Call filter before spring security filter chain at boot

Question

I configured my filter as shown below, but it does not start until Spring Security Filter Chains. I set the order to zero

I am using Spring Boot 1.3 which support the order of setting in the filter

@Bean public FilterRegistrationBean filterRegistrationBean() { FilterRegistrationBean registrationBean = new FilterRegistrationBean(); registrationBean.setFilter(new UrlRewriteFilter()); registrationBean.addUrlPatterns("*"); registrationBean.addInitParameter("confReloadCheckInterval", "5"); registrationBean.addInitParameter("logLevel", "DEBUG"); registrationBean.addInitParameter("confPath", "urlrewrite.xml"); registrationBean.setOrder(0); return registrationBean; } 

Answer 1

application.properties

 security.filter-order=5 

I did not do this myself, but looking at the code, it seems like you just need to set the property for the security filter order. For example, in application.properties

This should order your filter before the safety filter. I don’t know what the consequences of changing this order are, how safe it is, it seems a little risky to me. Spring developers are talking about this here. It ends up implementing my answer above.

Discussion

https://github.com/spring-projects/spring-boot/issues/1640

Testing showing what this property does (search for testCustomFilterOrder ())

https://github.com/spring-projects/spring-boot/blob/1.2.x/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java