Custom Filter in the Spring Security Filter Chain

Azure Container Apps is a fully managed serverless container service that enables you to build and deploy modern, cloud-native Java applications and microservices at scale. It offers a simplified developer experience while providing the flexibility and portability of containers.

Of course, Azure Container Apps has really solid support for our ecosystem, from a number of build options, managed Java components, native metrics, dynamic logger, and quite a bit more.

To learn more about Java features on Azure Container Apps, visit the documentation page.

You can also ask questions and leave feedback on the Azure Container Apps GitHub page.

Of course, Azure Container Apps has really solid support for our ecosystem, from a number of build options, managed Java components, native metrics, dynamic logger, and quite a bit more.

To learn more about Java features on Azure Container Apps, you can get started over on the documentation page.

And, you can also ask questions and leave feedback on the Azure Container Apps GitHub page.

Modern software architecture is often broken. Slow delivery leads to missed opportunities, innovation is stalled due to architectural complexities, and engineering resources are exceedingly expensive.

Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.

With Orkes Conductor managed through Orkes Cloud, developers can focus on building mission critical applications without worrying about infrastructure maintenance to meet goals and, simply put, taking new products live faster and reducing total cost of ownership.

Try a 14-Day Free Trial of Orkes Conductor today.

Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.

Try a 14-Day Free Trial of Orkes Conductor today.

End-to-end testing is a very useful method to make sure that your application works as intended. This highlights issues in the overall functionality of the software, that the unit and integration test stages may miss.

Playwright is an easy-to-use, but powerful tool that automates end-to-end testing, and supports all modern browsers and platforms.

When coupled with LambdaTest (an AI-powered cloud-based test execution platform) it can be further scaled to run the Playwright scripts in parallel across 3000+ browser and device combinations:

>> Automated End-to-End Testing With Playwright

1. Overview

In this quick tutorial, we’ll focus on writing a custom filter for the Spring Security filter chain.

Spring Security – @PreFilter and @PostFilter

Learn how to use the @PreFilter and @PostFilter Spring Security annotations through practical examples.

Introduction to Java Config for Spring Security

A quick and practical guide to Java Config for Spring Security

Spring Boot Security Auto-Configuration

A quick and practical guide to Spring Boot's default Spring Security configuration.

2. Creating the Filter

Spring Security provides a number of filters by default, and these are enough most of the time.

Of course, it’s sometimes necessary to implement new functionality by creating a new filter to use in the chain.

We’ll start by implementing the org.springframework.web.filter.GenericFilterBean.

The GenericFilterBean is a simple javax.servlet.Filter implementation that is Spring-aware.

We only need to implement a single method:

public class CustomFilter extends GenericFilterBean {
    @Override
    public void doFilter(
      ServletRequest request, 
      ServletResponse response,
      FilterChain chain) throws IOException, ServletException {
        chain.doFilter(request, response);
    }
}

3. Using the Filter in the Security Config

We’re free to choose either XML configuration or Java configuration to wire the filter into the Spring Security configuration.

3.1. Java Configuration

We can register the filter programmatically by creating a SecurityFilterChain bean.

For example, it works with the addFilterAfter method on an HttpSecurity instance:

@Configuration
public class CustomWebSecurityConfigurerAdapter {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.addFilterAfter(
          new CustomFilter(), BasicAuthenticationFilter.class);
        return http.build();
    }
}

There are a couple of possible methods:

addFilterBefore(filter, class) adds a filter before the position of the specified filter class.
addFilterAfter(filter, class) adds a filter after the position of the specified filter class.
addFilterAt(filter, class) adds a filter at the location of the specified filter class.
addFilter(filter) adds a filter that must be an instance of or extend one of the filters provided by Spring Security.

3.2. XML Configuration

We can add the filter to the chain using the custom-filter tag and one of these names to specify the position of our filter.

For instance, it can be pointed out by the after attribute:

<http>
    <custom-filter after="BASIC_AUTH_FILTER" ref="myFilter" />
</http>

<beans:bean id="myFilter" class="com.baeldung.security.filter.CustomFilter"/>

Here are all the attributes to specify exactly where to place our filter in the stack:

after describes the filter immediately after which a custom filter will be placed in the chain.
before defines the filter before which our filter should be placed in the chain.
position allows replacing a standard filter in the explicit position by a custom filter.

4. Applying Spring Security Filter Only on Secured Endpoints

Modern applications often serve both public and secured endpoints. Applying a custom Spring Security filter globally can lead to unnecessary processing for public endpoints. To address this, we can target the filter specifically to secured endpoints by using Spring Security’s SecurityFilterChain and RequestMatcher:

@Bean
public SecurityFilterChain securedFilterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(authorizationManagerRequestMatcherRegistry ->
      authorizationManagerRequestMatcherRegistry.requestMatchers("/secured/**").authenticated())
        .httpBasic(Customizer.withDefaults());
    http.addFilterAfter(new CustomFilter(), BasicAuthenticationFilter.class);
    return http.build();
}

This configuration ensures that security settings are only applied to endpoints matching /secured/**, as specified by requestMatchers(“/secured/**”).

The addFilterAfter(new CustomFilter(), BasicAuthenticationFilter.class) line ensures the custom filter is applied after the BasicAuthenticationFilter, meaning it will execute only after the basic authentication process.

This approach allows for targeted security processing on secured endpoints without affecting public ones. All requests to /secured/** require authentication, as enforced by .authorizeHttpRequests().

By using a custom SecurityFilterChain, we can isolate these security settings, keeping the application’s security modular and efficient. This setup prevents unnecessary overhead on public endpoints and ensures tailored authentication handling for secured paths, such as custom failure responses in the authentication entry point.

5. Conclusion

In this quick article, we created a custom filter and wired that into the Spring Security filter chain.

The code backing this article is available on GitHub. Once you're logged in as a Baeldung Pro Member, start learning and coding on the project.

Of course, Azure Container Apps has really solid support for our ecosystem, from a number of build options, managed Java components, native metrics, dynamic logger, and quite a bit more.

To learn more about Java features on Azure Container Apps, visit the documentation page.

You can also ask questions and leave feedback on the Azure Container Apps GitHub page.

Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.

Try a 14-Day Free Trial of Orkes Conductor today.

Orkes is the leading workflow orchestration platform built to enable teams to transform the way they develop, connect, and deploy applications, microservices, AI agents, and more.

Try a 14-Day Free Trial of Orkes Conductor today.

Of course, Azure Container Apps has really solid support for our ecosystem, from a number of build options, managed Java components, native metrics, dynamic logger, and quite a bit more.

To learn more about Java features on Azure Container Apps, visit the documentation page.

You can also ask questions and leave feedback on the Azure Container Apps GitHub page.