When do you use a Servlet filter, HandlerInterceptor, or ControllerAdvice?

Async requests can dispatch more than once, so filter dispatcher types and interceptor async callbacks must prevent duplicate work and lost completion. Ordering among filters, the security chain, MVC, and exception resolution is documented and tested for both success and failure paths. I avoid buffering large bodies merely to log them, and I redact sensitive headers and payload fields. Metrics and tracing use bounded labels and one owner so several hooks do not count the same request multiple times.