Why is my (Spring Security) servlet filter getting called twice?
Any ideas on why doFilterHttp in my SpringSecurityFilter subclass is being called twice on every request? I don't know where to start looking. Feeling weak.
I am developing code for vacationing employees. For the best I can figure it out, here's the relevant config:
in web.xml:
<filter>
<filter-name>userSecurityFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>userSecurityFilter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>userSecurityFilter</filter-name>
<url-pattern>/json/*</url-pattern>
In spring-security.xml:
<!-- Create the filter chains for developers, users and services -->
<bean id="userSecurityFilter" class="org.springframework.security.util.FilterChainProxy">
<security:filter-chain-map path-type="ant">
<security:filter-chain pattern="/**/json/*" filters="AuthFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor"/>
<security:filter-chain pattern="/**/*.do" filters="AuthFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor"/>
<security:filter-chain pattern="/**" filters="anonymousProcessingFilter,logoutFilter,exceptionTranslationFilter,filterInvocationInterceptor"/>
</security:filter-chain-map>
</bean>
It looks like / ** / json / * urls get the filter chain twice, while others only get it once. I'm going to go back and check to make sure what I just said is really true.
source to share
Ok, fixed that I guess.
<filter-mapping>
<filter-name>userSecurityFilter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>userSecurityFilter</filter-name>
<url-pattern>/json/*</url-pattern>
There are URLs under / json / that end with ".do", so those URLs get all the Spring Security stuff applied twice. Thanks for answers! Although it was a stupid problem and I answered it myself, working through the answers got me to the answer. Much appreciated.
source to share
Not much here, but it could be that the servlet container is handling multiple dispatchers, look in the web.xml for:
<filter-mapping>
<filter-name>securityFilter</filter-name>
<url-pattern>/*</url-pattern>
<!-- the following is optional, but some containers give the wrong default -->
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
Can you post filtering from your web.xml?
source to share
Spring Security Filters are not configured in web.xml like classic servlet filters. Instead, they are configured somewhere in the application-context.xml file (or whatever .xml config files you import into your web.xml).
Find beans with a tag like this:
<custom-filter position="LAST" />
adding that tag to the bean will add it to the Spring filter chain. I am assuming it is correctly chained and also added as a servlet filter as shown above. Hence, it is actually configured twice.
source to share