Filters and the security filter chain
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
explain where Spring Security sits in a web request.
Planned topics
- A servlet filter is code that runs before (and after) a controller for every request.
- Spring Security adds one big filter, which holds its own ordered list of security filters: the security filter chain.
- Each filter has one job: read credentials, check a session or token, check access, handle errors.
- If a filter rejects the request, the controller never runs.
- Order matters: the first matching rule decides.
Draft outline details
Demonstration
a diagram: Request → Security filters → DispatcherServlet → Controller.
Check your understanding
If a security filter rejects a request, does the controller run?
Show answer
No.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.