26
There are a default set of filters registered when we use the <http> element in our xml file. This mentions the ordering of filters (whichever we choose to apply), and just above that, it mentions :
<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
<constructor-arg>
<list>
<sec:filter-chain pattern="/restful/**" filters="
securityContextPersistenceFilterWithASCFalse,
basicAuthenticationFilter,
exceptionTranslationFilter,
filterSecurityInterceptor" />
<sec:filter-chain pattern="/**" filters="
securityContextPersistenceFilterWithASCTrue,
formLoginFilter,
exceptionTranslationFilter,
filterSecurityInterceptor" />
</list>
</constructor-arg>
</bean>
If the above is the list of default filters, then during debugging, I found that RequestCacheAwareFilter is also called. From where is this filter called and what is its position in the filter chain ? In which condition is AnonymousAuthenticationFilter configured into the chain ?
What's the default filter chain that's configured for me ?
Edit : I have applicationContext.xml and springSecurity.xml. The following is my applicationContext.xml :
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context" xmlns:aop="http://www.springframework.org/schema/aop"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://ww