Spring Security Filter Chain là gì? Hoạt động như thế nào?

Security Filter Chain là chuỗi servlet filter Spring Security đặt trước controller — mỗi filter xử lý 1 concern.

Thứ tự filter:

Request
  → SecurityContextHolderFilter          (load SecurityContext)
  → UsernamePasswordAuthenticationFilter (form login)
  → BearerTokenAuthenticationFilter      (JWT)
  → ExceptionTranslationFilter           (→ 401/403)
  → AuthorizationFilter                  (check phân quyền)
  → Controller

Config (Spring Security 6):

java

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
  return http
    .csrf(AbstractHttpConfigurer::disable)
    .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
    .authorizeHttpRequests(a -> a
      .requestMatchers("/api/public/**").permitAll()
      .anyRequest().authenticated())
    .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
    .build();
}

Custom filter: extend OncePerRequestFilter, override doFilterInternal (vd gắn request-id vào MDC cho logging), đăng ký như @Component hoặc addFilterBefore(...).

Xem toàn bộ Spring & Spring Boot cùng filter theo level & chủ đề con.

Mở danh sách Spring & Spring Boot

Security Filter Chain là chuỗi servlet filter Spring Security đặt trước controller — mỗi filter xử lý 1 concern.

Thứ tự filter:

Request
  → SecurityContextHolderFilter          (load SecurityContext)
  → UsernamePasswordAuthenticationFilter (form login)
  → BearerTokenAuthenticationFilter      (JWT)
  → ExceptionTranslationFilter           (→ 401/403)
  → AuthorizationFilter                  (check phân quyền)
  → Controller

Config (Spring Security 6):

java

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
  return http
    .csrf(AbstractHttpConfigurer::disable)
    .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
    .authorizeHttpRequests(a -> a
      .requestMatchers("/api/public/**").permitAll()
      .anyRequest().authenticated())
    .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
    .build();
}

Custom filter: extend OncePerRequestFilter, override doFilterInternal (vd gắn request-id vào MDC cho logging), đăng ký như @Component hoặc addFilterBefore(...).