asmhatre/spring-security-demo
1
0
Fork 0
Code Activity

Add the filter-chain module

Browse Source 
Companion project for "The Spring Security Filter Chain Explained". A real
Spring Boot 4.1.1 servlet application whose scenarios are Spring profiles, plus
a diagnostic controller that prints the live FilterChainProxy, the reflected
FilterOrderRegistration table, and the servlet container's own registrations.

Twelve captured transcripts under docs/output/, nine cross-linked doc chapters,
21 assertions.

Also fixes a broken relative link in method-security/docs/01: the cross-module
reference to context-propagation/README.md needed two levels up, not one.
This commit is contained in:
asmhatre
2026-08-26 01:59:35 +00:00
parent 5e9e7f1b12
commit 73ab67b171
52 changed files with 3562 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
README.md
View File

@@ -9,31 +9,39 @@ by that module's `scripts/run-all.sh`, never typed by hand.
|---|---|---|
| [`context-propagation/`](context-propagation/README.md) | [Spring Security Context Propagation: The Complete Guide](https://ankurm.com/spring-security-context-propagation-complete-guide/) | Whether a `SecurityContext` survives `@Async`, executors, virtual threads, `StructuredTaskScope`, Reactor, schedulers and the servlet filter chain |
| [`method-security/`](method-security/README.md) | [Method Security in Spring Security 7: `@PreAuthorize`, `@PostAuthorize` and the Proxy Traps](https://ankurm.com/spring-security-7-method-security-proxy-traps/) | What the method-security annotations do, the full SpEL surface, and the cases where the check silently does not run |
| [`filter-chain/`](filter-chain/README.md) | [The Spring Security Filter Chain Explained](https://ankurm.com/spring-security-filter-chain-explained/) | Every filter in the default chain and its order number, where a custom filter actually lands, and how to read the TRACE log |
The two are related more closely than they look. Method security reads the `Authentication`
from `SecurityContextHolder` on the calling thread; the context-propagation module is about
getting it there. An `@Async` method carrying `@PreAuthorize` fails with
`AuthenticationCredentialsNotFoundException` for reasons that belong to the first module, not
the second.
The three are related more closely than they look. `filter-chain` is about how an
`Authentication` gets into `SecurityContextHolder` in the first place and in what order;
`context-propagation` is about whether it survives leaving the request thread; `method-security`
reads it back on whatever thread it ends up on. An `@Async` method carrying `@PreAuthorize` fails
with `AuthenticationCredentialsNotFoundException` for reasons that belong to the second module,
not the third — and a custom authentication filter that never populated the context in the first
place fails the same way, for reasons that belong to the first.
## Common ground
Both modules target the same verified stack: **JDK 25** (Temurin 25.0.4.1+1),
All three modules target the same verified stack: **JDK 25** (Temurin 25.0.4.1+1),
**Spring Framework 7.0.9**, **Spring Security 7.1.1** — the versions Spring Boot **4.1.1**
manages. Versions were taken from `maven-metadata.xml` on Maven Central rather than from
release announcements.
`context-propagation` additionally needs `--enable-preview`, because `StructuredTaskScope` is
still a preview API on JDK 25. `method-security` does not.
still a preview API on JDK 25. `method-security` does not. `filter-chain` is the only module
that is a real servlet application: it inherits `spring-boot-starter-parent` and runs on Tomcat,
because the thing it demonstrates only exists inside a servlet container.
## Running either module
## Running a module
```bash
cd method-security # or context-propagation
cd method-security # or context-propagation, or filter-chain
./scripts/run-all.sh # every demo plus the test suite, regenerating docs/output/
mvn test # just the assertions
```
`filter-chain` also has `./scripts/run.sh <profile>` and `./scripts/stop.sh`, because its
scenarios are a running web application rather than a `main()` method.
## License
MIT — see [LICENSE](LICENSE).