How to Autowire a Spring Bean in a Servlet Filter

1. Introduction

Servlet filters offer a powerful mechanism for intercepting and manipulating incoming requests. However, accessing Spring-managed beans within these filters can pose a challenge.

In this tutorial, we’ll explore various approaches to seamlessly obtain Spring beans within a Servlet filter, which is a common requirement in Spring-based web applications.

2. Understanding the Limitations of @Autowired in Servlet Filter

While Spring’s dependency injection mechanism, @Autowired, is a convenient way to inject dependencies into Spring-managed components, it doesn’t work seamlessly with Servlet filters. This is because Servlet filters are initialized by the Servlet container, typically before Spring’s ApplicationContext is fully loaded and initialized.

As a result, when the container instantiates a Servlet filter, the Spring context may not yet be available, leading to null or uninitialized dependencies when attempting to use @Autowired annotations. Let’s explore alternative approaches for accessing Spring beans within Servlet filters.

3. Setup

Let’s create a common LoggingService that will be autowired into our filter:

@Service
public class LoggingService {
    private final Logger logger = LoggerFactory.getLogger(this.getClass());
    public void log(String message,String url){
        logger.info("Logging Request {} for URI : {}",message,url);
    }
}

We’ll then create our filter, which will intercept incoming HTTP requests to log the HTTP method and URI details using the LoggingService dependency:

@Component
public class LoggingFilter implements Filter {
    @Autowired
    LoggingService loggingService;
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) 
      throws IOException, ServletException {
        HttpServletRequest httpServletRequest=(HttpServletRequest)servletRequest;
        loggingService.log(httpServletRequest.getMethod(),httpServletRequest.getRequestURI());
        filterChain.doFilter(servletRequest,servletResponse);
    }
}

Let’s expose a RestController that returns a list of users:

@RestController
public class UserController {
    @GetMapping("/users")
    public List<User> getUsers(){
        return Arrays.asList(new User("1","John","john@email.com"),
          new User("2","Smith","smith@email.com"));
    }
}

We’ll set up our test to check if our LoggingService was autowired successfully into our filter:

@RunWith(SpringRunner.class)
@SpringBootTest
public class LoggingFilterTest {
    @Autowired
    private LoggingFilter loggingFilter;
    @Test
    public void givenFilter_whenAutowired_thenDependencyInjected() throws Exception {
        Assert.assertNotNull(loggingFilter);
        Assert.assertNotNull(getField(loggingFilter,"loggingService"));
    }
    private Object getField(Object target, String fieldName) throws NoSuchFieldException, IllegalAccessException {
        Field field = target.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        return field.get(target);
    }
}

However, at this stage, it’s possible that the LoggingService won’t be injected into the LoggingFilter because the Spring context wasn’t available yet. We’ll explore the various options for resolving this issue in the following sections.

4. Using SpringBeanAutowiringSupport in Servlet Filter

Spring’s SpringBeanAutowiringSupport class provides support for dependency injection into non-Spring-managed classes such as Filters and Servlets. By using this class, Spring can inject dependencies, such as the LoggingService, which is a Spring-managed bean, into the LoggingFilter.

The init method is used to initialize a Filter instance, and we’ll override this method in the LoggingFilter to use SpringBeanAutowiringSupport:

@Override
public void init(FilterConfig filterConfig) throws ServletException {
    SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this,
      filterConfig.getServletContext());
}

The processInjectionBasedOnServletContext method uses the ApplicationContext associated with the ServletContext to perform the autowiring. It first retrieves the ApplicationContext from the ServletContext and then uses it to autowire the dependencies into the target object. This process involves inspecting the target object’s fields for @Autowired annotations and then resolving and injecting the corresponding beans from the ApplicationContext.

This mechanism allows non-Spring-managed objects, like filters and servlets, to benefit from Spring’s dependency injection capabilities.

5. Using WebApplicationContextUtils in Servlet Filter

WebApplicationContextUtils provides a utility method that retrieves the ApplicationContext associated with the ServletContext. The ApplicationContext contains all the beans managed by the Spring container.

Let’s override the init method of the LoggingFilter class:

@Override
public void init(FilterConfig filterConfig) throws ServletException {
    loggingService = WebApplicationContextUtils
      .getRequiredWebApplicationContext(filterConfig.getServletContext())
      .getBean(LoggingService.class);
}

We retrieve an instance of LoggingService from the ApplicationContext and assign it to the loggingService field of the filter. This approach is useful when we need to access Spring-managed beans in a non-Spring-managed component, such as a Servlet or a Filter, and we cannot use annotation-based or constructor injection.

It should be noted that this approach tightly couples the filter with Spring, which may not be ideal in some cases.

6. Using FilterRegistrationBean in Configuration

FilterRegistrationBean is used to register Servlet filters in the servlet container programmatically. It provides a way to configure the filter registration dynamically in the application’s configuration classes.

By annotating the method with @Bean and @Autowired, the LoggingService is automatically injected into the method, allowing it to be passed to the LoggingFilter constructor. Let’s set up the method for FilterRegistrationBean in our config class:

@Bean
public FilterRegistrationBean<LoggingFilter> loggingFilterRegistration(LoggingService loggingService) {
    FilterRegistrationBean<LoggingFilter> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new LoggingFilter(loggingService));
    registrationBean.addUrlPatterns("/*");
    return registrationBean;
}

We’ll then include a constructor in our LoggingFilter to support the above configuration:

public LoggingFilter(LoggingService loggingService) {
    this.loggingService = loggingService;
}

This approach centralizes the configuration of filters and their dependencies, making the code more organized and easier to maintain.

7. Using DelegatingFilterProxy in Servlet Filter

The DelegatingFilterProxy is a Servlet filter that allows passing control to Filter classes that have access to the Spring ApplicationContext.

Let’s configure the DelegatingFilterProxy to delegate to a Spring-managed bean named “loggingFilter”. FilterRegistrationBean is used by Spring to register the filter with the Servlet container when the application starts up:

@Bean
public FilterRegistrationBean<DelegatingFilterProxy> loggingFilterRegistration() {
    FilterRegistrationBean<DelegatingFilterProxy> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new DelegatingFilterProxy("loggingFilter"));
    registrationBean.addUrlPatterns("/*");
    return registrationBean;
}

Let’s use the same bean name for our filter defined earlier:

@Component("loggingFilter")
public class LoggingFilter implements Filter {
    // standard methods
}

This approach allows us to use Spring’s dependency injection to manage the loggingFilter bean.

8. Comparing Dependency Injection Approaches in Servlet Filter

The DelegatingFilterProxy approach differs from both SpringBeanAutowiringSupport and the direct use of WebApplicationContextUtils in how it delegates the filter’s execution to a Spring-managed bean, allowing us to use Spring’s dependency injection.

The DelegatingFilterProxy is better aligned with the typical Spring application architecture and allows for a cleaner separation of concerns. The FilterRegistrationBean approach allows more control over the dependency injection of the filter and centralizes the configuration of dependencies.

In contrast, SpringBeanAutowiringSupport and WebApplicationContextUtils are more low-level approaches that can be useful in certain scenarios where we need more control over the filter’s initialization process or want to access the ApplicationContext directly. However, they require more manual setup and do not provide the same level of integration with Spring’s dependency injection mechanism.

9. Conclusion

In this article, we’ve explored the different approaches to autowire Spring beans into Servlet Filters. Each approach has its advantages and limitations, and the choice of approach depends on the specific requirements and constraints of the application. Overall, they enable seamless integration of Spring-managed beans into Servlet filters, enhancing the flexibility and maintainability of applications.

As always, the code is available over on GitHub.