spring security

_flow

org.springframework.web.filter.DelegatingFilterProxy#doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
if (delegateToUse == null)
		WebApplicationContext wac = findWebApplicationContext()
		delegate = wac.getBean("springSecurityFilterChain, Filter.class)
org.springframework.web.filter.DelegatingFilterProxy#invokeDelegate(delegate, request, response, filterChain)
delegate.doFilter(request, response, filterChain)
		org.springframework.security.web.FilterChainProxy#doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
		org.springframework.security.web.FilterChainProxy#doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
		List<Filter> filters = getFilters(fwRequest)
				for (SecurityFilterChain chain : filterChains)
						if (chain.matches(request))
								return chain.getFilters()
		VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters)
				org.springframework.security.web.FilterChainProxy.VirtualFilterChain#VirtualFilterChain(FirewalledRequest firewalledRequest, FilterChain chain, List<Filter> additionalFilters)
				this.originalChain = chain;
				this.additionalFilters = additionalFilters;
				this.size = additionalFilters.size();
				this.firewalledRequest = firewalledRequest
		vfc.doFilter(fwRequest, fwResponse)
				org.springframework.security.web.FilterChainProxy.VirtualFilterChain#doFilter(ServletRequest request, ServletResponse response)
				if (currentPosition == size) // #1
						originalChain.doFilter(request, response)
				else
						Filter nextFilter = additionalFilters.get(currentPosition++ - 1)
						nextFilter.doFilter(request, response, this)
								org.springframework.session.web.http.OncePerRequestFilter#doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
								org.springframework.session.web.http.SessionRepositoryFilter#doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
										request.setAttribute(SESSION_REPOSITORY_ATTR, sessionRepository);		
										SessionRepositoryRequestWrapper wrappedRequest = new SessionRepositoryRequestWrapper(request, response, servletContext);
										SessionRepositoryResponseWrapper wrappedResponse = new SessionRepositoryResponseWrapper(wrappedRequest,response);
										HttpServletRequest strategyRequest = httpSessionStrategy.wrapRequest(wrappedRequest, wrappedResponse);
										HttpServletResponse strategyResponse = httpSessionStrategy.wrapResponse(wrappedRequest, wrappedResponse);
										filterChain.doFilter(strategyRequest, strategyResponse)
				org.springframework.security.web.FilterChainProxy.VirtualFilterChain#doFilter(ServletRequest request, ServletResponse response)
				repeat // #1
						nextFilter.doFilter(request, response, this)
								org.springframework.session.web.http.OncePerRequestFilter#doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
								org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter#doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
										filterChain.doFilter(strategyRequest, strategyResponse)
				org.springframework.security.web.FilterChainProxy.VirtualFilterChain#doFilter(ServletRequest request, ServletResponse response)
				repeat // #1
						nextFilter.doFilter(request, response, this)
								org.springframework.security.web.context.SecurityContextPersistenceFilter#doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
								if (forceEagerSessionCreation)
										HttpSession session = request.getSession()
												org.springframework.session.web.http.SessionRepositoryFilter.SessionRepositoryRequestWrapper#getSession()
														return getSession(true)
														org.springframework.session.web.http.SessionRepositoryFilter.SessionRepositoryRequestWrapper#getSession(boolean)
																org.springframework.session.web.http.CookieHttpSessionStrategy#getRequestedSessionId(HttpServletRequest request)
																Cookie session = getCookie(request, "JSESSIONID")
														S session = sessionRepository.getSession(requestedSessionId)