title: How to use Spring Session + Spring security xml configuration and multiply security filter
body: <h2>Background</h2>
  <p>Hey all,
  We have <code>Spring</code> project which uses <code>Spring security</code>. We have defined the security filters by defining</p>
  <pre><code> &lt;b:bean id=&quot;springSecurityFilterChain&quot; class=&quot;org.springframework.security.web.FilterChainProxy&quot;&gt;
  </code></pre>
  <p>whith <code>filter-chain-map</code></p>
  <p>and in the <code>web.xml</code> we do</p>
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
   &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  <p>and it all works well :). Now when hooking up <code>Spring session</code> with <code>redis</code> according to the <code>doc</code>  the next following lines</p>
  <pre><code>&lt;context:annotation-config /&gt;
  &lt;bean class=&quot;org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration&quot;/&gt;
  </code></pre>
  <p>create a <code>filter</code> named <code>springSessionRepositoryFilter</code>. So basically what we did is in every custom <code>filter-chain</code> we add that filter to be the <em>very first filter</em> . i.e:</p>
  <pre><code>&lt;b:bean id=&quot;springSecurityFilterChain&quot;   class=&quot;org.springframework.security.web.FilterChainProxy&quot;&gt;
       &lt;filter-chain-map request-matcher=&quot;ant&quot;&gt;
  
             &lt;filter-chain pattern=&quot;/api/someapieformobilelogin&quot; filters=&quot;none&quot; /&gt;  &lt;!-- no filter on login --&gt;
          &lt;filter-chain pattern=&quot;/api/**&quot;
              filters=&quot;springSessionRepositoryFilter, securityContextFilter,and some other spring security filter /&gt;
  
          &lt;filter-chain pattern=&quot;/**&quot;
              filters=&quot;springSessionRepositoryFilter, securityContextFilter,and some other spring security filter /&gt;
  </code></pre>
  
  <p><strong>The results</strong>: the app seems to work good and also <code>monitoring</code> via <code>redis-cli</code> shows the <code>spring</code> is communicating with <code>redis</code>.</p>
  <h2>The question</h2>
  <p>Does the use of <code>springSessionRepositoryFilter</code> inside the <code>filter-chain</code> is ok? or we abused the filtering system?</p>
  <p>Thanks,</p>
  <p>Oak</p>
  <h2>Edit</h2>
  <p>It seems that above will not work for the case one wants to <code>Authenticate</code> the user from code i.e</p>
  <pre><code>Authentication authentication = authenticationManager
                  .authenticate(authenticationToken);
  SecurityContext securityContext = SecurityContextHolder
                  .getContext();
  securityContext.setAuthentication(authentication);
  </code></pre>
  <p>will failed. Maybe because its not enough to run it via <code>filter-chain</code> of <code>org.springframework.security.web.FilterChainProxy</code>.</p>
  <p>What do you think on run it as <code>filter</code> in <code>web.xml</code>?</p>
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSessionRepositoryFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSessionRepositoryFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  <p>The above will force running <code>springSessionRepositoryFilter</code> before <code>springSecurityFilterChain</code> but in this example <code>org.springframework.web.filter.DelegatingFilterProxy</code> is being called twice. any other ways to make <code>springSessionRepositoryFilter</code> run as a filter before out <code>springSecurityFilterChain</code> filter?</p>