title: How to make a server wide filter on Tomcat?
body: <p>At work, we've inherited this Java class which handles all SSO login operations. There's a FiltroSegurancaGlobal.class which is mapped to *, forcing everything with a annotation </p>
  
  <pre><code>@WebFilter(urlPatterns = { "/*" })
  </code></pre>
  
  <p>The class is deployed in a JAR with a few other classes to handle the whole SSO operation.</p>
  
  <p>Recently I was requested to install and configure a git server for internal purposes, I found a really interesting solution GitBlit, which works like a charm. </p>
  
  <p>Here's the thing, when I deployed it to the server somehow some requests are slipping through the filter. That seemed impossible so I changed the filter to nothing:</p>
  
  <pre><code>public void doFilter(ServletRequest request, ServletResponse response,
              FilterChain chain) throws IOException, ServletException {
          System.out.println("filter hit");
  }
  </code></pre>
  
  <p>While the whole application wasn't being loaded, the user wasn't being redirected to the log in page, none of the resources (css,js) were loaded, but the (index) still shows in the developer tools windows with some of the page. </p>
  
  <p>How is this possible? Wasn't a deployed filter with "/*" urlPatterns supposed to filter ALL requests? </p>
  
  <p>As mentioned bellow I tried changing the urlPatters using annotation first, then server's web.xml later:</p>
  
  <pre><code>@WebFilter({"/", "*", "/*"})
  </code></pre>
  
  <p>and then</p>
  
  <pre><code>&lt;filter-mapping&gt;
    &lt;filter-name&gt;FiltroSegurancaGlobal&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;url-pattern&gt;*&lt;/url-pattern&gt;
    &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>Nothing has changed. </p>
  
  <p>By probing chrome I realized that the only file that seemed to come through the server was angular.js, by searching their github I found a <a href="https://github.com/gitblit/gitblit/blob/252dc07d7f85cc344b5919bb7c6166ef84b2102e/src/main/java/com/gitblit/wicket/ng/NgController.java" rel="nofollow noreferrer">NgController.java</a> file which has an odd code segment:</p>
  
  <pre><code>public void renderHead(IHeaderResponse response) {
          // add Google AngularJS reference
          response.renderJavascriptReference(new ResourceReference(NgController.class, "angular.js"));
  </code></pre>
  
  <p>The actual class also implements IHeaderContributor, which is from the Apache Wicket package, not sure if this helps to troubleshoot the issue. </p>
  
  <p>I also found this <a href="https://stackoverflow.com/questions/31065687/servlet-filter-forwarded-request-from-a-servlet-will-go-to-servlet-filter-or-n">question</a> which mentions FORWARD requests, I'm gonna try checking this out, but I'm still not sure what's going on. </p>
  
  <p>Just a minor addition, it seems that the correct solution would be using <a href="https://stackoverflow.com/questions/7630268/global-java-servlet-filter-is-it-possible">Tomcat's Valve</a> but that question has a comment mentioning that: [Filters]'re only overridable whenever webapp's /WEB-INF/web.xml has another one with same filter name.</p>
  
  <p>Which is an impossible situation in this case, since I doubt the deployed app has a filter map with the same filter name. </p>
  
  <p>I'll probably migrate the whole thing to the Valve Component to make sure it's server wide, but I still don't understand what's going on in this particular scenario. </p>
  
  <p>ALSO: I forgot to mention that GitBlit has a console output when a user tries to connect, ex: <code>2016-05-13 13:53:38 [INFO ] 0 repositories identified with calculated folder sizes in 5 msecs</code> and I just noticed that the filter hit system.out.println is being executed AFTER it, meaning somehow the request from the browser is not passing through it. </p>