Currently SpnegoAuthenticationProcessingFilter.doFilter() is doing
if (header != null && (header.startsWith("Negotiate ") || header.startsWith("Kerberos "))) {
...
if (successHandler != null) {
successHandler.onAuthenticationSuccess(request, response, authentication);
}
}
chain.doFilter(request, response);
when successHandler is SimpleUrlAuthenticationSuccessHandler, the success handler will commit the response thus continuing the filter chain will fail with "IllegalStateException Committed" if a downstream filter calls response.send*()