title: How Spring Security Filter Chain works
body: <p>I realize that Spring security build on chain of filters, which will intercept the request, detect (absence of) authentication, redirect to authentication entry point or pass the request to authorization service, and eventually let the request either hit the servlet or throw security exception (unauthenticated or unauthorized). <em>DelegatingFitlerProxy</em> glues these filters together. To perform their tasks, these filter access services such as <em>UserDetailsService</em> and <em>AuthenticationManager</em>.</p>
  
  <p>Key filters in the chain are (in the order)</p>
  
  <ul>
  <li>SecurityContextPersistenceFilter (restores Authentication from JSESSIONID)</li>
  <li>UsernamePasswordAuthenticationFilter (performs authentication)</li>
  <li>ExceptionTranslationFilter (catch security exceptions from FilterSecurityInterceptor)</li>
  <li>FilterSecurityInterceptor (may throw authentication and authorization exceptions)</li>
  </ul>
  
  <p>I'm confused how these filters are used. Is it that for the spring provided form-login, <em>UsernamePasswordAuthenticationFilter</em> is only used for <em>/login</em>, and latter filters are not? Does the <em>form-login</em> namespace element auto-configure these filters? Does every request (authenticated or not) reach <em>FilterSecurityInterceptor</em> for non-login url?</p>
  
  <p><strong>What if I want to secure my REST API with <em>JWT-token</em>, which is retrieved from login?</strong> I must configure two namespace configuration <code>http</code> tags, rights? One for <em>/login</em> with <code>UsernamePasswordAuthenticationFilter</code>, and another one for REST url's, with custom <code>JwtAuthenticationFilter</code>.</p>
  
  <p>Does configuring two <code>http</code> elements create two <code>springSecurityFitlerChains</code>? Is <code>UsernamePasswordAuthenticationFilter</code> turned off by default, until I declare <code>form-login</code>? How do I replace <code>SecurityContextPersistenceFilter</code> with a filter which will obtain <code>Authentication</code> from existing <code>JWT-token</code> rather than <code>JSESSIONID</code>?</p>