Spring安全过滤器不起作用。 春虫？

Question

I added to spring config my own custom filter:

@Override
public void configure(HttpSecurity http) throws Exception {
    http.addFilterBefore(filter, BasicAuthenticationFilter.class);
    http.csrf().disable();
    http.authorizeRequests().antMatchers("/oauth/token").fullyAuthenticated();
}

but doFilter(...) doesn't invoke. I need to proccess request before it will be "eaten" by spring-security-oauth. How to make it work?

Answer 1

According to the documentation, addFilterBefore configuration method "allows adding a filter before one of the known Filter classes. The known Filter instances are either a Filter listed in HttpSecurityBuilder.addFilter(Filter) or a Filter that has already been added using HttpSecurityBuilder.addFilterAfter(Filter, Class) or HttpSecurityBuilder.addFilterBefore(Filter, Class) "

HttpSecurity documentaion

This basically means that your filter will be applied if and only if BasicAuthenticationFilter is already registered to process your requests, which is probably not.