How to define servlet filter order of execution using annotations in WAR

Question

If we define webapp specific servlet filters in WAR's own web.xml, then the order of execution of the filters will be the same as the order in which they are defined in the web.xml.

But, if we define those filters using @WebFilter annotation, what is the order of execution of filters, and how can we determine the order of execution?

Solution 1

You can indeed not define the filter execution order using @WebFilter annotation. However, to minimize the web.xml usage, it's sufficient to annotate all filters with just a filterName so that you don't need the <filter> definition, but just a <filter-mapping> definition in the desired order.

For example,

@WebFilter(filterName="filter1")
public class Filter1 implements Filter {}

@WebFilter(filterName="filter2")
public class Filter2 implements Filter {}

with in web.xml just this:

<filter-mapping>
    <filter-name>filter1</filter-name>
    <url-pattern>/url1/*</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>filter2</filter-name>
    <url-pattern>/url2/*</url-pattern>
</filter-mapping>

If you'd like to keep the URL pattern in @WebFilter, then you can just do like so,

@WebFilter(filterName="filter1", urlPatterns="/url1/*")
public class Filter1 implements Filter {}

@WebFilter(filterName="filter2", urlPatterns="/url2/*")
public class Filter2 implements Filter {}

but you should still keep the <url-pattern> in web.xml, because it's required as per XSD, although it can be empty:

<filter-mapping>
    <filter-name>filter1</filter-name>
    <url-pattern />
</filter-mapping>
<filter-mapping>
    <filter-name>filter2</filter-name>
    <url-pattern />
</filter-mapping>

Regardless of the approach, this all will fail in Tomcat until version 7.0.28 because it chokes on presence of <filter-mapping> without <filter>. See also Using Tomcat, @WebFilter doesn't work with <filter-mapping> inside web.xml

Solution 2

The Servlet 3.0 spec doesn't seem to provide a hint on how a container should order filters that have been declared via annotations. It is clear how about how to order filters via their declaration in the web.xml file, though.

Be safe. Use the web.xml file order filters that have interdependencies. Try to make your filters all order independent to minimize the need to use a web.xml file.

Comments

[siva636]

I have many Servlet filters in my project, out of them only a particular filter must be called first and order of other filters not a concern. Do I have to defile all filters in web.xml? Or are there any short-cuts?

[Bozho]

they could've introduced an order attribute of a nested @WebFilterMapping annotation. I wonder whether the didn't do it for simplicity

[BalusC]

@Bozho: That would not be specific enough. What if your webapp ships with 3rd party libraries which includes a filter? It's hard to tell its order beforehand.

[AndrewBourgeois]

@BalusC: Something went wrong in your example: url-pattern is closed with a filter-name.

[BalusC]

@AndrewBourgeois: Fixed. Was an copypaste error. Too bad that Markdown editor doesn't have builtin XML validation like as in Eclipse ;)

[AndrewBourgeois]

@BalusC: In the end this doesn't work for me, see this question: stackoverflow.com/questions/10856866/…

[djmj]

An annotation similar to @DependsOn for EJB would be great. I am not 100% sure but in glassfish with mojarra the url-pattern in xml can be left empty so that the patterns can still be defined via annotation.

[BalusC]

@Craig: you apparently never tried his answer. His answer does not work at all. The <absolute-ordering> has a completely different purpose. It's completely beyond me why it's currently on 12 votes.

[BalusC]

@djmj: that would be illegal syntax according XSD of web.xml.

[djmj]

I meant empty not leaving it.

[seanf]

Using <url-pattern /> doesn't work on JBoss EAP 6.1 - it overrides the @WebFilter value and prevents the filter from running at all.

[Dejell]

@BalusC has anything changed in tomcat 8?

[Yubaraj]

@BalusC what if I want to filter all url patterns except one? Eg. I don't want to use filter for my /welcome url pattern.

[nacho4d]

I wish there was an easier way. Jersey seems to solve something like this in a smarter way via javax.annotation.Priority. See Jersey Filters and Interceptors documentation

[eastwater]

It is not working in tomcat10.