How to replace UserPasswordAuthenticationFilter in Spring Security

Question

Using an XML configuration will look like

<custom-filter position="FORM_LOGIN_FILTER" ref="SCAAuthenticationFilter" />.  

Without XML, it would look like this:

httpSecurity.addFilter(new SCAAthenticationFilter())

Spring doesn't seem to replace UsernamePasswordAuthenticationFilter , but it adds my filter earlier.

Answer 1

If you look at FormLoginConfigurer, you will see that the UsernamePasswordAuthenticationFilter is created and inserted into the AbstractAuthenticationFilterConfigurer constructor, then there it is assigned to the final F authFilter, so there is no way to replace it in Spring Security 4.1

addFilter () will simply add another filter to the filter list

Answer 2

, <form-login> <http auto-config="true"> . , Spring UsernamePasswordAuthenticationFilter . URL- - , , , .