Spring Security Filter Chain and SecurityFilterChain Configuration
Fast recall
Quick revision
Core answer
FilterChainProxy) that intercepts every request to handle authentication, authorization, CSRF, CORS, headers, and exception translation. In Spring Security 6, you configure it by defining one or more `SecurityFilterChain` beans — each mapping URL patterns (securityMatcher) to a filter chain. `WebSecurityConfigurerAdapter` was removed in 6.0; use the component-based lambda DSL. Order matters: chains evaluated top-to-bottom, first match wins; use `@Order` for multiple chains (e.g., /api/** JWT + /web/** session). Built-in filters cover CSRF, sessions, exceptions, anonymous, auth processing, and authorization; insert custom filters with `addFilterBefore/After/At`.Understanding of filter chain architecture; Spring Security 6 migration; multiple filter chain patterns
Using deprecated WebSecurityConfigurerAdapter; mis-ordering filter chains; confusing authenticationManager setup
Discuss multiple chains for mixed auth, custom filters, observation API, SecurityMatcher
Interview-ready guide
Interview answer
How it plugs in
- Boot time: Spring registers
DelegatingFilterProxy - Delegates to
FilterChainProxybean holdingSecurityFilterChaininstances - Each chain is a list of filters applied to requests matching a
SecurityMatcher - First matching chain wins; filters run in fixed order
Key built-in filters in order
- SecurityContextHolderFilter -> loads context
- HeaderWriterFilter -> security headers
- CorsFilter, CsrfFilter, LogoutFilter
- UsernamePasswordAuthenticationFilter / BearerTokenAuthenticationFilter
- BasicAuthenticationFilter, RequestCacheAwareFilter
- AnonymousAuthenticationFilter
- ExceptionTranslationFilter -> AuthorizationFilter (replaces FilterSecurityInterceptor)
Spring Security 6 single-chain config
@Configuration @EnableWebSecurity@Bean SecurityFilterChainwithHttpSecuritycsrf.disable()for API;csrfenabled for browserauthorizeHttpRequests+requestMatchers;anyRequest().authenticated()lastsessionCreationPolicy(STATELESS)for tokensoauth2ResourceServer.jwt(...)for JWT
Multiple chains
@Order(1)apiChain withsecurityMatcher("/api/**")@Order(2)webChain withsecurityMatcher("/web/**", "/login")@Order(3)actuatorChain withsecurityMatcher("/actuator/**")- First matching
securityMatcherwins
Custom filter
- Extend
OncePerRequestFilter - Set
AuthenticationinSecurityContextHolder - Register with
addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class)
Migration checklist (pre-Boot 3 -> Boot 3+)
WebSecurityConfigurerAdapter->SecurityFilterChainbeanantMatchers->requestMatchersauthorizeRequests->authorizeHttpRequests- Remove
.and()chaining; use lambda DSL EnableGlobalMethodSecurity->EnableMethodSecurity
Common gotchas
- Rule order: specific first, anyRequest last
hasRolevshasAuthority(ROLE_ prefix)STATELESSbroken byrequest.getSession()in controllers- Missing
@Order-> undefined evaluation X-Frame-Options: DENYblocks dev iframes (H2 console)@EnableMethodSecurityrequired for@PreAuthorize
Spring Security Filter Chain and SecurityFilterChain Configuration
Direct Answer
Spring Security is built as a chain of servlet filters (FilterChainProxy) that intercepts every request to handle authentication, authorization, CSRF, CORS, headers, and exception translation. In Spring Security 6, you configure it by defining one or more SecurityFilterChain beans — each mapping URL patterns (securityMatcher) to a filter chain. WebSecurityConfigurerAdapter was removed in 6.0; use the component-based lambda DSL. Order matters: chains evaluated top-to-bottom, first match wins; use @Order for multiple chains (e.g., /api/** JWT + /web/** session). Built-in filters cover CSRF, sessions, exceptions, anonymous, auth processing, and authorization; insert custom filters with addFilterBefore/After/At.
Common Mistakes & Pitfalls
Using deprecated WebSecurityConfigurerAdapter; mis-ordering filter chains; confusing authenticationManager setup
Check your understanding
Answer these without looking back at the article.
- How do you set up two SecurityFilterChain beans for /api JWT and /web session?
- What's the difference between hasRole and hasAuthority?
- How do you add a custom filter at the right position in the chain?
- Migration from WebSecurityConfigurerAdapter to SecurityFilterChain beans?
Related interview prep categories
2Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.