Trace a Request Through the Security Filter Chain

Spring Security's web layer is built on standard Java Servlet Filters. When an HTTP request enters the Servlet container (such as Tomcat), the standard bridge filter DelegatingFilterProxy intercepts it and delegates processing to a Spring ApplicationContext singleton bean named springSecurityFilterChain. This bean is an instance of FilterChainProxy, which maintains a list of SecurityFilterChain beans. FilterChainProxy performs chain selection (matching the request path and headers against each chain's RequestMatcher in sequence), then routes the request through that matching chain's deterministic list of security filters.

1. 011. SecurityContextHolderFilter: Restores the SecurityContext from the SecurityContextRepository (e.g. HttpSession or request cache)
2. 022. HeaderWriterFilter: Injects secure response headers (X-Content-Type-Options, X-Frame-Options, HSTS)
3. 033. CorsFilter: Handles cross-origin preflight OPTIONS requests and sets Access-Control headers
4. 044. CsrfFilter: Validates CSRF tokens on mutating HTTP methods (POST, PUT, DELETE, PATCH)
5. 055. AuthenticationFilter: (e.g. BearerTokenAuthenticationFilter or UsernamePasswordAuthenticationFilter) Validates credentials and constructs an Authentication token
6. 066. ExceptionTranslationFilter: Catches AuthenticationException (delegating to the configured AuthenticationEntryPoint, such as 401 for REST or redirect for login) and AccessDeniedException (delegating to AccessDeniedHandler to return 403 Forbidden)
7. 077. AuthorizationFilter: Evaluates authorization rules against the current request and principal authorities via RequestMatcherDelegatingAuthorizationManager

Spring Security 6 (included in Spring Boot 3+) completely removed the legacy WebSecurityConfigurerAdapter and deprecated fluent chaining methods like .and(). All security configuration is now expressed via lambda DSLs returning a SecurityFilterChain bean.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

package com.example.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // Safe to disable ONLY when authenticating exclusively via non-ambient credentials (Authorization header);
            // ambient credentials (cookies, browser-cached basic auth) require CSRF protection regardless of statelessness.
            .csrf(csrf -> csrf.disable())
            .cors(Customizer.withDefaults())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health/**").permitAll()
                .requestMatchers(HttpMethod.POST, "/api/auth/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers(HttpMethod.GET, "/api/orders/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));

        return http.build();
    }
}

In authorizeHttpRequests, request matchers are evaluated in first-match-wins order. Once a request matches a pattern, Spring Security applies that rule immediately and stops evaluating subsequent matchers.

Let us analyze a real-world security vulnerability caused by regex / wildcard misconfigurations:

1
2
3
4

auth
    .requestMatchers("/api/public/**").permitAll()
    .requestMatchers("/api/public/admin-debug").hasRole("ADMIN") // DEAD CODE! Shadowed by line above!
    .anyRequest().authenticated();