.addFilterAfter(filter, SecurityContextHolderFilter.class) does not work properly

[ReXtrem]

As SecurityContextPersistenceFilter is deprecated and replaced by SecurityContextHolderFilter I would expect the Filter structure is setup equally to it.

Unfortunate I cam across this weird issue when you try to add a custom authentication for a stateless application context:

SecurityContextHolder.getContext().setAuthentication(authentication);

always get's reset because of the SecurityContextPersistenceFilter kicking in before:

Even if I define my "filter" to run after SecurityContextHolderFilter

.addFilterAfter(myFilter, SecurityContextHolderFilter.class)

The chain is setup like this:

Will secure any request with filters: DisableEncodeUrlFilter, WebAsyncManagerIntegrationFilter, MyFilter, SecurityContextPersistenceFilter, ...

If I use the deprecated:

.addFilterAfter(authenticationFilter, SecurityContextPersistenceFilter.class)

The filter chain is correct:

Will secure any request with filters: DisableEncodeUrlFilter, WebAsyncManagerIntegrationFilter, SecurityContextPersistenceFilter, MyFilter, ...

Spring-Boot version: 3.4.4

[snicoll]

Please review the guidelines for contributing and open an issue in the appropriate project, if necessary.