Spring security custom filter called multiple times

Question

I have a custom exit filter called six times. Twice as soon as I try to access the application, twice when I enter the username / password and click "Login", and then twice when I click "Logout".

What am I doing wrong?

Configuration:

<http auto-config="true" use-expressions="true"> <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN_FUNCTIONS')" /> <intercept-url pattern="/**" access="hasRole('ROLE_USER')" /> <form-login login-page="/login" authentication-success-handler-ref="customAuthenticationSuccessHandlerBean" authentication-failure-handler-ref="customAuthenticationFailureHandlerBean" /> <logout invalidate-session="true" success-handler-ref="logoutHandlerBean" /> <session-management session-fixation-protection="migrateSession"> <concurrency-control max-sessions="1" expired-url="/login_sessionexpired" /> </session-management> <custom-filter before="LOGOUT_FILTER" ref="customLogoutFilter" /> </http> <beans:bean id="customLogoutFilter" class="com.hurontg.libms.security.CustomLogoutFilter" /> 

Filter:

 public class CustomLogoutFilter extends OncePerRequestFilter { /** * */ private XLogger logger = XLoggerFactory .getXLogger(CustomLogoutFilter.class.getName()); @Override protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws ServletException, IOException { logger.error("========================================================================================"); logger.error("$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Custom Logout Filter $$$$$$$$$$$$$$$$$$$$$$$$$$$$$"); logger.error("========================================================================================"); chain.doFilter(req, res); } 

}

Spring version: 4.1.1 Spring security: 3.2.5

Answer 1

It is probably called for other URLs that are being requested. For example, if you have any css, javascript, images uploaded to the page, they will be called for each of them. Try adding a log statement that displays the current request information to see if this is the case. For instance,

 logger.error("URL = " + req.getRequestURL()); 

Answer 2

If you use Spring Boot, any GenericFilterBean (once PerRequestFilter once) in the context will be automatically added to the filter chain. The value you specified above will include the same filter twice.

The simplest workaround for this is to define a FilterRegistrationBean in the context and disable it:

 <beans:bean id="customLogoutFilterRegistration" class="org.springframework.boot.context.embedded.FilterRegistrationBean"> <beans:property name="filter" ref="customLogoutFilter"/> <beans:property name="enabled" value="false"/> </beans:bean>