Spring Security Filter Architecture
Spring Security is implemented as a chain of Servlet Filters. Every HTTP request passes through this chain before reaching any controller. Each filter has a specific responsibility: token extraction, authentication, authorization, CSRF protection, session management, and so on. Understanding the chain explains why security works the way it does and how to extend it.