Spring Security FilterChainProxy is registered automatically as a Filter

[cemo]

Spring Security is exposing a Filter which registered by Spring Boot. This results in a duplicate filter registration and unpredictable behaviour of our application.

Details:

org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity is registering a FilterChainProxy instance bean which is a Filter as this:

    @Bean(name=AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
    public Filter springSecurityFilterChain() throws Exception {
        boolean hasConfigurers = webSecurityConfigurers != null && !webSecurityConfigurers.isEmpty();
        if(!hasConfigurers) {
            throw new IllegalStateException("At least one non-null instance of "+ WebSecurityConfigurer.class.getSimpleName()+" must be exposed as a @Bean when using @EnableWebSecurity. Hint try extending "+ WebSecurityConfigurerAdapter.class.getSimpleName());
        }
        return webSecurity.build();
    }

I have declared a FilterRegistrationBean a FilterRegistrationBean as here: org.springframework.boot.autoconfigure.security.SpringBootWebSecurityConfiguration#securityFilterChainRegistration

   @Bean
   @ConditionalOnBean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
   public FilterRegistrationBean securityFilterChainRegistration( ) {
      DelegatingFilterProxy delegatingFilterProxy = new DelegatingFilterProxy();
      delegatingFilterProxy.setTargetBeanName(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME);
      FilterRegistrationBean registrationBean = new FilterRegistrationBean(delegatingFilterProxy);
      registrationBean.addUrlPatterns("/*");
      return registrationBean;
   }

This seems a bug to me. Am I missing something?

[dsyer]

What were you trying to do with the FilterRegistrationBean? If you just want to control the registration of the security filter then you need to make its filter the actual security filter, not a delegating proxy. I don't know what we would change for 1.2.1 unless I'm missing something.

[cemo]

My problem resolved.

For those of you who are interested in my problem, I added

registrationBean.setName(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME);

This prevents registering actual filter on startup. Spring Boot calls every org.springframework.boot.context.embedded.ServletContextInitializer on startup. For FilterRegistrationBean's it checks both filter status enabled and then tries to add. For filters already registered with same name return null.

By the way I had to use DelegatingFilterProxy because of early initialising is causing an error in my application. I had to use it for delegating to a later phase.

Shortly, I think that It would be great to add this sections clearly in documentation. It would help really a lot.

Thanks for your time guys.

[dsyer]

That doesn't seem like a great resolution. If you can provide a simple test project that demonstrates the problem, we might be able to have a more productive discussion.

[cemo]

You are right, I will provide tomorrow.