Spring Security能否配置多个过滤器？新增IPFilter后应用异常求助

问题背景 #

为实现IP连接时的特定任务，新增IPFilter替代修改原有JwtAuthenticationFilter，配置后应用报错无法运行，已定位为新增过滤器操作导致，但未找到原因。相关配置及代码如下：

原有配置代码：

@Bean
public JwtAuthenticationFilter jwtAuthenticationFilter() {
    return new JwtAuthenticationFilter();
}

// 新增代码块
@Bean
public IPFilter ipFilter() {
    return new IPFilter();
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.//此处省略大量HttpSecurity配置代码

    // JWT过滤器原本正常工作，新增了ipFilter()
    http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    http.addFilterAfter(ipFilter(), JwtAuthenticationFilter.class);
}

IPFilter实现代码：

public class IPFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        AuditLogger.log(AuditMessageType.IP_CONNECT, "Detecting connection from IP Address: " + request.getRemoteAddr());
        log.trace("Request from: " + request.getRemoteAddr());
    }
}

问题解答 #

Spring Security完全支持配置多个过滤器，你的问题核心原因及修复方案如下：

• 核心问题：IPFilter未继续执行过滤器链
  自定义过滤器继承OncePerRequestFilter后，必须在doFilterInternal方法中调用filterChain.doFilter(request, response)，否则请求会被拦截后中断，无法传递到后续过滤器或处理器，导致应用无法正常处理请求。

  修改后的IPFilter代码：

  public class IPFilter extends OncePerRequestFilter {
      @Override
      protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
          AuditLogger.log(AuditMessageType.IP_CONNECT, "Detecting connection from IP Address: " + request.getRemoteAddr());
          log.trace("Request from: " + request.getRemoteAddr());
          // 关键：让请求继续流转过过滤器链
          filterChain.doFilter(request, response);
      }
  }
  

• 可选检查：过滤器顺序配置的严谨性
  若后续仍有问题，可检查过滤器顺序的配置方式：使用addFilterAfter时，确保指定的前置过滤器（JwtAuthenticationFilter）已被正确添加到链中。如果是自定义过滤器，建议通过实例的Class对象来指定顺序，避免类型匹配问题：

  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.//省略其他配置
  
      JwtAuthenticationFilter jwtFilter = jwtAuthenticationFilter();
      http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
      http.addFilterAfter(ipFilter(), jwtFilter.getClass());
  }
  

内容的提问来源于stack exchange，提问作者remington howell