A filter chain is an ordered sequence of HTTP filters. Each filter receives a request, performs its responsibility, and delegates processing to the next filter. Spring Security supplies filters for concerns such as HTTP Basic authentication, CSRF protection, and CORS rules, while applications can add custom filters. section 5.0 section 5.1
Customize a chain by choosing where a filter acts:
- Add a filter before an existing filter when logic must run before authentication. section 5.1
- Add a filter after an existing filter for post-authentication logging, tracing, or notifications. section 5.3
- Add a filter at an existing filter’s location when replacing its responsibility, such as implementing static-key, signed-request, or one-time-password authentication. section 5.4
- Assign placement through the filter order; filters sharing an order value have no guaranteed relative order. section 5.1
Logging authenticated requests
A custom AuthenticationLoggingFilter implements Filter, reads a Request-Id header, logs the successful authentication event, and calls filterChain.doFilter(request, response). HttpSecurity then installs it with addFilterAfter(..., BasicAuthenticationFilter.class). section 5.3
Figure 5.1 The request is passed to the filter chain. Every filter engages a manager to execute particular logic upon the request and then passes it down the line to the subsequent filter in the chain.
Use the diagram to trace how each filter engages its responsibility and passes the request to the next filter. section 5.0
