asmhatre
73ab67b171
Companion project for "The Spring Security Filter Chain Explained". A real Spring Boot 4.1.1 servlet application whose scenarios are Spring profiles, plus a diagnostic controller that prints the live FilterChainProxy, the reflected FilterOrderRegistration table, and the servlet container's own registrations. Twelve captured transcripts under docs/output/, nine cross-linked doc chapters, 21 assertions. Also fixes a broken relative link in method-security/docs/01: the cross-module reference to context-propagation/README.md needed two levels up, not one.
Documentation index — filter-chain
Nine chapters, in order. Each links to the next; each links to the source files and the captured output it draws on. Nothing here is asserted without a file behind it.
| # | Chapter | What it answers |
|---|---|---|
| 01 | The two proxies | Why Spring Security is one servlet filter, and what DelegatingFilterProxy, FilterChainProxy and SecurityFilterChain each do |
| 02 | The default chain | The sixteen filters of the reference configuration, one by one, and what breaks without each |
| 03 | The order table | FilterOrderRegistration: every slot from 100 to 4300, the two reserved gaps, and the two slots naming classes that no longer exist |
| 04 | Where custom filters land | addFilterBefore / After / At / addFilter, the ±1 offset, superclass resolution, and ties |
| 05 | Failure modes | Six ways a chain goes wrong, each reproducible here |
| 06 | Reading the TRACE output | The five lines that matter and the three ways the log misleads |
| 07 | Multiple chains | Matching, ordering, securityMatcher vs requestMatchers, ignoring() vs permitAll() |
| 08 | Debugging recipes | Seven recipes and a symptom → chapter table |
| 09 | Testing the chain | How the twenty-one assertions are written and why |
Captured output
Every file below is regenerated by ../scripts/run-all.sh from a real
run. None of it is typed by hand.
| File | Scenario |
|---|---|
demo1-order-table.txt |
FilterOrderRegistration reflected out of the jar |
demo2-default-chain.txt |
The live 16-filter chain, plus the startup DEBUG line |
demo3-trace-authenticated.txt |
TRACE for one authenticated GET |
demo4-trace-csrf-403.txt |
TRACE for a CSRF rejection, including the /error re-dispatch |
demo5-custom-placement.txt |
Four custom filters at four anchors |
demo6-exception-translation.txt |
500 vs 403 across the ExceptionTranslationFilter boundary |
demo7-misordered.txt |
An authentication filter one slot too late |
demo8-tie.txt |
Two filters, one anchor, one order number |
demo9-double-registration.txt |
A filter bean in two chains at once |
demo10-multichain.txt |
Three chains, three lengths |
demo11-ignoring-vs-permitall.txt |
A chain with zero filters |
demo12-servlet-filters.txt |
What the servlet container sees |
tests.txt |
The 21 assertions |