advancedAuthorization: Roles, Authorities (RBAC) & Custom Filters

Why should custom filters extend OncePerRequestFilter instead of implementing Filter directly?

Certain servlet container dispatch mechanisms (internal forwards, includes, async dispatches) can cause the same filter to be invoked more than once for what is logically a single client request. OncePerRequestFilter guarantees the filtering logic executes exactly once per request by tracking an internal 'already filtered' marker, preventing duplicate processing (e.g., double logging, double authentication attempts).

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to What happens if a custom filter forgets to call filterChain.doFilter()? →← Back to all Spring Security questions