DelegatingFilterProxy is a standard Servlet Filter that acts as a bridge between the Servlet container and the Spring application context.
It does no filtering itself. Instead, it looks up a Spring-managed bean that implements the Filter interface (jakarta.servlet.Filter in current Spring versions) and delegates each request to it.
This matters because a filter registered directly with the container is created by the container, not by Spring, so it cannot use dependency injection. With DelegatingFilterProxy, the real filter is an ordinary Spring bean, so it can be injected with other beans (such as services) and take part in the Spring bean lifecycle.
The bean to delegate to is identified by the proxy's targetBeanName property. If this property is not set, the proxy uses its own filter name as the bean name.
Let's see an example of how to use it.
Example
A Spring bean implementing Servlet Filter
package com.logicbig.example;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.FilterConfig;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletRequest;
import java.io.IOException;
@Component("myTestFilter")
public class MyFilter implements Filter {
@Autowired
private MyService myService;
@Override
public void init (FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter (ServletRequest request, ServletResponse response,
FilterChain chain)
throws IOException, ServletException {
System.out.println("-- In MyFilter --");
HttpServletRequest req = (HttpServletRequest) request;
myService.doSomething(req);
chain.doFilter(request, response);
}
@Override
public void destroy () {
}
}
package com.logicbig.example;
import org.springframework.stereotype.Component;
import org.springframework.stereotype.Service;
import jakarta.servlet.http.HttpServletRequest;
@Service
public class MyService {
public void doSomething (HttpServletRequest req) {
System.out.println("In MyService: " + req.getRequestURI());
}
}
Java configuration class
package com.logicbig.example;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
@EnableWebMvc
@Configuration
@ComponentScan
public class MyWebConfig {
}
Registering DelegatingFilterProxy
package com.logicbig.example;
import org.springframework.web.filter.DelegatingFilterProxy;
import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
import jakarta.servlet.Filter;
public class AppInitializer extends
AbstractAnnotationConfigDispatcherServletInitializer {
.............
@Override
protected Filter[] getServletFilters () {
DelegatingFilterProxy filterProxy = new DelegatingFilterProxy();
filterProxy.setTargetBeanName("myTestFilter");
return new Filter[]{filterProxy};
}
.............
}
The targetBeanName must match the name of the Spring bean, which is myTestFilter in this example. Filters returned from getServletFilters() are registered by Spring and mapped to the DispatcherServlet.
A Controller
package com.logicbig.example;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
@RequestMapping("/test")
public class MyController {
@RequestMapping
@ResponseBody
public String handleRequest () {
System.out.println("-- handling request in controller --");
return "dummy response";
}
}
To try examples, run embedded Jetty (configured in pom.xml of example project below):
mvn jetty:run Output
$ curl -s "http://localhost:8080/test"
dummy response
Server Output
-- In MyFilter --
In MyService: /test
-- handling request in controller --
Things to know
- Context lookup: the proxy looks for the target bean in the root
WebApplicationContext first. If the application has no root context, it falls back to the single DispatcherServlet context, which is why this example works with getRootConfigClasses() returning null. In applications with a root context or several servlets, define the filter bean in the root configuration so the lookup is unambiguous.
For example:
com.logicbig.example.core: MyFilter, MyService, MyRootConfig
com.logicbig.example.web: MyController, MyWebConfig
@EnableWebMvc
@Configuration
@ComponentScan("com.logicbig.example.web")
public class MyWebConfig {
}
@Configuration
@ComponentScan("com.logicbig.example.core")
public class MyRootConfig {
}
public class AppInitializer extends
AbstractAnnotationConfigDispatcherServletInitializer {
@Override
protected Class<?>[] getRootConfigClasses () {
return new Class<?>[]{MyRootConfig.class};
}
@Override
protected Class<?>[] getServletConfigClasses () {
return new Class<?>[]{MyWebConfig.class};
}
@Override
protected Filter[] getServletFilters () {
return new Filter[]{
new DelegatingFilterProxy("myTestFilter")};
}
@Override
protected String[] getServletMappings () {
return new String[]{"/"};
}
}
- Lifecycle: by default, Spring manages the target bean's lifecycle, so the container does not call the delegate's
init() and destroy(). To have them called, set targetFilterLifecycle to true.
- Shorter form: the constructor
new DelegatingFilterProxy("myTestFilter") sets the target bean name in one step.
- Spring Boot: you normally don't need this. Boot registers any
Filter bean automatically; use FilterRegistrationBean to control the URL patterns and order. For a lazily resolved delegate, Boot provides DelegatingFilterProxyRegistrationBean.
- Spring Security: the same mechanism is used to plug in the
springSecurityFilterChain bean.
Example ProjectDependencies and Technologies Used: - spring-webmvc 7.0.6 (Spring Web MVC)
Version Compatibility: 4.2.0.RELEASE - 7.0.6 Version compatibilities of spring-webmvc with this example: Versions in green have been tested.
- jakarta.servlet-api 6.1.0 (Jakarta Servlet API documentation)
- JDK 25
- Maven 3.9.11
|
