public Authentication attemptAuthentication(HttpServletRequest request,
			HttpServletResponse response) throws AuthenticationException {
		if (postOnly && !request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException(
					"Authentication method not supported: " + request.getMethod());
		}
		//獲取用戶名和密碼
		String username = obtainUsername(request);
		String password = obtainPassword(request);

		if (username == null) {
			username = "";
		}

		if (password == null) {
			password = "";
		}
		username = username.trim();
		//構造UsernamePasswordAuthenticationToken對象
		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
				username, password);

		// 為details屬性賦值
		setDetails(request, authRequest);
		// 調(diào)用authenticate方法進行校驗
		return this.getAuthenticationManager().authenticate(authRequest);
	}

@Nullable
	protected String obtainPassword(HttpServletRequest request) {
		return request.getParameter(passwordParameter);
	}
	@Nullable
	protected String obtainUsername(HttpServletRequest request) {
		return request.getParameter(usernameParameter);
	}

UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
 username, password);

//UsernamePasswordAuthenticationToken 的構造器
public UsernamePasswordAuthenticationToken(Object principal, Object credentials) {
 super(null);
 this.principal = principal;
 this.credentials = credentials;
 setAuthenticated(false);
}

// Allow subclasses to set the "details" property 允許子類去設置這個屬性
setDetails(request, authRequest);

protected void setDetails(HttpServletRequest request,
    UsernamePasswordAuthenticationToken authRequest) {
 authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
}

//AbstractAuthenticationToken 是UsernamePasswordAuthenticationToken的父類
public void setDetails(Object details) {
 this.details = details;
}

	public WebAuthenticationDetails(HttpServletRequest request) {
		this.remoteAddress = request.getRemoteAddr();

		HttpSession session = request.getSession(false);
		this.sessionId = (session != null) ? session.getId() : null;
	}

this.getAuthenticationManager().authenticate(authRequest)

public Authentication authenticate(Authentication authentication)
 throws AuthenticationException {
 Class<? extends Authentication> toTest = authentication.getClass();
 AuthenticationException lastException = null;
 AuthenticationException parentException = null;
 Authentication result = null;
 Authentication parentResult = null;
 boolean debug = logger.isDebugEnabled();

 for (AuthenticationProvider provider : getProviders()) {
 //獲取Class，判斷當前provider是否支持該authentication
 if (!provider.supports(toTest)) {
  continue;
 }
 //如果支持，則調(diào)用provider的authenticate方法開始校驗
 result = provider.authenticate(authentication);
 
		//將舊的token的details屬性拷貝到新的token中。
 if (result != null) {
  copyDetails(authentication, result);
  break;
 }
 }
 //如果上一步的結果為null，調(diào)用provider的parent的authenticate方法繼續(xù)校驗。
 if (result == null && parent != null) {
 result = parentResult = parent.authenticate(authentication);
 }

 if (result != null) {
 if (eraseCredentialsAfterAuthentication
  && (result instanceof CredentialsContainer)) {
  //調(diào)用eraseCredentials方法擦除憑證信息
  ((CredentialsContainer) result).eraseCredentials();
 }
 if (parentResult == null) {
  //publishAuthenticationSuccess將登錄成功的事件進行廣播。
  eventPublisher.publishAuthenticationSuccess(result);
 }
 return result;
 }
}

public Authentication authenticate(Authentication authentication)
		throws AuthenticationException {
 //從Authenticaiton中提取登錄的用戶名。
	String username = (authentication.getPrincipal() == null) ? "NONE_PROVIDED"
			: authentication.getName();
 //返回登錄對象
	user = retrieveUser(username,(UsernamePasswordAuthenticationToken) authentication);
 //校驗user中的各個賬戶狀態(tài)屬性是否正常
	preAuthenticationChecks.check(user);
 //密碼比對
	additionalAuthenticationChecks(user,(UsernamePasswordAuthenticationToken) authentication);
 //密碼比對
	postAuthenticationChecks.check(user);
	Object principalToReturn = user;
 //表示是否強制將Authentication中的principal屬性設置為字符串
	if (forcePrincipalAsString) {
		principalToReturn = user.getUsername();
	}
 //構建新的UsernamePasswordAuthenticationToken
	return createSuccessAuthentication(principalToReturn, authentication, user);
}

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
		throws IOException, ServletException {
	HttpServletRequest request = (HttpServletRequest) req;
	HttpServletResponse response = (HttpServletResponse) res;
	Authentication authResult;
	try {
 //實際觸發(fā)了上面提到的attemptAuthentication方法
		authResult = attemptAuthentication(request, response);
		if (authResult == null) {
			return;
		}
		sessionStrategy.onAuthentication(authResult, request, response);
	}
 //登錄失敗
	catch (InternalAuthenticationServiceException failed) {
		unsuccessfulAuthentication(request, response, failed);
		return;
	}
	catch (AuthenticationException failed) {
		unsuccessfulAuthentication(request, response, failed);
		return;
	}
	if (continueChainBeforeSuccessfulAuthentication) {
		chain.doFilter(request, response);
	}
 //登錄成功
	successfulAuthentication(request, response, chain, authResult);
}

protected void successfulAuthentication(HttpServletRequest request,
		HttpServletResponse response, FilterChain chain, Authentication authResult)
		throws IOException, ServletException {
 //將登陸成功的用戶信息存儲在SecurityContextHolder.getContext()中
	SecurityContextHolder.getContext().setAuthentication(authResult);
	rememberMeServices.loginSuccess(request, response, authResult);
	// Fire event
	if (this.eventPublisher != null) {
		eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
				authResult, this.getClass()));
	}
 //登錄成功的回調(diào)方法
	successHandler.onAuthenticationSuccess(request, response, authResult);
}

SecurityContextHolder.getContext().getAuthentication();

@GetMapping("/hr/info")
public Hr getCurrentHr(Authentication authentication) {
 return ((Hr) authentication.getPrincipal());
}

public static final String MODE_THREADLOCAL = "MODE_THREADLOCAL";
public static final String MODE_INHERITABLETHREADLOCAL = "MODE_INHERITABLETHREADLOCAL";
public static final String MODE_GLOBAL = "MODE_GLOBAL";
public static final String SYSTEM_PROPERTY = "spring.security.strategy";
private static String strategyName = System.getProperty(SYSTEM_PROPERTY);

private static void initialize() {
 if (!StringUtils.hasText(strategyName)) {
 // Set default
 strategyName = MODE_THREADLOCAL;
 }
 if (strategyName.equals(MODE_THREADLOCAL)) {
 strategy = new ThreadLocalSecurityContextHolderStrategy();
 } 
}

private static final ThreadLocal<SecurityContext> contextHolder = new ThreadLocal<>();

public class SecurityContextPersistenceFilter extends GenericFilterBean {
	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
 if (request.getAttribute(FILTER_APPLIED) != null) {
			// 確保這個過濾器只應對一個請求
			chain.doFilter(request, response);
			return;
		}
 //分岔路口之后，表示應對多個請求
		HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request,
				response);
 //用戶信息在 session 中保存的 value。
		SecurityContext contextBeforeChainExecution = repo.loadContext(holder);
		try {
  //將當前用戶信息存入上下文
			SecurityContextHolder.setContext(contextBeforeChainExecution);
			chain.doFilter(holder.getRequest(), holder.getResponse());
		}
		finally {
  //收尾工作，獲取SecurityContext
			SecurityContext contextAfterChainExecution = SecurityContextHolder
					.getContext();
  //清空SecurityContext
			SecurityContextHolder.clearContext();
  //重新存進session中
			repo.saveContext(contextAfterChainExecution, holder.getRequest(),
					holder.getResponse());
		}
	}
}

http.authorizeRequests()
 .antMatchers("/hello").permitAll()
 .anyRequest().authenticated()

@Override
public void configure(WebSecurity web) throws Exception {
 	web.ignoring().antMatchers("/index.html","/img/**","/fonts/**","/favicon.ico");
}