doFilter Continuation, Blocking & Ordering
Master doFilter execution, chain continuation vs request blocking, HttpServletRequest casting, and filter ordering with @Order.
doFilter Continuation, Blocking & Ordering
The heart of every Servlet Filter is the doFilter() method, which receives the request, response, and the FilterChain continuation object.
1. doFilter() Execution Structure
@Component
public class ExecutionDemoFilter implements Filter {
@Override
public void doFilter(
ServletRequest request,
ServletResponse response,
FilterChain chain
) throws IOException, ServletException {
// 1. PRE-PROCESSING (Forward Execution Order)
System.out.println("PRE: Request entering filter");
// 2. CONTINUATION: Pass request downstream to next Filter or DispatcherServlet
chain.doFilter(request, response);
// 3. POST-PROCESSING (Reverse Response Order)
System.out.println("POST: Response returning through filter");
}
}2. Control Flow: Continuation vs Blocking
A Filter has two explicit control-flow choices:
- Path A (Continue): Calling
chain.doFilter()passes control down the pipeline. - Path B (Block/Reject): Setting an HTTP status code (e.g.
401 Unauthorized) and returning without callingchain.doFilter()aborts downstream execution immediately.
3. Casting Generic Servlet Objects to HTTP Types
The generic ServletRequest and ServletResponse interface types must be cast to HttpServletRequest and HttpServletResponse to access HTTP-specific metadata:
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
// Inspect HTTP Metadata
String method = httpRequest.getMethod(); // "GET", "POST"
String path = httpRequest.getRequestURI(); // "/api/v1/students"
String authHeader = httpRequest.getHeader("Authorization");
// Mutate HTTP Response
httpResponse.setHeader("X-Server-Time", String.valueOf(System.currentTimeMillis()));4. Filter Ordering via @Order
When multiple Filters are registered, Spring Boot orders them using the @Order(value) annotation:
@Component
@Order(1) // Executed FIRST on request path
public class AuthenticationFilter implements Filter { ... }
@Component
@Order(2) // Executed SECOND on request path
public class LoggingFilter implements Filter { ... }The Nested Stack Execution Model
Filters execute in a nested stack structure:
AuthenticationFilter (PRE - Order 1)
└── LoggingFilter (PRE - Order 2)
└── Controller Execution
┌── LoggingFilter (POST - Order 2)
AuthenticationFilter (POST - Order 1)Execution Sequence:
AuthFilter (PRE)──►LoggingFilter (PRE)──►Controller──►LoggingFilter (POST)──►AuthFilter (POST)
❓ Knowledge Check
What happens if a Filter fails to invoke chain.doFilter(request, response)?
In what order do filter post-processing steps execute after a controller returns?
Servlet Filter Fundamentals & Lifecycle
Master Servlet Filters in Spring Boot, the Security Checkpoint mental model, request pipeline execution, lifecycle methods, and Spring Boot 3 namespace rules.
Production Logging, Timing & Trace IDs
Master production-grade filter patterns, request timing with try-finally, correlation IDs, response header injection, and sensitive data logging security.