I think you are talking about the spring security filter chain.
Filters with these names must be called before UsernamePasswordAuthenticationFilter
- FIRST
- CHANNEL_FILTER,
- CONCURRENT_SESSION_FILTER,
- SECURITY_CONTEXT_FILTER,
- LOGOUT_FILTER,
- X509_FILTER,
- PRE_AUTH_FILTER,
- CAS_FILTER,
. org.springframework.security.config.http.SecurityFilters.
before:
<security:custom-filter ref="myFiler" before="FORM_LOGIN_FILTER" />