@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {

    // Lazily initialize the delegate if necessary.
    Filter delegateToUse = this.delegate;
    if (delegateToUse == null) {
        synchronized (this.delegateMonitor) {
            delegateToUse = this.delegate;
            if (delegateToUse == null) {
                // 获取应用上下文
                WebApplicationContext wac = findWebApplicationContext();
                if (wac == null) {
                    throw new IllegalStateException("No WebApplicationContext found: " +
                            "no ContextLoaderListener or DispatcherServlet registered?");
                }
                // 从应用上下文中找过滤器代理
                delegateToUse = initDelegate(wac);
            }
            // 保存下来，下次就不用再找了
            this.delegate = delegateToUse;
        }
    }

    // Let the delegate perform the actual doFilter operation.
    // 调用目标过滤器
    invokeDelegate(delegateToUse, request, response, filterChain);
}

protected void invokeDelegate(
        Filter delegate, ServletRequest request, ServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {

    delegate.doFilter(request, response, filterChain);
}

/*
 * 该类型的实例在WebSecurity的performBuild()方法中被创建，
 * 被WebSecurityConfiguration中的springSecurityFilterChain()方法注入到容器中（该filter bean的名称为springSecurityFilterChain），
 * 该方法在DelegatingFilterProxy中的invokeDelegate()方法中被调用
 */
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;
    if (!clearContext) { // 已经设置过了FILTER_APPLIED属性，为什么已经设置过了该属性的的请求还会被该过滤器处理？
        // 执行过滤器
        doFilterInternal(request, response, chain);
        return;
    }
    try {
        request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
        // 执行过滤器
        doFilterInternal(request, response, chain);
    }
    catch (Exception ex) {
        Throwable[] causeChain = this.throwableAnalyzer.determineCauseChain(ex);
        Throwable requestRejectedException = this.throwableAnalyzer
            .getFirstThrowableOfType(RequestRejectedException.class, causeChain);
        if (!(requestRejectedException instanceof RequestRejectedException)) {
            throw ex;
        }
        // 拒绝处理
        this.requestRejectedHandler.handle((HttpServletRequest) request, (HttpServletResponse) response,
                (RequestRejectedException) requestRejectedException);
    }
    finally {
        this.securityContextHolderStrategy.clearContext();
        request.removeAttribute(FILTER_APPLIED);
    }
}

private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest) request);
    HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse) response);
    // 获取目标过滤器集合
    List<Filter> filters = getFilters(firewallRequest);
    if (filters == null || filters.size() == 0) {
        if (logger.isTraceEnabled()) {
            logger.trace(LogMessage.of(() -> "No security for " + requestLine(firewallRequest)));
        }
        firewallRequest.reset();
        this.filterChainDecorator.decorate(chain).doFilter(firewallRequest, firewallResponse);
        return;
    }
    if (logger.isDebugEnabled()) {
        logger.debug(LogMessage.of(() -> "Securing " + requestLine(firewallRequest)));
    }
    // 封装了后续其他的servlet过滤器
    FilterChain reset = (req, res) -> {
        if (logger.isDebugEnabled()) {
            logger.debug(LogMessage.of(() -> "Secured " + requestLine(firewallRequest)));
        }
        // Deactivate path stripping as we exit the security filter chain
        firewallRequest.reset();
        // 继续调用后续的servlet filter
        chain.doFilter(req, res);
    };
    // filterChainDecorator是VirtualFilterChain类型的
    this.filterChainDecorator.decorate(reset, filters).doFilter(firewallRequest, firewallResponse);
}

private List<Filter> getFilters(HttpServletRequest request) {
    int count = 0;
    // 遍历过滤器链
    for (SecurityFilterChain chain : this.filterChains) {
        if (logger.isTraceEnabled()) {
            logger.trace(LogMessage.format("Trying to match request against %s (%d/%d)", chain, ++count,
                    this.filterChains.size()));
        }
        // 如果该过滤器链支持处理该请求，那么则返回该过滤器链上的所有过滤器
        if (chain.matches(request)) {
            // 找到一个就直接返回
            return chain.getFilters();
        }
    }
    return null;
}

@SuppressWarnings("unchecked")
@Override
protected DefaultSecurityFilterChain performBuild() {
    // URL表达式授权配置器
    ExpressionUrlAuthorizationConfigurer<?> expressionConfigurer = getConfigurer(
            ExpressionUrlAuthorizationConfigurer.class);
    // http授权配置器
    AuthorizeHttpRequestsConfigurer<?> httpConfigurer = getConfigurer(AuthorizeHttpRequestsConfigurer.class);
    // 这里使用了异或运算符(^)
    boolean oneConfigurerPresent = expressionConfigurer == null ^ httpConfigurer == null;
    // 如果都为null或都不为null，则断言失败，请选一个使用
    Assert.state((expressionConfigurer == null && httpConfigurer == null) || oneConfigurerPresent,
            "authorizeHttpRequests cannot be used in conjunction with authorizeRequests. Please select just one.");

    // 对过滤器进行排序
    this.filters.sort(OrderComparator.INSTANCE);
    List<Filter> sortedFilters = new ArrayList<>(this.filters.size());
    for (Filter filter : this.filters) {
        // 添加到列表中
        sortedFilters.add(((OrderedFilter) filter).filter);
    }
    // 创建过滤器链
    return new DefaultSecurityFilterChain(this.requestMatcher, sortedFilters);
}

public static final class VirtualFilterChainDecorator implements FilterChainDecorator {

    /**
     * {@inheritDoc}
     */
    @Override
    public FilterChain decorate(FilterChain original) {
        return original;
    }

    /**
     * {@inheritDoc}
     */
    @Override
    public FilterChain decorate(FilterChain original, List<Filter> filters) {
        return new VirtualFilterChain(original, filters);
    }

}

private static final class VirtualFilterChain implements FilterChain {

    // 其他的servlet上下文中的过滤器
    private final FilterChain originalChain;

    // Spring Security中的过滤器列表
    private final List<Filter> additionalFilters;

    private final int size;

    private int currentPosition = 0;

    private VirtualFilterChain(FilterChain chain, List<Filter> additionalFilters) {
        this.originalChain = chain;
        this.additionalFilters = additionalFilters;
        this.size = additionalFilters.size();
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
        // 如果已经执行完security相关的过滤器
        if (this.currentPosition == this.size) {
            // 则让其他servlet的filter被执行
            this.originalChain.doFilter(request, response);
            return;
        }
        this.currentPosition++;
        // 获取下一个待执行的过滤器
        Filter nextFilter = this.additionalFilters.get(this.currentPosition - 1);
        if (logger.isTraceEnabled()) {
            String name = nextFilter.getClass().getSimpleName();
            logger.trace(LogMessage.format("Invoking %s (%d/%d)", name, this.currentPosition, this.size));
        }
        // 调用过滤器，并传入this作为过滤器链，过滤器内部可以决定要不要执行后面的其他过滤器。
        nextFilter.doFilter(request, response, this);
    }

}