public class UsernamePasswordAuthenticationFilter extends
  AbstractAuthenticationProcessingFilter {
 // 默認取賬戶名、密碼的key
	public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
	public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
 // 可以通過對應(yīng)的set方法修改
	private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
	private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
 // 默認只支持 POST 請求
	private boolean postOnly = true;
 
 // 初始化一個用戶密碼 認證過濾器 默認的登錄uri 是 /login 請求方式是POST
 public UsernamePasswordAuthenticationFilter() {
  super(new AntPathRequestMatcher("/login", "POST"));
 }

 // 實現(xiàn)其父類 AbstractAuthenticationProcessingFilter 提供的鉤子方法 用去嘗試認證
 public Authentication attemptAuthentication(HttpServletRequest request,
   HttpServletResponse response) throws AuthenticationException {
  // 判斷請求方式是否是POST
  if (postOnly && !request.getMethod().equals("POST")) {
   throw new AuthenticationServiceException(
    "Authentication method not supported: " + request.getMethod());
  }
  
  // 先去 HttpServletRequest 對象中獲取賬號名、密碼
  String username = obtainUsername(request);
  String password = obtainPassword(request);

  if (username == null) {
   username = "";
  }

  if (password == null) {
   password = "";
  }

  username = username.trim();

  // 然后把賬號名、密碼封裝到 一個認證Token對象中，這是就是一個通行證，但是這時的狀態(tài)時不可信的，一旦通過認證就變?yōu)榭尚诺?
  UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
   username, password);

  // 會將 HttpServletRequest 中的一些細節(jié) request.getRemoteAddr() request.getSession 存入的到Token中
  setDetails(request, authRequest);

  // 然后 使用 父類中的 AuthenticationManager 對Token 進行認證 
  return this.getAuthenticationManager().authenticate(authRequest);
 }
 // 獲取密碼 很重要 如果你想改變獲取密碼的方式要么在此處重寫，要么通過自定義一個前置的過濾器保證能此處能get到
 @Nullable
 protected String obtainPassword(HttpServletRequest request) {
  return request.getParameter(passwordParameter);
 }

  // 獲取賬戶很重要 如果你想改變獲取密碼的方式要么在此處重寫，要么通過自定義一個前置的過濾器保證能此處能get到
 @Nullable
 protected String obtainUsername(HttpServletRequest request) {
  return request.getParameter(usernameParameter);
 }

 // 參見上面對應(yīng)的說明為憑據(jù)設(shè)置一些請求細節(jié)
 protected void setDetails(HttpServletRequest request,
   UsernamePasswordAuthenticationToken authRequest) {
  authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
 }

 // 設(shè)置賬戶參數(shù)的key
 public void setUsernameParameter(String usernameParameter) {
  Assert.hasText(usernameParameter, "Username parameter must not be empty or null");
  this.usernameParameter = usernameParameter;
 }

 // 設(shè)置密碼參數(shù)的key
 public void setPasswordParameter(String passwordParameter) {
  Assert.hasText(passwordParameter, "Password parameter must not be empty or null");
  this.passwordParameter = passwordParameter;
 }

 // 認證的請求方式是只支持POST請求
 public void setPostOnly(boolean postOnly) {
  this.postOnly = postOnly;
 }

 public final String getUsernameParameter() {
  return usernameParameter;
 }

 public final String getPasswordParameter() {
  return passwordParameter;
 }
}