title: How to add custom filter after user authorize in spring application
body: <p>I am a newbie to Spring Security 3. I am using roles for users to login.</p>
  
  <p>I want to add some session value after a user is authorized into the application. Maybe I need some filter so that it redirects to my method which adds some session value. I have configured my security.xml file but I am not sure whether I am doing right things. Any examples in that direction would help. Which Filter Class should I use? How should I configure security.xml file?</p>
  
  <pre><code>&lt;custom-filter ref="authenticationFilter" after="FORM_LOGIN_FILTER "/&gt;
  
  &lt;beans:bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
      &lt;beans:property name="filterProcessesUrl" value="/j_spring_security_check" /&gt;
      &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;beans:property name="authenticationSuccessHandler" ref="successHandler" /&gt;
  &lt;/beans:bean&gt; 
  
  &lt;beans:bean id="successHandler" class="org.dfci.sparks.datarequest.security.CustomAuthorizationFilter"/&gt;
  </code></pre>
  
  <p>My filter class method I need to add some session value.</p>
  
  <pre><code>public class CustomAuthorizationFilter implements AuthenticationSuccessHandler {
  
      @Override
      public void onAuthenticationSuccess(HttpServletRequest request,
              HttpServletResponse response, Authentication authentication)
              throws IOException, ServletException {
          Set&lt;String&gt; roles = AuthorityUtils.authorityListToSet(authentication
                  .getAuthorities());
          if (roles.contains("ROLE_USER")) {
              request.getSession().setAttribute("myVale", "myvalue");
          }
      }
  }
  </code></pre>
  
  <p><strong>Edit Code</strong></p>
  
  <p>I have modified my security.xml file and class file</p>
  
  <pre><code>&lt;custom-filter ref="authenticationFilter" after="FORM_LOGIN_FILTER "/&gt;  
  </code></pre>
  
  <pre class="lang-java prettyprint-override"><code>public class CustomAuthorizationFilter extends GenericFilterBean {
  
      /*
       * ServletRequestAttributes attr = (ServletRequestAttributes)
       * RequestContextHolder.currentRequestAttributes(); HttpSession
       * session=attr.getRequest().getSession(true);
       */
      @Autowired
      private UserService userService;
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response,
              FilterChain chain) throws IOException, ServletException {
  
          try {
              chain.doFilter(request, response);
  
                      HttpServletRequest req = (HttpServletRequest) request;
                      HttpSession session = req.getSession(true);
                      Authentication authentication = SecurityContextHolder
                              .getContext().getAuthentication();
                      Set&lt;String&gt; roles = AuthorityUtils
                              .authorityListToSet(authentication.getAuthorities());
                      User user = null;                   
                          if (true) {
                              session.setAttribute("Flag", "Y");
                          } 
              }
  
          } catch (IOException ex) {
              throw ex;
          }
      }
  
  }
  </code></pre>
  
  <p>Which invokes each and every URL. Is it any alternative to call filter method only once when a user is authenticated?</p>