SS常见的使用场景之一就是表单登陆了，而登陆校验主要是通过过滤器来实现的。这里的代码使用了过滤器设计模式，将一系列的过滤器按顺序准备好，依次进行过滤。下面来看下具体的实现流程吧！
首先看下过滤器链的核心：FilterChainProxy
它内部包含一个内部类VirtualFilterChain：
VirtualFilterChain vfc = new VirtualFilterChain(fwRequest, chain, filters);
vfc.doFilter(fwRequest, fwResponse);这里的过滤方法是调用此内部类的doFilter（）方法：
public void doFilter(ServletRequest request, ServletResponse response)
throws IOException, ServletException {
if (currentPosition == size) {
if (logger.isDebugEnabled()) {
logger.debug(UrlUtils.buildRequestUrl(firewalledRequest)
+ " reached end of additional filter chain; proceeding with original chain");
}
// Deactivate path stripping as we exit the security filter chain
this.firewalledRequest.reset();
originalChain.doFilter(request, response);
}
else {
currentPosition++;
Filter nextFilter = additionalFilters.get(currentPosition - 1);
if (logger.isDebugEnabled()) {
logger.debug(UrlUtils.buildRequestUrl(firewalledRequest)
+ " at position " + currentPosition + " of " + size
+ " in additional filter chain; firing Filter: '"
+ nextFilter.getClass().getSimpleName() + "'");
}
nextFilter.doFilter(request, response, this);
}
}可以看到，currentPosition代表当前处理的过滤器链List<Filter> additionalFilters的索引，由第一个开始，若未到达最后一个过滤器，则currentPosition++，继续处理
debug看到过滤器链如下（由于上传图片异常）：
[org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@9e59000,
org.springframework.security.web.context.SecurityContextPersistenceFilter@6124add8,
org.springframework.security.web.header.HeaderWriterFilter@32c8408f,
org.springframework.security.web.authentication.logout.LogoutFilter@c187cf1,
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@bd732bf,
com.ctrip.framework.apollo.portal.spi.springsecurity.um.UmUserPwdAuthenticationFilter@3b150949,
org.springframework.security.web.authentication.www.BasicAuthenticationFilter@4d04219f,
org.springframework.security.web.savedrequest.RequestCacheAwareFilter@22beacf1,
org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@7501bb71,
org.springframework.security.web.authentication.AnonymousAuthenticationFilter@6e1c0e52,
org.springframework.security.web.session.SessionManagementFilter@39c396b,
org.springframework.security.web.access.ExceptionTranslationFilter@7c08314d,
org.springframework.security.web.access.intercept.FilterSecurityInterceptor@455e1838]其中，这里关注的是：
