spring boot 2.x靜態資源會被HandlerInterceptor攔截的緣由和解決方法

在spring boot 1.5.x中，resources/static目錄下的靜態資源能夠直接訪問，而且訪問路徑上不用帶static，好比靜態資源放置位置以下圖所示：

那麼訪問靜態資源的路徑能夠是：

• http://localhost:8080/views/demoindex.html

• http://localhost:8080/res/js/jquery.min.js

當有配置自定義HandlerInterceptor攔截器時，請求以上靜態資源路徑不會被攔截。自定義HandlerInterceptor攔截器源碼以下：

package com.itopener.demo.config;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;


public class LoginRequiredInterceptor extends HandlerInterceptorAdapter {

    private final Logger logger = LoggerFactory.getLogger(LoginRequiredInterceptor.class);

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
            throws Exception {
        logger.info(request.getRequestURI());
        return super.preHandle(request, response, handler);
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
            throws Exception {
        logger.info(request.getRequestURI());
        super.afterCompletion(request, response, handler, ex);
    }
}

配置以下：

package com.itopener.demo.config;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;


@Configuration
public class WebMvcConfiguration extends WebMvcConfigurerAdapter {

    private final Logger logger = LoggerFactory.getLogger(WebMvcConfiguration.class);

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        logger.info("add interceptors");
        registry.addInterceptor(new LoginRequiredInterceptor());
    }

}

訪問靜態資源時路徑上不用加static目錄：

當spring boot版本升級爲2.x時，訪問靜態資源就會被HandlerInterceptor攔截

這樣對於利用HandlerInterceptor來處理訪問權限或其餘相關的功能就會受影響，跟蹤源碼查看緣由，是由於spring boot 2.x依賴的spring 5.x版本，相對於spring boot 1.5.x依賴的spring 4.3.x版本而言，針對資源的攔截器初始化時有區別，具體源碼在WebMvcConfigurationSupport中，spring 4.3.x源碼以下：

/**
 * Return a handler mapping ordered at Integer.MAX_VALUE-1 with mapped
 * resource handlers. To configure resource handling, override
 * {@link #addResourceHandlers}.
 */
@Bean
public HandlerMapping resourceHandlerMapping() {
    ResourceHandlerRegistry registry = new ResourceHandlerRegistry(this.applicationContext,
                this.servletContext, mvcContentNegotiationManager());
    addResourceHandlers(registry);

    AbstractHandlerMapping handlerMapping = registry.getHandlerMapping();
    if (handlerMapping != null) {
        handlerMapping.setPathMatcher(mvcPathMatcher());
        handlerMapping.setUrlPathHelper(mvcUrlPathHelper());
        // 此處固定添加了一個Interceptor
        handlerMapping.setInterceptors(new ResourceUrlProviderExposingInterceptor(mvcResourceUrlProvider()));
        handlerMapping.setCorsConfigurations(getCorsConfigurations());
        }
    else {
        handlerMapping = new EmptyHandlerMapping();
    }
    return handlerMapping;
}

而spring 5.x的源碼以下：

/**
 * Return a handler mapping ordered at Integer.MAX_VALUE-1 with mapped
 * resource handlers. To configure resource handling, override
 * {@link #addResourceHandlers}.
 */
@Bean
public HandlerMapping resourceHandlerMapping() {
    Assert.state(this.applicationContext != null, "No ApplicationContext set");
    Assert.state(this.servletContext != null, "No ServletContext set");

    ResourceHandlerRegistry registry = new ResourceHandlerRegistry(this.applicationContext,
                this.servletContext, mvcContentNegotiationManager(), mvcUrlPathHelper());
    addResourceHandlers(registry);

    AbstractHandlerMapping handlerMapping = registry.getHandlerMapping();
    if (handlerMapping != null) {
        handlerMapping.setPathMatcher(mvcPathMatcher());
        handlerMapping.setUrlPathHelper(mvcUrlPathHelper());
        // 此處是將全部的HandlerInterceptor都添加了（包含自定義的HandlerInterceptor）
        handlerMapping.setInterceptors(getInterceptors());
        handlerMapping.setCorsConfigurations(getCorsConfigurations());
    }
    else {
        handlerMapping = new EmptyHandlerMapping();
    }
    return handlerMapping;
}

/**
 * Provide access to the shared handler interceptors used to configure
 * {@link HandlerMapping} instances with. This method cannot be overridden,
 * use {@link #addInterceptors(InterceptorRegistry)} instead.
 */
protected final Object[] getInterceptors() {
    if (this.interceptors == null) {
        InterceptorRegistry registry = new InterceptorRegistry();
        // 此處傳入新new的registry對象，在配置類當中設置自定義的HandlerInterceptor後便可獲取到
        addInterceptors(registry);
        registry.addInterceptor(new ConversionServiceExposingInterceptor(mvcConversionService()));
        registry.addInterceptor(new ResourceUrlProviderExposingInterceptor(mvcResourceUrlProvider()));
        this.interceptors = registry.getInterceptors();
    }
    return this.interceptors.toArray();
}

從源碼當中能夠看出，使用spring 5.x時，靜態資源也會執行自定義的攔截器，所以在配置攔截器的時候須要指定排除靜態資源的訪問路徑，即配置改成以下便可：

package com.itopener.demo.config;

import java.util.Arrays;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

/**
 * @author fuwei.deng
 * @date 2018年4月13日 下午3:32:54
 * @version 1.0.0
 */
@Configuration
public class WebMvcConfiguration implements WebMvcConfigurer {

    private final Logger logger = LoggerFactory.getLogger(WebMvcConfiguration.class);

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        logger.info("add interceptors");
        registry.addInterceptor(new LoginRequiredInterceptor()).excludePathPatterns(Arrays.asList("/views/**", "/res/**"));
    }
}

這樣就能夠和spring boot 1.5.x同樣的方式使用了。不過從源碼當中能夠看出，每一個靜態資源的請求都會被自定義Interceptor攔截，只是經過訪問路徑判斷後不會執行攔截器的內容，因此spring 5.x相對於spring 4.3.x而言，這部分處理的性能會更低一些

說明：

• 本文中測試使用的具體版本：

  • spring-boot-1.5.3.RELEASE（相對應的spring版本是spring-webmvc-4.3.8.RELEASE）

  • spring-boot-2.0.1.RELEASE（相對應的spring版本是spring-webmvc-5.0.5.RELEASE）

• 關於配置類，在spring boot 2.x已經改成最低支持jdk8版本，而jdk8中的接口容許有默認實現，因此已經廢棄掉WebMvcConfigurerAdapter適配類，而改成直接實現WebMvcConfigurer接口