SoFunction
Updated on 2025-03-08

Summary of the application of responsibility chain mode in spring security filter chain

Chain of Responsibility Pattern is aBehavioral design pattern, It allows multiple objects to process requests in sequence, and each object can choose whether to process the request itself or pass it to the next object.

In Spring Security, the responsibility chain model has been widely used, especially in its Filter Chain mechanism.

1. Overview of Spring Security Filter Chain

Filter chains in Spring Security are one of the core components that protect web applications. It is a sequence of multiple filters that are executed in a specific order to handle HTTP requests and responses. Whenever a client sends a request to the application, the request first passes through the filter chain of Spring Security. Filters in the filter chain are executed in sequence, each with the opportunity to process requests and responses. If the filter allows the request to continue, the request is forwarded to the next filter or to the controller that eventually arrives at the application.

2. Application of responsibility chain model in filter chain

  • The composition of the filter chain：
    • Spring Security's filter chain contains a variety of filters, such as:UsernamePasswordAuthenticationFilter(For handling authentication based on username and password),AbstractAuthenticationProcessingFilter(Abstract class, the base class of most authentication filters),SecurityContextPersistenceFilter(Responsible for loading and saving SecurityContext),RememberMeAuthenticationFilter(Processing authentication based on the "Remember Me" function),CsrfFilter(Processing cross-site request forgery protection) andFilterSecurityInterceptor(Execute access decisions) etc.
  • Implementation of the chain of responsibility model：
    • In Spring Security, each filter implements a specific security function and they are connected in series in the order of configuration to form a filter chain.
    • When the request arrives, it is first passed to the first filter in the chain. The filter will determine based on its logic whether the request needs to be processed. If needed, process is performed; if it is not needed or needs to continue to pass after processing is completed, pass the request to the next filter in the chain.
    • This mechanism allows each filter to focus on its own security features without caring about the implementation details of other filters. At the same time, it also provides greater flexibility and scalability, as security policies can be easily modified by adding, deleting, or reordering filters.
  • Functions of key filters：
    • UsernamePasswordAuthenticationFilter: Used to handle authentication based on username and password. It usually handles POST requests to the /login endpoint.
    • SecurityContextPersistenceFilter: Responsible for loading and saving the SecurityContext. SecurityContext contains the security context for the current user, such as the authenticated user principal.
    • FilterSecurityInterceptor: Perform access decisions. It is based on the configurationAccessDecisionManagerandAccessDecisionVoterto determine whether the user has access to a resource.

3. Custom filters

In Spring Security, the implementation of custom filters is a typical application of the responsibility chain pattern. By creating and registering custom filters, you can insert specific security logic into the filter chain, thus performing additional operations during request processing.

Here is a simple example showing how to create a custom filter and integrate it into the filter chain in Spring Security.

Suppose we need to create a custom filter that records the URI and HTTP methods for each request. Here are the steps to implement this custom filter and add it to the filter chain in Spring Security.

Create a custom filter

First, you need to create an implementationThe class of the interface. In this class you will overridedoFilterMethod to execute your custom logic.

import ;
import ;
import ;
import ;
import ;
import ;
import ;
public class CustomLoggingFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // Initialization logic (optional)    }
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String uri = ();
        String method = ();
        // Record the URI and HTTP methods for requests        ("Request URI: " + uri + ", Method: " + method);
        // Pass the request to the next filter in the filter chain        (request, response);
    }
    @Override
    public void destroy() {
        // Destruction logic (optional)    }
}

Register a custom filter to Spring Security

Next, you need to register your custom filters into the filter chain in Spring Security. This is usually achieved through configuration classes.

import ;
import ;
import ;
import ;
import ;
import ;
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .addFilterBefore(customLoggingFilter(), )
            // Other security configurations...            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin() // If you use a form to log in, enable it            .and()
            .httpBasic(); // Enable HTTP Basic (optional)        return ();
    }
    @Bean
    public CustomLoggingFilter customLoggingFilter() {
        return new CustomLoggingFilter();
    }
}

In this configuration class, we useHttpSecurityTo configure Spring Security. By callingaddFilterBeforeMethod, we will customize the filterCustomLoggingFilterAdded toUsernamePasswordAuthenticationFilterBefore. This means that our custom filter will first execute and log the requested URI and HTTP methods before authentication.

Run the application

Now, when you run the application and send the request, you should see the request information recorded by the custom filter in the console.

In Spring Security, each filter (including custom filters) is a node in the chain, which is executed in sequence in the order of configuration. Each filter has a chance to process the request, and there is an option to pass the request to the next filter in the chain or perform other actions (such as access denied, redirected, etc.). This mechanism allows Spring Security to flexibly handle various security requirements while maintaining the clarity and maintainability of the code.

This is the article about the application of the responsibility chain mode in the spring security filter chain. For more related content of the spring security filter chain, please search for my previous articles or continue browsing the related articles below. I hope everyone will support me in the future!