Expected Behavior
I have a custom filter (doing things like user validation) expected to be put after both BearerTokenAuthenticationFilter
(Used for OAuth2 ResourceServer) and OAuth2LoginAuthenticationFilter
(Used for OAuth2 client).
I'm expecting to have a new addFilterAfter
to accept multiple reference filters instead of one. For example:
public HttpSecurity addFilterAfter(Filter filter, Collection<Class? extends Filter>> afterFilters) {}
The expected behavior is to have my custom filter added after the last filter in afterFilters
.
Current Behavior
Currently, HttpSecurity
has addFilterAfter
and addFilterBefore
method, both accepts only one existing filter as reference position.
Also, internal field filterOrders
is private which means I cannot call its getOrder(filter)
to detect order of existing filters.
Context
Since now I cannot put my custom filter to multiple existing filters. Then, I have to relying on options:
* find out which existing filter is late in the list by running my application and logging their ordering, and then call addFitlerAfter
with that filter.
This put my code depends on sequence of filters which is internal to framework. I searched for example, there are no documentation said that BearerTokenAuthenticationFilter
will always be after OAuth2LoginAuthenticationFilter
, then relying on the ordering of these two filters is a hack and may break in future release.