How does a request flow through Spring Security's filter chain?

Traces a Servlet request through the security proxy, selected filter chain, authentication, context, authorization, and exception handling.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

A Servlet request reaches Spring Security through a delegating filter that invokes FilterChainProxy. That proxy selects one SecurityFilterChain and runs its security filters in order. A relevant authentication filter extracts credentials and delegates authentication; on success, the resulting Authentication is placed in a SecurityContext. Later authorization filters decide whether the request may continue to Spring MVC, while security exceptions are translated into an authentication challenge or an access-denied response.

Full answer below

Practice focus

FilterChainProxy, SecurityFilterChain, authentication filters, SecurityContext, authorization, and failure translation.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Spring Security protects Servlet applications through an ordered filter chain before the controller is invoked.
A Servlet request reaches Spring Security through a delegating filter that invokes FilterChainProxy. That proxy selects one SecurityFilterChain and runs its security filters in order. A relevant authentication filter extracts credentials and delegates authentication; on success, the resulting Authentication is placed in a SecurityContext. Later authorization filters decide whether the request may continue to Spring MVC, while security exceptions are translated into an authentication challenge or an access-denied response.
Checkpoint
Stronger answer

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Saying controllers authenticate requests themselves.
Treating the filter chain as one monolithic filter.
Adding a custom filter without understanding its position.

How does a request flow through Spring Security's filter chain?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next in path

Tech stacks

Skill areas

Suggest an improvement

Found this answer useful?