The FilterChainProxy class

When working in conjunction with Spring Security, o.s.web.filter.DelegatingFilterProxy will delegate to the o.s.s.web.FilterChainProxy interface of Spring Security, which was created in our minimal security.xml file. The FilterChainProxy class allows Spring Security to conditionally apply any number of Servlet Filters to the servlet request. We will learn more about each of the Spring Security filters, and their roles in ensuring that our application is properly secured, throughout the rest of the book. The pseudocode for how FilterChainProxy works are as follows:

    public class FilterChainProxy implements Filter {
  void doFilter(request, response, filterChain) {
    // lookup all the Filters for this request
    List<Filter> delegates = 
      lookupDelegates(request,response)
    // invoke each filter unless the delegate decided to stop
    for delegate in delegates {
      if continue processing
        delegate.doFilter(request,response,filterChain)
    }
    // if all the filters decide it is ok allow the 
    // rest of the application to run
    if continue processing
      filterChain.doFilter(request,response)
  }
    }

Due to the fact that both DelegatingFilterProxy and FilterChainProxy are the front door to Spring Security, when used in a web application, you would add a debug point when trying to figure out what is happening.