To ensure that the OncePerRequestFilter works when the servlet API is used directly it would be nice to update OncePerRequestFilter.isAsyncDispatch to use HttpServletRequest.getDispatcherType()

@Override
protected boolean isAsyncDispatch(HttpServletRequest request) {
    return request.getDispatcherType() == DispatcherType.ASYNC;
}

See https://github.com/spring-projects/spring-security/issues/4211

Comment From: slyoldfox

@rstoyanchev I just had this NPE in a unit test when moving from Spring Boot 2.4.1 to Spring Boot 2.4.3.

It might be safer to flip the arguments in:

    protected boolean isAsyncDispatch(HttpServletRequest request) {
        return request.getDispatcherType().equals(DispatcherType.ASYNC);
    }

Comment From: sbrannen

@slyoldfox, can you please create a new GitHub issue to track that NPE?

Comment From: sbrannen

@slyoldfox, out of curiosity, are you invoking org.springframework.mock.web.MockHttpServletRequest.setDispatcherType(DispatcherType) with a null value somewhere in your tests?

Comment From: slyoldfox

@sbrannen it was a silly mockito mock of HttpServletRequest.class I have outlined it in the linked issue, thanks for the update :-)