`HiddenHttpMethodFilter` configuration in the `hello-mvc-security` example project?

Inquiry about the HiddenHttpMethodFilter configuration in the hello-mvc-security example project

Hello,

In the hello-mvc-security example project, to use the HiddenHttpMethodFilter correctly, wouldn’t it be better to place this filter before the Spring Security Filter?

• https://github.com/spring-projects/spring-security-samples/blob/main/servlet/java-configuration/hello-mvc-security/src/main/java/example/MvcWebApplicationInitializer.java#L43

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
  ...
  // ✨  I am inquiring whether additional configuration is necessary?”
  @Override
  protected void beforeSpringSecurityFilterChain(ServletContext servletContext) {
    FilterRegistration.Dynamic encodingFilter =
        servletContext.addFilter("hiddenHttpMethodFilter", new HiddenHttpMethodFilter());
    encodingFilter.addMappingForUrlPatterns(
        null, false, "/*");
  }
}

If the HiddenHttpMethodFilter is not placed before the security filter, there have been times when setting up requestMatchers() resulted in unintended behavior.

For example, after setting the hidden input below in the form…

...
<input type="hidden" name="_method" value="DELETE"/>
...

If the requestMatchers() configuration is set up as follows…

...
.requestMatchers(HttpMethod.DELETE, "/targetUrl/*")
.hasAuthority("ADMIN")
...

There were times when it didn't work as I intended.
When I requested deletion with "USER" permission, it was deleted.

Even so, since there are no web pages in the hello-mvc-security example project that utilize the HiddenHttpMethodFilter, it seems that it might be okay to remove the HiddenHttpMethodFilter.

Inquiry Summary

1. Wouldn’t it be better to remove the HiddenHttpMethodFilter configuration from the security settings of the hello-mvc-security example project?
2. If not removed, shouldn’t the HiddenHttpMethodFilter be positioned before the SpringSecurityFilterChain?

Thank you. Have a great day. 👍

Start with servlet/java-configuration/hello-mvc-security/src/main/java/example/MvcWebApplicationInitializer.java and trace registration order for HiddenHttpMethodFilter relative to the Spring Security filter chain. Reproduce the shown DELETE requestMatchers scenario, then determine whether the example should remove the filter or register it before security; done means the example configuration behaves consistently with its authorization rules.