Spring Filter Bean Registration

Published by

youngkih21

on

March 13, 2022

Any Servlet or Filter beans are registered with the servlet container automatically.
https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.add-servlet-filter-listener.spring-bean

As mentioned from the above Spring document, registering Servlet or Filter as a bean automatically makes those filters to be applied from the servlet container. In other words, the filters that are registered as beans will automatically be called from Spring Boot.

For example,

Figure 1. Negated /hello

Just as Figure 1, if we add the /hello path to be excluded from the requestMatcher, the path would bypass the filters.

However, if we add make the filter as a Bean, the filter itself will be triggered from the servlet container.

Figure 2. Filter bean registration

Figure 3. FilterChainProxy includes the Filter beans

Like seen from the Figure 3, we can check the registered filter bean is included in the FilterChainProxy‘s chain that triggers the doFilter() to be called from MyCustomFilter class.

If that so, what should we do in circumstances where we need that filter to be declared as a bean but don’t want that to be executed from the spring security?
The answer is to use FilterRegistrationBean.

Use FilterRegistrationBean to bypass filter registration

Figure 4. Usage of FilterRegistrationBean

Figure 5. Usage of FilterRegistrationBean

Declaring a FilterRegistrationBean of the specific filter and disabling it from registration would make the requests to bypass that filter.

Will the Guru