title: Adding a custom filter to be invoked after spring-security filter in a Servlet 3+ environment
body: <p>I'm using Spring-Security 3.2.4 and Spring Boot 1.1.0 (and it's related dependencies versions 4.X).
  I'm writing a web application that will be run in an embedded tomcat.</p>
  
  <p>I'm trying to add two additional filters(not related to Spring security) that one of them will be invoked before the Spring-Security-FilterChainProxy and the other one will be invoked after the Spring-Security-FilterChainProxy.</p>
  
  <p>My Spring-Security configuration files:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityCtxConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth
      .inMemoryAuthentication()
          .withUser("user").password("pass").roles("USER");
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.csrf()
              .disable()
              .authorizeRequests()
              .anyRequest()
              .authenticated()
              .and()
              .formLogin()
              .usernameParameter("user").passwordParameter("password");
  }
  }
  </code></pre>
  
  <p>And the Main class (Application.class):</p>
  
  <pre><code>@Configuration
  @ComponentScan
  @EnableAutoConfiguration
  public class Application {
  
      @Bean
  RequestFilter beforeSpringSecurityFilter(){
      return new RequestFilter();
  }
  
  @Bean
  RequestFilter afterSpringSecurityFilter(){
      return new RequestFilter();
  }
  
      public static void main(String[] args) {
          SpringApplication.run(Application.class, args);
      }
  }
  </code></pre>
  
  <p>And the Filter implementation:</p>
  
  <pre><code>public class RequestFilter extends OncePerRequestFilter {
  
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
          FilterChain filterChain) throws ServletException, IOException {
          filterChain.doFilter(request, response);
  }
  
  }
  </code></pre>
  
  <p>Is there a way to controll the invocation order when taking in account the FilterChainProxy (that is beeing created by the WebSecurityConfigurerAdapter ?
  To be percise, the required order is:</p>
  
  <ol>
  <li>request-filter-1</li>
  <li>Spring-Security FilterChain</li>
  <li>request-filter-2</li>
  </ol>
  
  <p>Thanks</p>