spring - Spring Security:REST API需要哪个过滤器

Question

我只需要在我的项目中使用Spring Security Basic HTML身份验证过滤器来保护REST API。

由于我是Spring Security的新手，所以我想知道其余过滤器链中不需要哪个过滤器。我已经做过一些研究，说securityContextPersistenceFilter是在任何身份验证过滤器之前设置所必需的，其他过滤器呢？

securityContextPersistenceFilter //It should be needed..
logoutFilter, // I'm not so sure about this..
authenticationProcessingFilter, // I guess it should not be necessary, because user will just use header to hold the credential
concurrentSessionFilter, // I guess no
basicAuthenticationFilter, // Should be needed
securityContextHolderAwareRequestFilter, //It's required because the need to judge the ROLE of the user
rememberMeAuthenticationFilter, // I guess no
anonymousAuthenticationFilter, // I'm not so sure
exceptionTranslationFilter, // Should be needed
filterInvocationInterceptor // I'm not so sure

我对列表中的所有内容都正确吗？

Answer 1

我认为您只需要:

securityContextPersistenceFilter // It should be needed..
basicAuthenticationFilter, // Should be needed
securityContextHolderAwareRequestFilter, // for internal stuff also
anonymousAuthenticationFilter, // for default/non-logged in user
exceptionTranslationFilter, // catches security exceptions
filterInvocationInterceptor // defines which url are accessible, etc

也有很好的描述: http://docs.spring.io/spring-security/site/docs/3.0.x/reference/security-filter-chain.html#d0e2952