SecurityFilterChain 中的自定义身份验证处理过滤器位置？

Question

I have a custom implementation of AbstractAuthenticationProcessingFilter that I need to manually insert in the Security Filter Chain. I've seen multiple tutorials, each saying to insert it before or after a different filter in the chain.

Is there a definitive answer on where this filter is supposed to be placed? Or, at least, a rule of thumb that can help figure it out?

Visual reference below:

@Bean
public void SecurityFilterChain configure(HttpSecurity http) {

    MyAuthenticationProcessingFilter filter = new MyAuthenticationProcessingFilter();

    http
        .addFilterBefore(filter, WhateverFilter.class);

    // rest of configuration here

}

Answer 1

maybe you can define a AuthenticationProvider bean to process an authentication

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {

}

Answer 2

Per the documentation, implementations of AbstractAuthenticationProcessingFilter are placed between ConcurrentSessionFilter and SecurityContextHolderAwareRequestFilter