advancedAuthorization: Roles, Authorities (RBAC) & Custom Filters

Why should custom filters extend OncePerRequestFilter instead of implementing Filter directly?

Certain servlet container dispatch mechanisms (internal forwards, includes, async dispatches) can cause the same filter to be invoked more than once for what is logically a single client request. OncePerRequestFilter guarantees the filtering logic executes exactly once per request by tracking an internal 'already filtered' marker, preventing duplicate processing (e.g., double logging, double authentication attempts).

This is a Pro chapter

Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.

Why should custom filters extend OncePerRequestFilter instead of implementing Filter directly?

Next Step

Continue to What happens if a custom filter forgets to call filterChain.doFilter()?← Back to all Spring Security questions