Spring Security filter not invoked

Question

I have below code for filters configured in a spring boot application. My second filter which is B, is not invoke when i make a request.

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter  {
    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        webSecurity.ignoring().antMatchers(HttpMethod.GET, "/health");
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.addFilterBefore(new A(), BasicAuthenticationFilter.class);
        http.addFilterAfter(new B(), new A().getClass());
    }
}

import org.springframework.web.filter.GenericFilterBean;
public class A extends GenericFilterBean {

    @Override
    public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)
            throws IOException, ServletException {
        System.out.println("filter A");
    }
}

import org.springframework.web.filter.GenericFilterBean;
public class B extends GenericFilterBean {

    @Override
    public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)
            throws IOException, ServletException {
        System.out.println("filter B");         
    }
}

Edit:

 public class A extends GenericFilterBean {

        @Override
        public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException {
             System.out.println("filter A Before");
             arg2.doFilter(arg0,arg1);
             System.out.println("filter A After");
        }
}

Could you expand a bit. What error message do you get ? What have you tried already to solve your problem ? — kebs, Nov 04 '15 at 10:38
well there is no error..it just does not invoke the Filter B. — Harshana, Nov 04 '15 at 10:44
Ofcourse not, nor will it ever... Your `doFilter` method stops the request processing. You should call `filterchain.doFilter(request,response);` to continue processing. You are breaking proper processing. — M. Deinum, Nov 04 '15 at 11:21
thanks for pointing out. By the way i have added chain.doFilter(request, response); in each doFilter methods in Filter classes. But after filter C, my filter A is invoke from beginning which it should be after chain.doFilter(request, response) line right where "filter A After" printed? (See my edit question) — Harshana, Nov 04 '15 at 12:49
I'm bit confused by this. I don't think filters will come back to the place that they have been before. Also can you explain, Filter C and the flow a bit? — Maleen Abewardana, Nov 04 '15 at 14:16
@Maleenc My apologies for confuse you. Can you please have a look on below question, http://stackoverflow.com/questions/33537388/use-autowired-with-a-filter-configured-in-springboot — Harshana, Nov 05 '15 at 06:21

score 4 · Accepted Answer · edited Jun 20 '20 at 09:12

Your config is correct. But you need to pass your request from Filter A to Filter B as mentioned by M. Deinum. Just printing wont work. In your code it should be like, arg2.doFilter() in Filter A.

From docs it says,

A typical implementation of this method would follow the following pattern:

Examine the request
Optionally wrap the request object with a custom implementation to filter content or headers for input filtering
Optionally wrap the response object with a custom implementation to filter content or headers for output filtering
Either invoke the next entity in the chain using the FilterChain object (chain.doFilter()), or not pass on the request/response pair to the next entity in the filter chain to block the request processing
Directly set headers on the response after invocation of the next entity in the filter chain.

Spring Security filter not invoked

1 Answers1