AuthenticationWebFilter executes filter chain twice per request

[jdolan-chwy]

I've noticed this for some time in my application logs and thought I was just misconfiguring Spring Security WebFlux somehow. But upon closer examination, I think there's a bug in AuthenticationWebFilter that causes this behavior:

spring-security/web/src/main/java/org/springframework/security/web/server/authentication/AuthenticationWebFilter.java

Line 114 in 8e2a4bf

.switchIfEmpty(chain.filter(exchange).then(Mono.empty()))

        @Override
	public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
		return this.requiresAuthenticationMatcher.matches(exchange)
			.filter((matchResult) -> matchResult.isMatch())
			.flatMap((matchResult) -> this.authenticationConverter.convert(exchange))
			.switchIfEmpty(chain.filter(exchange).then(Mono.empty()))
			.flatMap((token) -> authenticate(exchange, chain, token))
			.onErrorResume(AuthenticationException.class, (ex) -> this.authenticationFailureHandler
				.onAuthenticationFailure(new WebFilterExchange(exchange, chain), ex));
	}

The .switchIfEmpty() here is actually assembling the filter chain on downstream subscription, rather than deferring it until it is needed. Shouldn't that line be more like:

.switchIfEmpy(Mono.defer(() -> chain.filter(exchange).then(Mono.empty()))

And, in fact, the method directly below this one uses Mono.defer() for error cases.