shiro【filter】

 1  public final void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
 2             throws ServletException, IOException {
 3         String alreadyFilteredAttributeName = getAlreadyFilteredAttributeName();
 4         if ( request.getAttribute(alreadyFilteredAttributeName) != null ) {
 5             log.trace("Filter ‘{}‘ already executed.  Proceeding without invoking this filter.", getName());
 6             filterChain.doFilter(request, response);
 7         } else //noinspection deprecation
 8             if (/* added in 1.2: */ !isEnabled(request, response) ||
 9                 /* retain backwards compatibility: */ shouldNotFilter(request) ) {
10             log.debug("Filter ‘{}‘ is not enabled for the current request.  Proceeding without invoking this filter.",
11                     getName());
12             filterChain.doFilter(request, response);
13         } else {
14             // Do invoke this filter...
15             log.trace("Filter ‘{}‘ not yet executed.  Executing now.", getName());
16             request.setAttribute(alreadyFilteredAttributeName, Boolean.TRUE);
17 
18             try {
19                 doFilterInternal(request, response, filterChain); //保证客户端请求后该filter的doFilter只会执行一次。
20             } finally {
21                 // Once the request has finished, we‘re done and we don‘t
22                 // need to mark as ‘already filtered‘ any more.
23                 request.removeAttribute(alreadyFilteredAttributeName);
24             }
25         }
26     }

可以看出doFilter的实质内容是在doFilterInternal方法中完成的。
所以实质上是保证每一个filter的 doFilterInternal只会被执行一次，
例如在配置中 配置路径 /user/** = authc,authc.则只会执行authc中的doFilterInternal一次。
doFilterInternal非常重要，在shiro整个filter体系中的核心方法及实质入口。
另外，shiro是通过在request中设置一个该filter特定的属性值来保证该filter只会执行一次的。
其次可以看到有一个enabled属性，表示是否启用这个filter，默认是true，可以设置成false，
则会跳过这个filter的doFilterInternal方法而去执行filter链中其他filter。（filterChain.doFilter(request, response);放行）

 1 public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
 2             throws ServletException, IOException {
 3 
 4         Exception exception = null;
 5 
 6         try {
 7 
 8             boolean continueChain = preHandle(request, response);
 9             if (log.isTraceEnabled()) {
10                 log.trace("Invoked preHandle method.  Continuing chain?: [" + continueChain + "]");
11             }
12 
13             if (continueChain) {
14                 executeChain(request, response, chain); //doFilterInternal(request, response, filterChain);
15             }
16 
17             postHandle(request, response);  //进入我们自己的方法逻辑，有点像 interceptor拦截器
18             if (log.isTraceEnabled()) {
19                 log.trace("Successfully invoked postHandle method");
20             }
21 
22         } catch (Exception e) {
23             exception = e;
24         } finally {
25             cleanup(request, response, exception);
26         }
27     }

PathMatchingFilter主要是对preHandle做进一步细化控制，该filter为抽象类，其他路径直接通过：preHandle中，
若请求的路径非该filter中配置的拦截路径，则直接返回true进行下一个filter。
若包含在此filter路径中，则会在isFilterChainContinued做一些控制，
该方法中会调用onPreHandle方法，
所以子类可以在onPreHandle中编写filter控制流程代码（返回true或false）。

 1 protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
 2 
 3         if (this.appliedPaths == null || this.appliedPaths.isEmpty()) {
 4             if (log.isTraceEnabled()) {
 5                 log.trace("appliedPaths property is null or empty.  This Filter will passthrough immediately.");
 6             }
 7             return true;
 8         }
 9 
10         for (String path : this.appliedPaths.keySet()) {
11             // If the path does match, then pass on to the subclass implementation for specific checks
12             //(first match ‘wins‘):
13             if (pathsMatch(path, request)) {
14                 log.trace("Current requestURI matches pattern ‘{}‘.  Determining filter chain execution...", path);
15                 Object config = this.appliedPaths.get(path);
16                 return isFilterChainContinued(request, response, path, config);
17             }
18         }
19 
20         //no path matched, allow the request to go through:
21         return true;
22     }
23 
24  private boolean isFilterChainContinued(ServletRequest request, ServletResponse response,
25                                            String path, Object pathConfig) throws Exception {
26 
27         if (isEnabled(request, response, path, pathConfig)) { //isEnabled check added in 1.2 点击在OncePerRequestFilter里头 默认true
28             if (log.isTraceEnabled()) {
29                 log.trace("Filter ‘{}‘ is enabled for the current request under path ‘{}‘ with config [{}].  " +
30                         "Delegating to subclass implementation for ‘onPreHandle‘ check.",
31                         new Object[]{getName(), path, pathConfig});
32             }
33             //The filter is enabled for this specific request, so delegate to subclass implementations
34             //so they can decide if the request should continue through the chain or not:
35             return onPreHandle(request, response, pathConfig);
36         }
37 
38         if (log.isTraceEnabled()) {
39             log.trace("Filter ‘{}‘ is disabled for the current request under path ‘{}‘ with config [{}].  " +
40                     "The next element in the FilterChain will be called immediately.",
41                     new Object[]{getName(), path, pathConfig});
42         }
43         //This filter is disabled for this specific request,
44         //return ‘true‘ immediately to indicate that the filter will not process the request
45         //and let the request/response to continue through the filter chain:
46         return true;
47     }
48 
49 protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
50         return true;
51 }

AccessControlFilter中的对onPreHandle方法做了进一步细化，isAccessAllowed方法和onAccessDenied方法达到控制效果
。这两个方法都是抽象方法，由子类去实现。到这一层应该明白。isAccessAllowed和onAccessDenied方法会影响到onPreHandle方法，而onPreHandle方法会影响到preHandle方法，
而preHandle方法会达到控制filter链是否执行下去的效果。所以如果正在执行的filter中isAccessAllowed和onAccessDenied都返回false，
则整个filter控制链都将结束，不会到达目标方法（客户端请求的接口），而是直接跳转到某个页面（由filter定义的，将会在authc中看到）。