ServletContextInitializer> sortedInitializers = this.initializers.values().stream()
                .flatMap((value) -> value.stream().sorted(AnnotationAwareOrderComparator.INSTANCE))
                .collect(Collectors.toList());
        this.sortedList = Collections.unmodifiableList(sortedInitializers);
        logMappings(this.initializers);
    }

　　一个一个方法分析一下，让大家看个明白到底是怎么回事，为什么这三种方法都可以实现添加过滤器

//获取我们的实现FilterRegistrationBean类的过滤器
    private void addServletContextInitializerBeans(ListableBeanFactory beanFactory) {
        for (Class<? extends ServletContextInitializer> initializerType : this.initializerTypes) {
            //获取type为ServletContextInitializer的排好序的类，跟是否实现order类无关！
            for (Entry<String, ? extends ServletContextInitializer> initializerBean : getOrderedBeansOfType(beanFactory,
                    initializerType)) {
                   //这时候就开始判断实现FilterRegistrationBean类的过滤器
                addServletContextInitializerBean(initializerBean.getKey(), initializerBean.getValue(), beanFactory);
            }
        }
    }

获取bean时debug，观察一下，最后会筛选出来我们FilterRegistrationBean的过滤器，为什么呢？因为这个类的上级实现了ServletContextInitializer

 　　再来看一下添加的过程，就知道filter要注册到FilterRegistrationBean中的原因了，

private void addServletContextInitializerBean(String beanName, ServletContextInitializer initializer,
            ListableBeanFactory beanFactory) {
        if (initializer instanceof ServletRegistrationBean) {
            Servlet source = ((ServletRegistrationBean<?>) initializer).getServlet();
            addServletContextInitializerBean(Servlet.class, beanName, initializer, beanFactory, source);
        }
        //在这里进行的添加的过程
        else if (initializer instanceof FilterRegistrationBean) {
            Filter source = ((FilterRegistrationBean<?>) initializer).getFilter();
            addServletContextInitializerBean(Filter.class, beanName, initializer, beanFactory, source);
        }
        else if (initializer instanceof DelegatingFilterProxyRegistrationBean) {
            String source = ((DelegatingFilterProxyRegistrationBean) initializer).getTargetBeanName();
            addServletContextInitializerBean(Filter.class, beanName, initializer, beanFactory, source);
        }
        else if (initializer instanceof ServletListenerRegistrationBean) {
            EventListener source = ((ServletListenerRegistrationBean<?>) initializer).getListener();
            addServletContextInitializerBean(EventListener.class, beanName, initializer, beanFactory, source);
        }
        else {
            addServletContextInitializerBean(ServletContextInitializer.class, beanName, initializer, beanFactory,
                    initializer);
        }
    }

　　我们再来看一下另一种添加的方法

//另一种添加过滤器的方法在这里
    protected void addAdaptableBeans(ListableBeanFactory beanFactory) {
        MultipartConfigElement multipartConfig = getMultipartConfig(beanFactory);
        addAsRegistrationBean(beanFactory, Servlet.class, new ServletRegistrationBeanAdapter(multipartConfig));
        //从bean工厂中获取为Filter类型的类，所以只要我们把我们已经实现Filter接口的类交给spring，beanFactory中有我们的类就可以实现
        addAsRegistrationBean(beanFactory, Filter.class, new FilterRegistrationBeanAdapter());
        for (Class<?> listenerType : ServletListenerRegistrationBean.getSupportedTypes()) {
            addAsRegistrationBean(beanFactory, EventListener.class, (Class<EventListener>) listenerType,
                    new ServletListenerRegistrationBeanAdapter());
        }
    }

　　其实最后获取出来后，都是进行创建FilterRegistrationBean

private <T, B extends T> void addAsRegistrationBean(ListableBeanFactory beanFactory, Class<T> type,
            Class<B> beanType, RegistrationBeanAdapter<T> adapter) {
            //从beanfactory中获取为filter类型的bean
        List<Map.Entry<String, B>> entries = getOrderedBeansOfType(beanFactory, beanType, this.seen);
        for (Entry<String, B> entry : entries) {
            String beanName = entry.getKey();
            B bean = entry.getValue();
            if (this.seen.add(bean)) {
                //剩下其他自动实现的创建过程，也是创建一个FilterRegistrationBean并返回
                RegistrationBean registration = adapter.createRegistrationBean(beanName, bean, entries.size());
                int order = getOrder(bean);
                registration.setOrder(order);
                this.initializers.add(type, registration);
                if (logger.isTraceEnabled()) {
                    logger.trace("Created " + type.getSimpleName() + " initializer for bean '" + beanName + "'; order="
                            + order + ", resource=" + getResourceDescription(beanName, beanFactory));
                }
            }
        }
    }
        @Override
        public RegistrationBean createRegistrationBean(String name, Filter source, int totalNumberOfSourceBeans) {
            FilterRegistrationBean<Filter> bean = new FilterRegistrationBean<>(source);
            bean.setName(name);
            return bean;
        }

 　　现在已经把过滤器找的了并且已经添加成功了，开始进行注册时调用的是onstartup方法，注册到filterDefs这个map中，下面初始化会用到

 　　这里开始进行过滤器的初始化，new ApplicationFilterConfig方法就需要大家自己去debug了，至少加深一下印象，里面会进行初始化，调用init方法

//开始过滤器的初始化
    public boolean filterStart() {

        if (getLogger().isDebugEnabled()) {
            getLogger().debug("Starting filters");
        }
        // Instantiate and record a FilterConfig for each defined filter
        boolean ok = true;
        synchronized (filterConfigs) {
            filterConfigs.clear();
            //filterDefs这个map就是刚才添加进来的过滤器map
            for (Entry<String,FilterDef> entry : filterDefs.entrySet()) {
                String name = entry.getKey();
                if (getLogger().isDebugEnabled()) {
                    getLogger().debug(" Starting filter '" + name + "'");
                }
                try {
                //在这里会进行fileter的init方法
                    ApplicationFilterConfig filterConfig =
                            new ApplicationFilterConfig(this, entry.getValue());
                    filterConfigs.put(name, filterConfig);
                } catch (Throwable t) {
                    t = ExceptionUtils.unwrapInvocationTargetException(t);
                    ExceptionUtils.handleThrowable(t);
                    getLogger().error(sm.getString(
                            "standardContext.filterStart", name), t);
                    ok = false;
                }
            }
        }

　　到这里，过滤器初始化就完成了也把开头的三个问题给大家讲解明白了，剩下的就是过滤请求的过程了，看一下请求过来时的源码处理

// Create the filter chain for this request
        //当有请求过来时，首先会调用过滤器，进行过滤，这里会进行过滤器数组的创建
        ApplicationFilterChain filterChain =
                ApplicationFilterFactory.createFilterChain(request, wrapper, servlet);

        // Call the filter chain for this request
        // NOTE: This also calls the servlet's service() method
        Container container = this.container;
        try {
            if ((servlet != null) && (filterChain != null)) {
                // Swallow output if needed
                if (context.getSwallowOutput()) {
                    try {
                        SystemLogHandler.startCapture();
                        if (request.isAsyncDispatching()) {
                            request.getAsyncContextInternal().doInternalDispatch();
                        } else {
                            filterChain.doFilter(request.getRequest(),
                                    response.getResponse());
                        }
                    } finally {
                        String log = SystemLogHandler.stopCapture();
                        if (log != null && log.length() > 0) {
                            context.getLogger().info(log);
                        }
                    }
                } else {
                    if (request.isAsyncDispatching()) {
                        request.getAsyncContextInternal().doInternalDispatch();
                    } else {
                        filterChain.doFilter
                            (request.getRequest(), response.getResponse());
                    }
                }

            }

//数组结构可以在这里查看
    void addFilter(ApplicationFilterConfig filterConfig) {

        // Prevent the same filter being added multiple times
        for(ApplicationFilterConfig filter:filters)
            if(filter==filterConfig)
                return;

        if (n == filters.length) {
            ApplicationFilterConfig[] newFilters =
                new ApplicationFilterConfig[n + INCREMENT];
            System.arraycopy(filters, 0, newFilters, 0, n);
            filters = newFilters;
        }
        filters[n++] = filterConfig;

    }

　　创建后会进行对请求的过滤，源码：

//过滤器开始过滤
private void internalDoFilter(ServletRequest request,
                                  ServletResponse response)
        throws IOException, ServletException {

        // Call the next filter if there is one
        //过滤器数组大小
        if (pos < n) {
        //每调用一次都会从数组中自增1 pos++
            ApplicationFilterConfig filterConfig = filters[pos++];
            try {
                Filter filter = filterConfig.getFilter();

                if (request.isAsyncSupported() && "false".equalsIgnoreCase(
                        filterConfig.getFilterDef().getAsyncSupported())) {
                    request.setAttribute(Globals.ASYNC_SUPPORTED_ATTR, Boolean.FALSE);
                }
                if( Globals.IS_SECURITY_ENABLED ) {
                    final ServletRequest req = request;
                    final ServletResponse res = response;
                    Principal principal =
                        ((HttpServletRequest) req).getUserPrincipal();

                    Object[] args = new Object[]{req, res, this};
                    SecurityUtil.doAsPrivilege ("doFilter", filter, classType, args, principal);
                } else {
                    //每次都会调用doFilter方法，在doFilter方法中调用internalDoFilter，就是一直回调，直到所有过滤器走完
                    filter.doFilter(request, response, this);
                }
            } catch (IOException | ServletException | RuntimeException e) {
                throw e;
            } catch (Throwable e) {
                e = ExceptionUtils.unwrapInvocationTargetException(e);
                ExceptionUtils.handleThrowable(e);
                throw new ServletException(sm.getString("filterChain.filter"), e);
            }
            //当有过滤器直接返回，并没有继续回调时，回直接return，不会处理该请求，就是下面的步骤
            return;
        }
        //当所有过滤器走完后，将会处理请求
        // We fell off the end of the chain -- call the servlet instance
        try {
            if (ApplicationDispatcher.WRAP_SAME_OBJECT) {
                lastServicedRequest.set(request);
                lastServicedResponse.set(response);
            }

            if (request.isAsyncSupported() && !servletSupportsAsync) {
                request.setAttribute(Globals.ASYNC_SUPPORTED_ATTR,
                        Boolean.FALSE);
            }
            // Use potentially wrapped request from this point
            if ((request instanceof HttpServletRequest) &&
                    (response instanceof HttpServletResponse) &&
                    Globals.IS_SECURITY_ENABLED ) {
                final ServletRequest req = request;
                final ServletResponse res = response;
                Principal principal =
                    ((HttpServletRequest) req).getUserPrincipal();
                Object[] args = new Object[]{req, res};
                SecurityUtil.doAsPrivilege("service",
                                           servlet,
                                           classTypeUsedInService,
                                           args,
                                           principal);
            } else {
            //就是这里直接调用dsipatcherservlet的service方法去转发doget，dopost方法的，
            //剩下的就是拦截器的知识点了:
                servlet.service(request, response);
            }
        } catch (IOException | ServletException | RuntimeException e) {
            throw e;
        } catch (Throwable e) {
            e = ExceptionUtils.unwrapInvocationTargetException(e);
            ExceptionUtils.handleThrowable(e);
            throw new ServletException(sm.getString("filterChain.servlet"), e);
        } finally {
            if (ApplicationDispatcher.WRAP_SAME_OBJECT) {
                lastServicedRequest.set(null);
                lastServicedResponse.set(null);
            }
        }
    }

　　到此创建以及过滤请求的流程分析也就结束了，和拦截器的创建以及拦截分析做一下对比，分析一下两者的区别，如果不知道拦截器的创建以及流程处理可以看一下我的另一篇文章：https://www.cnblogs.com/guoxiaoyu/p/13402861.html

相同点：

1. 都需要交给spring进行管理，虽然filter本身是servlet，但是如果不给spring管理，根本不会添加成功，也不会过滤请求
2. 都会在请求真正被处理前进行拦截过滤，如果不符合条件会直接返回，不会处理请求
3. 两者都可以指定执行顺序

差异点：

1. 过滤器先注册，拦截器后注册
2. 过滤器先执行，拦截器后执行，拦截器可以在请求执行后继续处理其他事情，过滤器只有一个过滤的方法
3. 过滤器执行时是基于函数回调，而拦截器执行是直接从数组中获取，一个一个执行，作者没有看到哪里用到了反射，网上好多说是反射，拦截器的三个方法都是从数组中获取然后一个一个调用方法进行的，只有在处理请求的时候才用到了invoke反射

---