> For the complete documentation index, see [llms.txt](https://www.pranaypourkar.co.in/the-programmers-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.pranaypourkar.co.in/the-programmers-guide/spring/spring-features/spring-security/security-filters-and-interceptors.md). # Security Filters and Interceptors ## About Security **Filters** and **Interceptors** are two core components in Spring Security that handle authentication, authorization, and request processing at different stages.


Component	Purpose	Executes Before/After
Security Filters	Process incoming requests for authentication, authorization, CSRF protection, CORS, etc.	Before the request reaches the controller
Security Interceptors	Perform security-related checks at the method and API level.	Before/After method execution

## **Security Filters in Spring Security** ### **How Filters Work in Spring Security** Spring Security uses the **Servlet Filter chain** to intercept requests before they reach the application. ### **Security Filter Chain Overview** 1. The **Http request** enters the application. 2. Spring Security **filters the request** based on authentication and authorization rules. 3. If the request is **valid**, it is passed to the next filter. 4. If authentication/authorization **fails**, the request is rejected. 5. Once **all filters are executed**, the request is handed to the application. ### **Core Security Filters in Spring Security** Spring Security applies **multiple filters in a specific order**:


Filter Name	Purpose
`ChannelProcessingFilter`	Enforces HTTPS and security constraints.
`WebAsyncManagerIntegrationFilter`	Integrates Spring Security with asynchronous requests.
`SecurityContextPersistenceFilter`	Restores `SecurityContext` between requests (session-based security).
`HeaderWriterFilter`	Adds security headers (e.g., X-Frame-Options, Content-Security-Policy).
`CorsFilter`	Handles CORS policies.
`CsrfFilter`	Prevents Cross-Site Request Forgery (CSRF) attacks.
`LogoutFilter`	Manages user logout functionality.
`UsernamePasswordAuthenticationFilter`	Handles form-based authentication (processes username/password login).
`DefaultLoginPageGeneratingFilter`	Generates a default login page if none is provided.
`BasicAuthenticationFilter`	Handles HTTP Basic Authentication.
`BearerTokenAuthenticationFilter`	Processes JWT and OAuth2 token-based authentication.
`RequestCacheAwareFilter`	Saves unauthorized requests and redirects after authentication.
`SecurityContextHolderAwareRequestFilter`	Wraps requests to provide Spring Security capabilities.
`AnonymousAuthenticationFilter`	Assigns an anonymous authentication token to unauthenticated users.
`SessionManagementFilter`	Controls session security policies (concurrent session control, timeout).
`ExceptionTranslationFilter`	Converts security exceptions into HTTP responses.
`FilterSecurityInterceptor`	Final authorization filter that enforces security rules.

### **How Spring Security Applies Filters** Spring Security **automatically registers filters** based on the configuration. **Example: Manually Registering a Custom Security Filter** ```java @Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http .addFilterBefore(new CustomFilter(), UsernamePasswordAuthenticationFilter.class) .authorizeHttpRequests(auth -> auth.anyRequest().authenticated()); return http.build(); } } ``` * `addFilterBefore()` inserts a **custom filter** before `UsernamePasswordAuthenticationFilter`. * **Custom filters** can be used for logging, request validation, or additional security checks. ### **Custom Security Filter Implementation** A **custom security filter** can inspect or modify requests **before authentication**. **Example: Custom Security Filter** ```java public class CustomFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { // Custom logic before processing authentication System.out.println("Custom Filter Executed: " + request.getRequestURI()); filterChain.doFilter(request, response); // Continue the filter chain } } ``` * `OncePerRequestFilter` ensures the filter runs **once per request**. * The filter **logs requests** before processing. ## **Security Interceptors in Spring Security** Security **Interceptors** enforce **method-level security** in Spring Security. They work **inside the application**, rather than at the filter level. ### **Types of Security Interceptors**


Interceptor	Purpose
`FilterSecurityInterceptor`	Ensures authorization at the filter level.
`MethodSecurityInterceptor`	Enforces security on methods using annotations.
`AspectJMethodSecurityInterceptor`	Enables AspectJ-based security for non-Spring-managed beans.

### **Method Security with Security Interceptors** **Using `@PreAuthorize` for Authorization** ```java @PreAuthorize("hasRole('ADMIN')") public void deleteUser(Long userId) { // Only ADMIN can delete a user } ``` * `@PreAuthorize` is **evaluated by `MethodSecurityInterceptor`** before executing the method. **Using `@PostAuthorize` for Authorization** ```java @PostAuthorize("returnObject.owner == authentication.name") public Order getOrder(Long id) { return orderRepository.findById(id).orElseThrow(); } ``` * The method **executes first**, and then **authorization is checked** after the result is returned. #### **How Spring Security Configures Interceptors** Spring Security **automatically registers interceptors** when method-level security is enabled.

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
}

* `@EnableMethodSecurity` enables `MethodSecurityInterceptor` for method-level security. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://www.pranaypourkar.co.in/the-programmers-guide/spring/spring-features/spring-security/security-filters-and-interceptors.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.