Sorting RememberMeAuthenticationFilter

[daromnik]

Hello.

I noticed this situation with the RememberMeAuthenticationFilter filter.

When the application is launched, this filter appears at the end of the filter chain.

1 = "WebAsyncManagerIntegrationFilter"
2 = "SecurityContextPersistenceFilter"
3 = "HeaderWriterFilter"
4 = "LogoutFilter"
5 = "BasicAuthenticationFilter"
6 = "SecuritySaveContextFilter"
7 = "CachedSessionFilter"
8 = "RequestCacheAwareFilter"
9 = "SecurityContextHolderAwareRequestFilter"
10 = "RememberMeAuthenticationFilter"
11 = "AnonymousAuthenticationFilter"
...

In the FilterOrderRegistration class, its sorting is 3000, so it never gets to its turn.
Although it should go somewhere at the beginning after LogoutFilter.
Is this normal behavior?
I did not find any ways to change the sorting of RememberMeAuthenticationFilter.

[kse-music]

If you must do it, I think you can do like this

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        DefaultSecurityFilterChain chain = http
                .authorizeHttpRequests(c -> c.anyRequest().permitAll())
                .rememberMe(Customizer.withDefaults())
                .build();
        List<Filter> filters = new ArrayList<>(chain.getFilters().size());
        for (Filter filter : chain.getFilters()) {
            if (filter instanceof RememberMeAuthenticationFilter) {
                filters.add(7, filter);//set position
                continue;
            }
            filters.add(filter);
        }
        return new DefaultSecurityFilterChain(chain.getRequestMatcher(), filters);
    }

[daromnik]

I can change it programmatically, I agree, but I wonder why this filter appears at the end of the list by default, maybe it's a bug?