Spring Protected Filter Not Called

Question

I have code for filters configured in a spring boot application. My second filter, which is B, is not called when I make a request.

import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity; @Configuration @EnableWebMvcSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override public void configure(WebSecurity webSecurity) throws Exception { webSecurity.ignoring().antMatchers(HttpMethod.GET, "/health"); } @Override protected void configure(HttpSecurity http) throws Exception { http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS); http.addFilterBefore(new A(), BasicAuthenticationFilter.class); http.addFilterAfter(new B(), new A().getClass()); } } import org.springframework.web.filter.GenericFilterBean; public class A extends GenericFilterBean { @Override public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException { System.out.println("filter A"); } } import org.springframework.web.filter.GenericFilterBean; public class B extends GenericFilterBean { @Override public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException { System.out.println("filter B"); } } 

Edit:

  public class A extends GenericFilterBean { @Override public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException { System.out.println("filter A Before"); arg2.doFilter(arg0,arg1); System.out.println("filter A After"); } } 

Answer 1

Your configuration is correct. But you need to pass your query from Filter A to Filter B , as indicated by M. Deinum . Just printing does not work. In your code, it should be arg2.doFilter() in Filter A

From the docs it says:

A typical implementation of this method will follow the following pattern:

• Examine the request
• If necessary, add a query object using a special implementation for filter contents or headers for filtering input.
• Optionally wrap the response object with a special implementation to allow filter contents or headers to filter output.
• Either call the next object in the chain using the FilterChain object (chain.doFilter ()) or not pass a request / response pair to the next object in the filter chain to block the request Processing
• Directly set headers in response after calling the next object in the filter chain.