Hello.
I noticed this situation with the RememberMeAuthenticationFilter filter.
When the application is launched, this filter appears at the end of the filter chain.
```0 = "DisableEncodeUrlFilter" 1 = "WebAsyncManagerIntegrationFilter" 2 = "SecurityContextPersistenceFilter" 3 = "HeaderWriterFilter" 4 = "LogoutFilter" 5 = "BasicAuthenticationFilter" 6 = "SecuritySaveContextFilter" 7 = "CachedSessionFilter" 8 = "RequestCacheAwareFilter" 9 = "SecurityContextHolderAwareRequestFilter" 10 = "RememberMeAuthenticationFilter" 11 = "AnonymousAuthenticationFilter" ...
In the FilterOrderRegistration class, its sorting is 3000, so it never gets to its turn.
Although it should go somewhere at the beginning after LogoutFilter.
Is this normal behavior?
I did not find any ways to change the sorting of RememberMeAuthenticationFilter.
**Comment From: kse-music**
If you must do it, I think you can do like this
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
DefaultSecurityFilterChain chain = http
.authorizeHttpRequests(c -> c.anyRequest().permitAll())
.rememberMe(Customizer.withDefaults())
.build();
List<Filter> filters = new ArrayList<>(chain.getFilters().size());
for (Filter filter : chain.getFilters()) {
if (filter instanceof RememberMeAuthenticationFilter) {
filters.add(7, filter);//set position
continue;
}
filters.add(filter);
}
return new DefaultSecurityFilterChain(chain.getRequestMatcher(), filters);
}
```
Comment From: daromnik
I can change it programmatically, I agree, but I wonder why this filter appears at the end of the list by default, maybe it's a bug?