正常情況下，我們需要新增一個過濾器，需要實現javax.servlet.Filter介面，再在web.xml中配置filter，如下：

package cc.eabour.webapp.security.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
 
import javax.servlet.ServletResponse;

public class XssFilter implements Filter {

    private String enable = null;
    
    public void init(FilterConfig filterConfig) throws ServletException {
        // Auto-generated method stub
        enable = filterConfig.getInitParameter("enable");
    }

    
 
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // Auto-generated method stub
        // Do XSS Filter (WrapperRequest)
        chain.doFilter(request, response);
    }

    public void destroy() {
        
 
// TODO Auto-generated method stub
        
    }

}

此時，web.xml中增加的配置：

    <filter>
        <filter-name>xssFilter</filter-name>
        <filter-class>cc.eabour.webapp.security.filter.XssFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>xssFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

　　那麼，我們為什麼要使用Spring的org.springframework.web.filter.DelegatingFilterProxy類呢？其中，最主要的目的還是我們新增的過濾器，需要使用spring中的某些bean，即委託Spring來管理過濾器的生命週期。當然，使用了這個代理類，需要設定引數targetFilterLifecycle為true才能讓spring來管理，否則就是一個正常的filter，其生命週期會被servlet容器管理。配置如下：

package cc.eabour.webapp.security.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import cc.eabour.webapp.service.IResourceService;

@Service("securityXssFilter")
public class XssFilter implements Filter {

    private String enable = null;
    
    @Autowired
    private IResourceService reosurceService;
    
    
    public void init(FilterConfig filterConfig) throws ServletException {
        // Auto-generated method stub
        enable = filterConfig.getInitParameter("enable");
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // Auto-generated method stub
        // Do XSS Filter (WrapperRequest)
        reosurceService.work();
        chain.doFilter(request, response);
    }

    public void destroy() {
        // TODO Auto-generated method stub
        
    }

}

 web.xml配置：

    <filter>
        <filter-name>securityXssFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- 可以新增自定義引數 -->
        <init-param>
            <param-name>enable</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>securityXssFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

　　Spring在初始化過濾器的時候，會根據過濾器的名稱去尋找對應代理的過濾器，也可以通過引數targetBeanName引數來制定對應的過濾器bean名稱。如果把初始化引數targetFilterLifecycle修改為false或不新增，則代理的過濾器為普通的，不受Spring管理。

　　以下為摘自Spring的文件：

Proxy for a standard Servlet Filter, delegating to a Spring-managed bean that implements the Filter interface. Supports a "targetBeanName" filter init-param in web.xml, specifying the name of the target bean in the Spring application context.

web.xml will usually contain a DelegatingFilterProxy definition, with the specified filter-name corresponding to a bean name in Spring's root application context. All calls to the filter proxy will then be delegated to that bean in the Spring context, which is required to implement the standard Servlet Filter interface.

 

This approach is particularly useful for Filter implementation with complex setup needs, allowing to apply the full Spring bean definition machinery to Filter instances. Alternatively, consider standard Filter setup in combination with looking up service beans from the Spring root application context.

 

NOTE: The lifecycle methods defined by the Servlet Filter interface will by default not be delegated to the target bean, relying on the Spring application context to manage the lifecycle of that bean. Specifying the "targetFilterLifecycle" filter init-param as "true" will enforce invocation of the Filter.init and Filter.destroy lifecycle methods on the target bean, letting the servlet container manage the filter lifecycle.