Add support for CharacterEncodingFilter

[markus-s24]

Summary

Add support for easy configuration of CharacterEncodingFilter with SpringSecurity.

Actual Behavior

When enabling Spring Security, the CharacterEncodingFilter configured via the web.xml has no effect, because it should be the first filter. But Spring Security inserts itself as first. So one has to register CharacterEncodingFilter via the HttpSecurityBuilder which does not know about the order of the CharacterEncodingFilter. So one has to manually add the filter before the first filter of Spring Security.

Expected Behavior

Adding the CharacterEncodingFilter via HttpSeucrityBuilder.addFilter knows about the order for this filter and adds it to the first position.

Maybe there is an even better solution using Spring Web only for configuration. But this is the solution which works for me.

Configuration

Spring Web with Spring Security.

Version

Spring 4.3.8.RELEASE with Spring Security 4.2.2.RELEASE.

Sample

public class MySecurityConfig extends WebSecurityConfigurerAdapter {
   protected void configure(HttpSecurity http) throws Exception {
      # Actual behaviour:
      http.addFilterBefore(characterEncodingFilter(), ChannelProcessingFilter.class);
      # Expected behaviour:
      http.addFilter(characterEncodingFilter());
   }
}

[rwinch]

When enabling Spring Security, the CharacterEncodingFilter configured via the web.xml has no effect, because it should be the first filter.

This is not strictly true. It makes sense to have filters like CharacterEncodingFilter, OpenEntityManagerInViewFilter, etc before Spring Security's filter chain.

So the preferred solution in this case is to register CharacterEncodingFilter before springSecurityFilterChain.

I'm going to close this, but feel free to reopen if you have additional questions / concerns.